Skip to content

Commit 52f0f8d

Browse files
CBL-Mariner-Botazurelinux-securityKanishk-Bansaljslobodzian
authored
Merge PR "[AUTO-CHERRYPICK] [AutoPR- Security] Patch nginx for CVE-2026-32647, CVE-2026-28753, CVE-2026-27784, CVE-2026-27654, CVE-2026-27651, CVE-2026-28755 [HIGH] - branch main" #16331
Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com> Co-authored-by: jslobodzian <joslobo@microsoft.com>
1 parent 742fd10 commit 52f0f8d

File tree

7 files changed

+430
-2
lines changed

7 files changed

+430
-2
lines changed

‎SPECS/nginx/CVE-2026-27651.patch‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
From 13304121a32b610d8decc84dd98ec411ce2bbd7f Mon Sep 17 00:00:00 2001
2+
From: Sergey Kandaurov <pluknet@nginx.com>
3+
Date: Wed, 18 Mar 2026 16:39:37 +0400
4+
Subject: [PATCH] Mail: fixed clearing s->passwd in auth http requests.
5+
6+
Previously, it was not properly cleared retaining length as part of
7+
authenticating with CRAM-MD5 and APOP methods that expect to receive
8+
password in auth response. This resulted in null pointer dereference
9+
and worker process crash in subsequent auth attempts with CRAM-MD5.
10+
11+
Reported by Arkadi Vainbrand.
12+
13+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
14+
Upstream-reference: https://github.com/nginx/nginx/commit/0f71dd8ea94ab8c123413b2e465be12a35392e9c.patch
15+
---
16+
src/mail/ngx_mail_auth_http_module.c | 2 +-
17+
1 file changed, 1 insertion(+), 1 deletion(-)
18+
19+
diff --git a/src/mail/ngx_mail_auth_http_module.c b/src/mail/ngx_mail_auth_http_module.c
20+
index 27f64b9..d931183 100644
21+
--- a/src/mail/ngx_mail_auth_http_module.c
22+
+++ b/src/mail/ngx_mail_auth_http_module.c
23+
@@ -1325,7 +1325,7 @@ ngx_mail_auth_http_create_request(ngx_mail_session_t *s, ngx_pool_t *pool,
24+
b->last = ngx_cpymem(b->last, "Auth-Salt: ", sizeof("Auth-Salt: ") - 1);
25+
b->last = ngx_copy(b->last, s->salt.data, s->salt.len);
26+
27+
- s->passwd.data = NULL;
28+
+ ngx_str_null(&s->passwd);
29+
}
30+
31+
b->last = ngx_cpymem(b->last, "Auth-Protocol: ",
32+
--
33+
2.45.4
34+

‎SPECS/nginx/CVE-2026-27654.patch‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
From c0b2a4a7d85256349ce257602409367e6c797a7a Mon Sep 17 00:00:00 2001
2+
From: Roman Arutyunyan <arut@nginx.com>
3+
Date: Mon, 16 Mar 2026 20:13:03 +0400
4+
Subject: [PATCH] Dav: destination length validation for COPY and MOVE.
5+
6+
Previously, when alias was used in a location with Dav COPY or MOVE
7+
enabled, and the destination URI was shorter than the alias, integer
8+
underflow could happen in ngx_http_map_uri_to_path(), which could
9+
result in heap buffer overwrite, followed by a possible segfault.
10+
With some implementations of memcpy(), the segfault could be avoided
11+
and the overwrite could result in a change of the source or destination
12+
file names to be outside of the location root.
13+
14+
Reported by Calif.io in collaboration with Claude and Anthropic Research.
15+
16+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
17+
Upstream-reference: https://github.com/nginx/nginx/commit/a1d18284e0a173c4ef2b28425535d0f640ae0a82.patch
18+
---
19+
src/http/modules/ngx_http_dav_module.c | 39 +++++++++++++++++---------
20+
1 file changed, 26 insertions(+), 13 deletions(-)
21+
22+
diff --git a/src/http/modules/ngx_http_dav_module.c b/src/http/modules/ngx_http_dav_module.c
23+
index 0cc9ae1..2caf4b0 100644
24+
--- a/src/http/modules/ngx_http_dav_module.c
25+
+++ b/src/http/modules/ngx_http_dav_module.c
26+
@@ -535,19 +535,20 @@ ngx_http_dav_mkcol_handler(ngx_http_request_t *r, ngx_http_dav_loc_conf_t *dlcf)
27+
static ngx_int_t
28+
ngx_http_dav_copy_move_handler(ngx_http_request_t *r)
29+
{
30+
- u_char *p, *host, *last, ch;
31+
- size_t len, root;
32+
- ngx_err_t err;
33+
- ngx_int_t rc, depth;
34+
- ngx_uint_t overwrite, slash, dir, flags;
35+
- ngx_str_t path, uri, duri, args;
36+
- ngx_tree_ctx_t tree;
37+
- ngx_copy_file_t cf;
38+
- ngx_file_info_t fi;
39+
- ngx_table_elt_t *dest, *over;
40+
- ngx_ext_rename_file_t ext;
41+
- ngx_http_dav_copy_ctx_t copy;
42+
- ngx_http_dav_loc_conf_t *dlcf;
43+
+ u_char *p, *host, *last, ch;
44+
+ size_t len, root;
45+
+ ngx_err_t err;
46+
+ ngx_int_t rc, depth;
47+
+ ngx_uint_t overwrite, slash, dir, flags;
48+
+ ngx_str_t path, uri, duri, args;
49+
+ ngx_tree_ctx_t tree;
50+
+ ngx_copy_file_t cf;
51+
+ ngx_file_info_t fi;
52+
+ ngx_table_elt_t *dest, *over;
53+
+ ngx_ext_rename_file_t ext;
54+
+ ngx_http_dav_copy_ctx_t copy;
55+
+ ngx_http_dav_loc_conf_t *dlcf;
56+
+ ngx_http_core_loc_conf_t *clcf;
57+
58+
if (r->headers_in.content_length_n > 0 || r->headers_in.chunked) {
59+
ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
60+
@@ -644,6 +645,18 @@ destination_done:
61+
return NGX_HTTP_CONFLICT;
62+
}
63+
64+
+ clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);
65+
+
66+
+ if (clcf->alias
67+
+ && clcf->alias != NGX_MAX_SIZE_T_VALUE
68+
+ && duri.len < clcf->alias)
69+
+ {
70+
+ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
71+
+ "client sent invalid \"Destination\" header: \"%V\"",
72+
+ &dest->value);
73+
+ return NGX_HTTP_BAD_REQUEST;
74+
+ }
75+
+
76+
depth = ngx_http_dav_depth(r, NGX_HTTP_DAV_INFINITY_DEPTH);
77+
78+
if (depth != NGX_HTTP_DAV_INFINITY_DEPTH) {
79+
--
80+
2.45.4
81+

‎SPECS/nginx/CVE-2026-27784.patch‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
From d19a77f3ed7c32cf51424c6e5a7ba26dc90c814b Mon Sep 17 00:00:00 2001
2+
From: Roman Arutyunyan <arut@nginx.com>
3+
Date: Mon, 2 Mar 2026 21:12:34 +0400
4+
Subject: [PATCH] Mp4: fixed possible integer overflow on 32-bit platforms.
5+
6+
Previously, a 32-bit overflow could happen while validating atom entries
7+
count. This allowed processing of an invalid atom with entrires beyond
8+
its boundaries with reads and writes outside of the allocated mp4 buffer.
9+
10+
Reported by Prabhav Srinath (sprabhav7).
11+
12+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
13+
Upstream-reference: https://github.com/nginx/nginx/commit/b23ac73b00313d159a99636c21ef71b828781018.patch
14+
---
15+
src/http/modules/ngx_http_mp4_module.c | 14 +++++++-------
16+
1 file changed, 7 insertions(+), 7 deletions(-)
17+
18+
diff --git a/src/http/modules/ngx_http_mp4_module.c b/src/http/modules/ngx_http_mp4_module.c
19+
index dfada7c..672b4a8 100644
20+
--- a/src/http/modules/ngx_http_mp4_module.c
21+
+++ b/src/http/modules/ngx_http_mp4_module.c
22+
@@ -2293,7 +2293,7 @@ ngx_http_mp4_read_stts_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
23+
"mp4 time-to-sample entries:%uD", entries);
24+
25+
if (ngx_mp4_atom_data_size(ngx_mp4_stts_atom_t)
26+
- + entries * sizeof(ngx_mp4_stts_entry_t) > atom_data_size)
27+
+ + (uint64_t) entries * sizeof(ngx_mp4_stts_entry_t) > atom_data_size)
28+
{
29+
ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
30+
"\"%s\" mp4 stts atom too small", mp4->file.name.data);
31+
@@ -2596,7 +2596,7 @@ ngx_http_mp4_read_stss_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
32+
atom->last = atom_table;
33+
34+
if (ngx_mp4_atom_data_size(ngx_http_mp4_stss_atom_t)
35+
- + entries * sizeof(uint32_t) > atom_data_size)
36+
+ + (uint64_t) entries * sizeof(uint32_t) > atom_data_size)
37+
{
38+
ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
39+
"\"%s\" mp4 stss atom too small", mp4->file.name.data);
40+
@@ -2801,7 +2801,7 @@ ngx_http_mp4_read_ctts_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
41+
atom->last = atom_table;
42+
43+
if (ngx_mp4_atom_data_size(ngx_mp4_ctts_atom_t)
44+
- + entries * sizeof(ngx_mp4_ctts_entry_t) > atom_data_size)
45+
+ + (uint64_t) entries * sizeof(ngx_mp4_ctts_entry_t) > atom_data_size)
46+
{
47+
ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
48+
"\"%s\" mp4 ctts atom too small", mp4->file.name.data);
49+
@@ -2983,7 +2983,7 @@ ngx_http_mp4_read_stsc_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
50+
"sample-to-chunk entries:%uD", entries);
51+
52+
if (ngx_mp4_atom_data_size(ngx_mp4_stsc_atom_t)
53+
- + entries * sizeof(ngx_mp4_stsc_entry_t) > atom_data_size)
54+
+ + (uint64_t) entries * sizeof(ngx_mp4_stsc_entry_t) > atom_data_size)
55+
{
56+
ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
57+
"\"%s\" mp4 stsc atom too small", mp4->file.name.data);
58+
@@ -3361,7 +3361,7 @@ ngx_http_mp4_read_stsz_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
59+
60+
if (size == 0) {
61+
if (ngx_mp4_atom_data_size(ngx_mp4_stsz_atom_t)
62+
- + entries * sizeof(uint32_t) > atom_data_size)
63+
+ + (uint64_t) entries * sizeof(uint32_t) > atom_data_size)
64+
{
65+
ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
66+
"\"%s\" mp4 stsz atom too small",
67+
@@ -3520,7 +3520,7 @@ ngx_http_mp4_read_stco_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
68+
ngx_log_debug1(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, "chunks:%uD", entries);
69+
70+
if (ngx_mp4_atom_data_size(ngx_mp4_stco_atom_t)
71+
- + entries * sizeof(uint32_t) > atom_data_size)
72+
+ + (uint64_t) entries * sizeof(uint32_t) > atom_data_size)
73+
{
74+
ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
75+
"\"%s\" mp4 stco atom too small", mp4->file.name.data);
76+
@@ -3736,7 +3736,7 @@ ngx_http_mp4_read_co64_atom(ngx_http_mp4_file_t *mp4, uint64_t atom_data_size)
77+
ngx_log_debug1(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, "chunks:%uD", entries);
78+
79+
if (ngx_mp4_atom_data_size(ngx_mp4_co64_atom_t)
80+
- + entries * sizeof(uint64_t) > atom_data_size)
81+
+ + (uint64_t) entries * sizeof(uint64_t) > atom_data_size)
82+
{
83+
ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0,
84+
"\"%s\" mp4 co64 atom too small", mp4->file.name.data);
85+
--
86+
2.45.4
87+

‎SPECS/nginx/CVE-2026-28753.patch‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
From d929965584a814f3f67b56f340b5573b83f21da1 Mon Sep 17 00:00:00 2001
2+
From: Roman Arutyunyan <arut@nginx.com>
3+
Date: Thu, 26 Feb 2026 11:52:53 +0400
4+
Subject: [PATCH] Mail: host validation.
5+
6+
Now host name resolved from client address is validated to only contain
7+
the characters specified in RFC 1034, Section 3.5. The validation allows
8+
to avoid injections when using the resolved host name in auth_http and
9+
smtp proxy.
10+
11+
Reported by Asim Viladi Oglu Manizada, Colin Warren,
12+
Xiao Liu (Yunnan University), Yuan Tan (UC Riverside), and
13+
Bird Liu (Lanzhou University).
14+
15+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
16+
Upstream-reference: https://github.com/nginx/nginx/commit/6a8513761fb327f67fcc6cfcf1ad216887e2589f.patch
17+
---
18+
src/mail/ngx_mail_smtp_handler.c | 45 ++++++++++++++++++++++++++++++++
19+
1 file changed, 45 insertions(+)
20+
21+
diff --git a/src/mail/ngx_mail_smtp_handler.c b/src/mail/ngx_mail_smtp_handler.c
22+
index e68ceed..e477741 100644
23+
--- a/src/mail/ngx_mail_smtp_handler.c
24+
+++ b/src/mail/ngx_mail_smtp_handler.c
25+
@@ -13,6 +13,7 @@
26+
27+
28+
static void ngx_mail_smtp_resolve_addr_handler(ngx_resolver_ctx_t *ctx);
29+
+static ngx_int_t ngx_mail_smtp_validate_host(ngx_str_t *name);
30+
static void ngx_mail_smtp_resolve_name(ngx_event_t *rev);
31+
static void ngx_mail_smtp_resolve_name_handler(ngx_resolver_ctx_t *ctx);
32+
static void ngx_mail_smtp_block_reading(ngx_event_t *rev);
33+
@@ -127,6 +128,20 @@ ngx_mail_smtp_resolve_addr_handler(ngx_resolver_ctx_t *ctx)
34+
return;
35+
}
36+
37+
+ if (ngx_mail_smtp_validate_host(&ctx->name) != NGX_OK) {
38+
+ ngx_log_error(NGX_LOG_ERR, c->log, 0,
39+
+ "%V resolved to invalid host name \"%V\"",
40+
+ &c->addr_text, &ctx->name);
41+
+
42+
+ s->host = smtp_tempunavail;
43+
+
44+
+ ngx_resolve_addr_done(ctx);
45+
+
46+
+ ngx_mail_smtp_greeting(s, s->connection);
47+
+
48+
+ return;
49+
+ }
50+
+
51+
c->log->action = "in resolving client hostname";
52+
53+
s->host.data = ngx_pstrdup(c->pool, &ctx->name);
54+
@@ -149,6 +164,36 @@ ngx_mail_smtp_resolve_addr_handler(ngx_resolver_ctx_t *ctx)
55+
}
56+
57+
58+
+static ngx_int_t
59+
+ngx_mail_smtp_validate_host(ngx_str_t *name)
60+
+{
61+
+ u_char ch;
62+
+ ngx_uint_t i;
63+
+
64+
+ if (name->len == 0) {
65+
+ return NGX_DECLINED;
66+
+ }
67+
+
68+
+ for (i = 0; i < name->len; i++) {
69+
+ ch = name->data[i];
70+
+
71+
+ /* allow only characters from RFC 1034, Section 3.5 */
72+
+
73+
+ if ((ch >= 'a' && ch <= 'z')
74+
+ || (ch >= 'A' && ch <= 'Z')
75+
+ || (ch >= '0' && ch <= '9')
76+
+ || ch == '-' || ch == '.')
77+
+ {
78+
+ continue;
79+
+ }
80+
+
81+
+ return NGX_DECLINED;
82+
+ }
83+
+
84+
+ return NGX_OK;
85+
+}
86+
+
87+
+
88+
static void
89+
ngx_mail_smtp_resolve_name(ngx_event_t *rev)
90+
{
91+
--
92+
2.45.4
93+

‎SPECS/nginx/CVE-2026-28755.patch‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
From 27517a55c8999812ef72ca75ef2348104580bc0a Mon Sep 17 00:00:00 2001
2+
From: Sergey Kandaurov <pluknet@nginx.com>
3+
Date: Tue, 17 Mar 2026 19:20:03 +0400
4+
Subject: [PATCH] Stream: fixed client certificate validation with OCSP.
5+
6+
Check for OCSP status was missed in 581cf2267, resulting
7+
in a broken validation.
8+
9+
Reported by Mufeed VH of Winfunc Research.
10+
11+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
12+
Upstream-reference: https://github.com/nginx/nginx/commit/78f581487706f2e43eea5a060c516fc4d98090e8.patch
13+
---
14+
src/stream/ngx_stream_ssl_module.c | 10 ++++++++++
15+
1 file changed, 10 insertions(+)
16+
17+
diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c
18+
index c530832..3209fed 100644
19+
--- a/src/stream/ngx_stream_ssl_module.c
20+
+++ b/src/stream/ngx_stream_ssl_module.c
21+
@@ -335,6 +335,7 @@ ngx_stream_ssl_handler(ngx_stream_session_t *s)
22+
long rc;
23+
X509 *cert;
24+
ngx_int_t rv;
25+
+ const char *str;
26+
ngx_connection_t *c;
27+
ngx_stream_ssl_conf_t *sslcf;
28+
29+
@@ -385,6 +386,15 @@ ngx_stream_ssl_handler(ngx_stream_session_t *s)
30+
31+
X509_free(cert);
32+
}
33+
+
34+
+ if (ngx_ssl_ocsp_get_status(c, &str) != NGX_OK) {
35+
+ ngx_log_error(NGX_LOG_INFO, c->log, 0,
36+
+ "client SSL certificate verify error: %s", str);
37+
+
38+
+ ngx_ssl_remove_cached_session(c->ssl->session_ctx,
39+
+ (SSL_get0_session(c->ssl->connection)));
40+
+ return NGX_ERROR;
41+
+ }
42+
}
43+
44+
return NGX_OK;
45+
--
46+
2.45.4
47+

0 commit comments

Comments
 (0)