mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-11-12 15:31:03 +00:00
Code Issues Projects Releases Wiki Activity

nginx: Ignore CVE-2026-40460

Browse Source 
Analysis:
- CVE-2026-40460 affects nginx only when the HTTP/3
  QUIC module is enabled [1].
- The module requires the explicit --with-http_v3_module configure
  option, which neither Wrynose nginx recipe enables by default [2].
- Mark the CVE not applicable only when that option is absent; report it
  as unpatched when a bbappend enables the module.

Reference:
[1] https://nginx.org/en/security_advisories.html
[2] https://nginx.org/en/docs/configure.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Hetvi Thakar authored and Anuj Mittal committed 2026-10-28 12:31:44 +05:30
1 parent 29166e9b7a
commit 9b332333cd
2 files changed
+2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb
+1
View File
@@ -23,3 +23,4 @@ SRC_URI[sha256sum] = "2c96a946bfb0882a21744ed429770a2123ae1828c7c48665092993ddee
CVE_STATUS[CVE-2025-53859] = "cpe-stable-backport: Fix is included in 1.28.1"
CVE_STATUS[CVE-2026-1642] = "fixed-version: fixed since v1.28.2"
CVE_STATUS[CVE-2026-40460] = "${@ 'unpatched' if '--with-http_v3_module' in ((d.getVar('EXTRA_OECONF') or '').split() + (d.getVar('PACKAGECONFIG_CONFARGS') or '').split()) else 'not-applicable-config: ngx_http_v3_module is not enabled'}"
meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb
+1
View File
@@ -25,3 +25,4 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=79da1c70d587d3a199af9255ad393f99"
SRC_URI[sha256sum] = "673f8fb8c0961c44fbd9410d6161831453609b44063d3f2948253fc2b5692139"
CVE_STATUS[CVE-2026-40460] = "${@ 'unpatched' if '--with-http_v3_module' in ((d.getVar('EXTRA_OECONF') or '').split() + (d.getVar('PACKAGECONFIG_CONFARGS') or '').split()) else 'not-applicable-config: ngx_http_v3_module is not enabled'}"