From 9b332333cd461e32fdd670abf040c54cbb67628d Mon Sep 17 00:00:00 2001 From: Hetvi Thakar Date: Thu, 15 Oct 2026 20:20:55 -0700 Subject: [PATCH] nginx: Ignore CVE-2026-40460 Analysis: - CVE-2026-40460 affects nginx only when the HTTP/3 QUIC module is enabled [1]. - The module requires the explicit --with-http_v3_module configure option, which neither Wrynose nginx recipe enables by default [2]. - Mark the CVE not applicable only when that option is absent; report it as unpatched when a bbappend enables the module. Reference: [1] https://nginx.org/en/security_advisories.html [2] https://nginx.org/en/docs/configure.html Signed-off-by: Hetvi Thakar Signed-off-by: Anuj Mittal --- meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb | 1 + meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb | 1 + 2 files changed, 2 insertions(+) diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb index 56050b84eb..ca8e7129fb 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb @@ -23,3 +23,4 @@ SRC_URI[sha256sum] = "2c96a946bfb0882a21744ed429770a2123ae1828c7c48665092993ddee CVE_STATUS[CVE-2025-53859] = "cpe-stable-backport: Fix is included in 1.28.1" CVE_STATUS[CVE-2026-1642] = "fixed-version: fixed since v1.28.2" +CVE_STATUS[CVE-2026-40460] = "${@ 'unpatched' if '--with-http_v3_module' in ((d.getVar('EXTRA_OECONF') or '').split() + (d.getVar('PACKAGECONFIG_CONFARGS') or '').split()) else 'not-applicable-config: ngx_http_v3_module is not enabled'}" diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb index 68015a12fa..2aae2091a0 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb @@ -25,3 +25,4 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=79da1c70d587d3a199af9255ad393f99" SRC_URI[sha256sum] = "673f8fb8c0961c44fbd9410d6161831453609b44063d3f2948253fc2b5692139" +CVE_STATUS[CVE-2026-40460] = "${@ 'unpatched' if '--with-http_v3_module' in ((d.getVar('EXTRA_OECONF') or '').split() + (d.getVar('PACKAGECONFIG_CONFARGS') or '').split()) else 'not-applicable-config: ngx_http_v3_module is not enabled'}"