From ba349a44f962847ba3ba6b40a5d7f4cef18e58d2 Mon Sep 17 00:00:00 2001 From: Hetvi Thakar Date: Mon, 2 Nov 2026 23:04:27 -0800 Subject: [PATCH] nginx: fix CVE-2026-95101 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/nginx/nginx/commit/90b30edffea4f427608c36e3849643b6f9841bc4 [2] https://ubuntu.com/security/CVE-2026-95101 Signed-off-by: Hetvi Thakar Signed-off-by: Anuj Mittal --- .../nginx/files/CVE-2026-95101.patch | 68 +++++++++++++++++++ .../recipes-httpd/nginx/nginx_1.28.3.bb | 1 + .../recipes-httpd/nginx/nginx_1.29.7.bb | 1 + 3 files changed, 70 insertions(+) create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-95101.patch diff --git a/meta-webserver/recipes-httpd/nginx/files/CVE-2026-95101.patch b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-95101.patch new file mode 100644 index 0000000000..c70150c114 --- /dev/null +++ b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-95101.patch @@ -0,0 +1,68 @@ +From 90b30edffea4f427608c36e3849643b6f9841bc4 Mon Sep 17 00:00:00 2001 +From: Vadim Zhestikov +Date: Wed, 22 Jul 2026 17:48:55 -0700 +Subject: [PATCH] HTTP/3: kept the skipped frame length separate from data + length + +ngx_http_v3_parse_data() stored the remaining length of a skipped +(unknown) frame in st->length -- the same field the request body +filter uses for the number of DATA payload bytes to pass on as +request body. When an unknown frame was split across parser +invocations, the skip was interrupted with st->length holding the +skip remainder; on the next buffer the body filter, which calls +the parser only while st->length == 0, treated that remainder as +request body. + +When proxying, this could result in sending unframed bytes, potentially +allowing for bypass of client_max_body_size, which is enforced only on +the DATA path, or an injection. + +The fix is to keep unknown frame payload in a separate st->skip counter. + +Reported by Hansol Lee of GOTROOT. + +CVE: CVE-2026-95101 +Upstream-Status: Backport [https://github.com/nginx/nginx/commit/90b30edffea4f427608c36e3849643b6f9841bc4] + +Signed-off-by: Hetvi Thakar +--- + src/http/v3/ngx_http_v3_parse.c | 4 +++- + src/http/v3/ngx_http_v3_parse.h | 1 + + 2 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/src/http/v3/ngx_http_v3_parse.c b/src/http/v3/ngx_http_v3_parse.c +index bcbf0dbe12..ffaade8429 100644 +--- a/src/http/v3/ngx_http_v3_parse.c ++++ b/src/http/v3/ngx_http_v3_parse.c +@@ -1837,6 +1837,8 @@ ngx_http_v3_parse_data(ngx_connection_t *c, ngx_http_v3_parse_data_t *st, + st->type, st->length); + + if (st->type != NGX_HTTP_V3_FRAME_DATA && st->length > 0) { ++ st->skip = st->length; ++ st->length = 0; + st->state = sw_skip; + break; + } +@@ -1846,7 +1848,7 @@ ngx_http_v3_parse_data(ngx_connection_t *c, ngx_http_v3_parse_data_t *st, + + case sw_skip: + +- rc = ngx_http_v3_parse_skip(b, &st->length); ++ rc = ngx_http_v3_parse_skip(b, &st->skip); + if (rc != NGX_DONE) { + return rc; + } +diff --git a/src/http/v3/ngx_http_v3_parse.h b/src/http/v3/ngx_http_v3_parse.h +index ba004db5df..e161cecf7b 100644 +--- a/src/http/v3/ngx_http_v3_parse.h ++++ b/src/http/v3/ngx_http_v3_parse.h +@@ -121,6 +121,7 @@ typedef struct { + ngx_uint_t state; + ngx_uint_t type; + ngx_uint_t length; ++ ngx_uint_t skip; + ngx_http_v3_parse_varlen_int_t vlint; + } ngx_http_v3_parse_data_t; + +-- +2.35.6 diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb index d087ae8804..eaf069135a 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb @@ -15,6 +15,7 @@ SRC_URI:append = " \ file://CVE-2026-42533_p4.patch \ file://CVE-2026-42533_p5.patch \ file://CVE-2026-56434.patch \ + file://CVE-2026-95101.patch \ " LIC_FILES_CHKSUM = "file://LICENSE;md5=3dc49537b08b14c8b66ad247bb4c4593" diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb index 3b57994069..bba4788d5e 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb @@ -15,6 +15,7 @@ SRC_URI:append = " \ file://CVE-2026-42533_p4.patch \ file://CVE-2026-42533_p5.patch \ file://CVE-2026-56434.patch \ + file://CVE-2026-95101.patch \ " # 1.28.x branch is the current stable branch, the recommended default