From cd674e9d1568d8c2aa4c41b36638c01a8c73796b Mon Sep 17 00:00:00 2001 From: Hetvi Thakar Date: Thu, 15 Oct 2026 20:20:51 -0700 Subject: [PATCH] nginx: fix CVE-2026-42055 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. Use version-specific backports: nginx 1.28.3 contains only the affected gRPC module, while nginx 1.29.7 also contains ngx_http_proxy_v2_module and therefore carries the complete upstream changes for both modules. [1] https://github.com/nginx/nginx/commit/131be8514da8985b15b74150521afedbf9cc4ea3 [2] https://nginx.org/en/security_advisories.html Signed-off-by: Hetvi Thakar Signed-off-by: Anuj Mittal --- .../nginx/nginx-1.28.3/CVE-2026-42055.patch | 108 ++++++++++ .../nginx/nginx-1.29.7/CVE-2026-42055.patch | 188 ++++++++++++++++++ .../recipes-httpd/nginx/nginx_1.28.3.bb | 1 + .../recipes-httpd/nginx/nginx_1.29.7.bb | 1 + 4 files changed, 298 insertions(+) create mode 100644 meta-webserver/recipes-httpd/nginx/nginx-1.28.3/CVE-2026-42055.patch create mode 100644 meta-webserver/recipes-httpd/nginx/nginx-1.29.7/CVE-2026-42055.patch diff --git a/meta-webserver/recipes-httpd/nginx/nginx-1.28.3/CVE-2026-42055.patch b/meta-webserver/recipes-httpd/nginx/nginx-1.28.3/CVE-2026-42055.patch new file mode 100644 index 0000000000..ce16a9279d --- /dev/null +++ b/meta-webserver/recipes-httpd/nginx/nginx-1.28.3/CVE-2026-42055.patch @@ -0,0 +1,108 @@ +From 131be8514da8985b15b74150521afedbf9cc4ea3 Mon Sep 17 00:00:00 2001 +From: Roman Arutyunyan +Date: Tue, 2 Jun 2026 19:37:17 +0400 +Subject: [PATCH] Upstream: limit header length for HTTP/2 and gRPC + +The change applies the HTTP/2 header length limits to avoid buffer +overflow. See 58a7bc3406ac for details. + +Reported by Mufeed VH of Winfunc Research. + +CVE: CVE-2026-42055 +Upstream-Status: Backport [https://github.com/nginx/nginx/commit/131be8514da8985b15b74150521afedbf9cc4ea3] + +Backport Changes: +- Dropped the ngx_http_proxy_v2_module.c hunk because that module is not + available in nginx 1.28.3. Retained the ngx_http_grpc_module.c fix. + +(cherry picked from commit 131be8514da8985b15b74150521afedbf9cc4ea3) +Signed-off-by: Hetvi Thakar +--- + src/http/modules/ngx_http_grpc_module.c | 44 +++++++++++++++++++++++++ + 1 file changed, 44 insertions(+) + +diff --git a/src/http/modules/ngx_http_grpc_module.c b/src/http/modules/ngx_http_grpc_module.c +index 80046d6a4..84ce51265 100644 +--- a/src/http/modules/ngx_http_grpc_module.c ++++ b/src/http/modules/ngx_http_grpc_module.c +@@ -749,6 +749,12 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + tmp_len = 0; + + } else { ++ if (r->method_name.len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 method: \"%V\"", &r->method_name); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + r->method_name.len; + tmp_len = r->method_name.len; + } +@@ -769,6 +775,12 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + uri_len = r->uri.len + escape + sizeof("?") - 1 + r->args.len; + } + ++ if (uri_len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 URI"); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + uri_len; + + if (tmp_len < uri_len) { +@@ -778,6 +790,12 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + /* :authority header */ + + if (!glcf->host_set) { ++ if (ctx->host.len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 host: \"%V\"", &ctx->host); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + ctx->host.len; + + if (tmp_len < ctx->host.len) { +@@ -808,6 +826,18 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + continue; + } + ++ if (key_len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 header name"); ++ return NGX_ERROR; ++ } ++ ++ if (val_len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 header value"); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + key_len + + NGX_HTTP_V2_INT_OCTETS + val_len; + +@@ -842,6 +872,20 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + continue; + } + ++ if (header[i].key.len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 header name: \"%V\"", ++ &header[i].key); ++ return NGX_ERROR; ++ } ++ ++ if (header[i].value.len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 header value: \"%V: %V\"", ++ &header[i].key, &header[i].value); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + header[i].key.len + + NGX_HTTP_V2_INT_OCTETS + header[i].value.len; + +-- +2.35.6 diff --git a/meta-webserver/recipes-httpd/nginx/nginx-1.29.7/CVE-2026-42055.patch b/meta-webserver/recipes-httpd/nginx/nginx-1.29.7/CVE-2026-42055.patch new file mode 100644 index 0000000000..c10ab2dbc0 --- /dev/null +++ b/meta-webserver/recipes-httpd/nginx/nginx-1.29.7/CVE-2026-42055.patch @@ -0,0 +1,188 @@ +From 131be8514da8985b15b74150521afedbf9cc4ea3 Mon Sep 17 00:00:00 2001 +From: Roman Arutyunyan +Date: Tue, 2 Jun 2026 19:37:17 +0400 +Subject: [PATCH] Upstream: limit header length for HTTP/2 and gRPC + +The change applies the HTTP/2 header length limits to avoid buffer +overflow. See 58a7bc3406ac for details. + +Reported by Mufeed VH of Winfunc Research. + +CVE: CVE-2026-42055 +Upstream-Status: Backport [https://github.com/nginx/nginx/commit/131be8514da8985b15b74150521afedbf9cc4ea3] + +(cherry picked from commit 131be8514da8985b15b74150521afedbf9cc4ea3) +Signed-off-by: Hetvi Thakar +--- + src/http/modules/ngx_http_grpc_module.c | 44 +++++++++++++++++++++ + src/http/modules/ngx_http_proxy_v2_module.c | 44 +++++++++++++++++++++ + 2 files changed, 88 insertions(+) + +diff --git a/src/http/modules/ngx_http_grpc_module.c b/src/http/modules/ngx_http_grpc_module.c +index cc3aebe59..1895ef31b 100644 +--- a/src/http/modules/ngx_http_grpc_module.c ++++ b/src/http/modules/ngx_http_grpc_module.c +@@ -749,6 +749,12 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + tmp_len = 0; + + } else { ++ if (r->method_name.len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 method: \"%V\"", &r->method_name); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + r->method_name.len; + tmp_len = r->method_name.len; + } +@@ -769,6 +775,12 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + uri_len = r->uri.len + escape + sizeof("?") - 1 + r->args.len; + } + ++ if (uri_len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 URI"); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + uri_len; + + if (tmp_len < uri_len) { +@@ -778,6 +790,12 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + /* :authority header */ + + if (!glcf->host_set) { ++ if (ctx->host.len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 host: \"%V\"", &ctx->host); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + ctx->host.len; + + if (tmp_len < ctx->host.len) { +@@ -808,6 +826,18 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + continue; + } + ++ if (key_len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 header name"); ++ return NGX_ERROR; ++ } ++ ++ if (val_len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 header value"); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + key_len + + NGX_HTTP_V2_INT_OCTETS + val_len; + +@@ -842,6 +872,20 @@ ngx_http_grpc_create_request(ngx_http_request_t *r) + continue; + } + ++ if (header[i].key.len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 header name: \"%V\"", ++ &header[i].key); ++ return NGX_ERROR; ++ } ++ ++ if (header[i].value.len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 header value: \"%V: %V\"", ++ &header[i].key, &header[i].value); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + header[i].key.len + + NGX_HTTP_V2_INT_OCTETS + header[i].value.len; + +diff --git a/src/http/modules/ngx_http_proxy_v2_module.c b/src/http/modules/ngx_http_proxy_v2_module.c +index 4c282a864..637fa9a0e 100644 +--- a/src/http/modules/ngx_http_proxy_v2_module.c ++++ b/src/http/modules/ngx_http_proxy_v2_module.c +@@ -379,6 +379,12 @@ ngx_http_proxy_v2_create_request(ngx_http_request_t *r) + tmp_len = 0; + + } else { ++ if (method.len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 method: \"%V\"", &method); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + method.len; + tmp_len = method.len; + } +@@ -419,6 +425,12 @@ ngx_http_proxy_v2_create_request(ngx_http_request_t *r) + return NGX_ERROR; + } + ++ if (uri_len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 URI"); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + uri_len; + + if (tmp_len < uri_len) { +@@ -430,6 +442,12 @@ ngx_http_proxy_v2_create_request(ngx_http_request_t *r) + host = &ctx->ctx.vars.host_header; + + if (!plcf->host_set) { ++ if (host->len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 host: \"%V\"", host); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + host->len; + + if (tmp_len < host->len) { +@@ -486,6 +504,18 @@ ngx_http_proxy_v2_create_request(ngx_http_request_t *r) + continue; + } + ++ if (key_len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 header name"); ++ return NGX_ERROR; ++ } ++ ++ if (val_len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 header value"); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + key_len + + NGX_HTTP_V2_INT_OCTETS + val_len; + +@@ -520,6 +550,20 @@ ngx_http_proxy_v2_create_request(ngx_http_request_t *r) + continue; + } + ++ if (header[i].key.len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 header name: \"%V\"", ++ &header[i].key); ++ return NGX_ERROR; ++ } ++ ++ if (header[i].value.len > NGX_HTTP_V2_MAX_FIELD) { ++ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, ++ "too long http2 header value: \"%V: %V\"", ++ &header[i].key, &header[i].value); ++ return NGX_ERROR; ++ } ++ + len += 1 + NGX_HTTP_V2_INT_OCTETS + header[i].key.len + + NGX_HTTP_V2_INT_OCTETS + header[i].value.len; + +-- +2.35.6 diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb index 94ca40e36f..a47e398422 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb @@ -7,6 +7,7 @@ SRC_URI:append = " \ file://CVE-2026-42946_p2.patch \ file://CVE-2026-42945.patch \ file://CVE-2026-9256.patch \ + file://CVE-2026-42055.patch \ " LIC_FILES_CHKSUM = "file://LICENSE;md5=3dc49537b08b14c8b66ad247bb4c4593" diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb index c5f8ea2645..bfd82d5e31 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb @@ -7,6 +7,7 @@ SRC_URI:append = " \ file://CVE-2026-42946_p2.patch \ file://CVE-2026-42945.patch \ file://CVE-2026-9256.patch \ + file://CVE-2026-42055.patch \ " # 1.28.x branch is the current stable branch, the recommended default