[PATCH 0 of 3] patches based on fixes by F5

[Maxim Dounin]

Hello!

The following patch series addresses issues relevant to freenginx among
those recently fixed by F5 as security issues in F5 NGINX.  In
particular:

- Fixed use of an uninitialized TLS session ticket key when automatic
  ticket key rotation is used, which makes it possible to forge SSL
  sessions and bypass SSL certificate authentication (CVE-2026-97629);

- Fixed a segmentation fault which might occur with many SSI includes
  when using AIO (CVE-2026-97205, though not considered to be a security
  issue in freenginx, see below);

- Fixed handling of unknown frames when reading a request body in the
  experimental HTTP/3 implementation (CVE-2026-95101, though not
  considered to be a security issue in freenginx, see below).


Detailed analysis of the issues fixed by F5:

    *) Security: a buffer overflow might occur in a worker process when
       using the "alias" directive if the request URI was changed by the
       "rewrite" directive and was then mapped to a file path
       (CVE-2026-15176).

Relevant commit:

Avoid post-rewrite URI to path mapping with alias
https://github.com/nginx/nginx/commit/f8a23425bd6840c4c36b4264edf576ba3646156f

In freenginx, the issue cannot happen due to mitigations introduced in
9493:aae28b083279 (freenginx 1.29.7).  Also, the security impact is
questionable, since the bug can be triggered only with a specially
crafted configuration.

    *) Security: a buffer overflow might occur in a worker process while
       evaluating string expressions with variables, which affected the
       document root calculation and request logging in the http and stream
       modules (CVE-2026-93479).
       Thanks to Matt Suiche of Tolmo Inc.

Relevant commit:

Script: reserved memory overrun protection in ngx_http_script_run()
https://github.com/nginx/nginx/commit/6aa4b3fdd4fdc156153f2981eb4070690624447c

In freenginx, the affected code is not present.  Further, since
9577:5bfb1aa8b443 (freenginx 1.31.4) the underlying problem with
incorrect length calculations is fixed.

    *) Security: when using HTTP/3 a part of an unknown frame might be
       treated as the request body, which might result in bypassing the
       "client_max_body_size" limit or injecting data in the proxied request
       (CVE-2026-95101).
       Thanks to Hansol Lee of GOTROOT.

Relevant commit:

HTTP/3: kept the skipped frame length separate from data length
https://github.com/nginx/nginx/commit/1c173a2d8767730e678c27446138d7ae5dd6fd64

The issue is valid and affects freenginx.  The patch looks good and
is included in this patch series.  However, since the issue is in the
experimental HTTP/3 code, it is not considered to be a security issue.

    *) Security: when using TLS session ticket key rotation, one of the keys
       was left uninitialized, which might allow to forge a session
       (CVE-2026-97629).
       Thanks to PhiNode Labs.

Relevant commit:

SSL: synced all session ticket keys to the worker process
https://github.com/nginx/nginx/commit/1916f26e6ca49296568633d309777e36527e5bb2

The issue is valid and affects freenginx.  The patch included in this
patch series is identical to the one from F5 (which is trivial), though
it provides a more relevant commit message.

    *) Security: when using asynchronous file I/O (AIO), use-after-free
       might occur in certain configurations if the SSI page has "include
       virtual" commands (CVE-2026-97205).
       Thanks to cyberlancer.

Relevant commit:

Limited the number of pending operations per request
https://github.com/nginx/nginx/commit/6adfc05ece48f92446383ec1f145446848694698

The issue looks valid and affects freenginx.  However, triggering the
issue requires a configuration with AIO enabled and control over a
resource processed by SSI, which is not expected to be available to
external attackers and implies at least a DoS impact.  Further,
exploiting this issue for anything beyond DoS seems unlikely.  As such,
it is not considered to be a security issue.  An alternative patch to
address this issue is included in this patch series.


-- 
Maxim Dounin