From mdounin at mdounin.ru Tue Oct 27 16:20:33 2026 From: mdounin at mdounin.ru (Maxim Dounin) Date: Tue, 27 Oct 2026 19:20:33 +0300 Subject: freenginx-1.31.5 Message-ID: Changes with freenginx 1.31.5 27 Oct 2026 *) Security: one of the keys was left uninitialized when using automatic rotation of TLS session ticket keys, making it possible to forge a session and bypass client certificate verification (CVE-2026-97629); *) Bugfix: a segmentation fault might occur in a worker process if AIO was used in subrequests. *) Bugfix: in HTTP/3. -- Maxim Dounin http://freenginx.org/ From mdounin at mdounin.ru Tue Oct 27 16:20:58 2026 From: mdounin at mdounin.ru (Maxim Dounin) Date: Tue, 27 Oct 2026 19:20:58 +0300 Subject: freenginx-1.30.2 Message-ID: Changes with freenginx 1.30.2 27 Oct 2026 *) Security: one of the keys was left uninitialized when using automatic rotation of TLS session ticket keys, making it possible to forge a session and bypass client certificate verification (CVE-2026-97629); -- Maxim Dounin http://freenginx.org/