<!DOCTYPE html><html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<p><font face="Calibri">Yeah, I believe those are other bugs and
Security fixes patched in NGINX OSS 1.31.0 and 1.30.1. Just
thought I'd make a note. (the one-line for the rewrite buffer
overrun is, however, a fix for the specific CVE referenced in
this thread. Other CVEs were also patched independently as other
commits.)</font></p>
<div class="moz-cite-prefix">On 2026-05-14 23:44, Maxim Dounin
wrote:<br>
</div>
<blockquote type="cite" cite="mid:agaWhmOkrTqe4udb@mdounin.ru">
<pre wrap="" class="moz-quote-pre">Hello!
On Fri, May 15, 2026 at 12:38:09AM +0000, Thomas Ward via nginx wrote:
</pre>
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">FYI Maxim the fix for the buffer overrun in rewrite is a one line patch.
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">
Sure, except it might not be the best solution. Based on my
analysis I tend to prefer at least three lines.
Also, I see at least one additional case of obviously incorrect
escaping applied by the related rewrite code, though without a
buffer overrun.
</pre>
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">
Sent from my Galaxy
-------- Original message --------
From: Maxim Dounin <a class="moz-txt-link-rfc2396E" href="mailto:mdounin@mdounin.ru"><mdounin@mdounin.ru></a>
Date: 5/14/26 20:09 (GMT-05:00)
To: <a class="moz-txt-link-abbreviated" href="mailto:nginx@freenginx.org">nginx@freenginx.org</a>
Subject: Re: CVE status
Hello!
On Thu, May 14, 2026 at 02:15:35PM -0700, <a class="moz-txt-link-abbreviated" href="mailto:bayberry.uninspired694@aceecat.org">bayberry.uninspired694@aceecat.org</a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="" class="moz-quote-pre">Hi,
does CVE-2026-42945 apply to freenginx? And if yes, will there be a point
release to fix it?
Here's the reference:
<a class="moz-txt-link-freetext" href="https://nvd.nist.gov/vuln/detail/CVE-2026-42945">https://nvd.nist.gov/vuln/detail/CVE-2026-42945</a>
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">
It does apply.
Note though that triggering this bug requires rather specific
configuration (a matched "rewrite" which changes request arguments
but continues rewrite processing, that is, without "break" or any
other flags, followed by a "set" or "if" which uses positional
captures or another matched rewrite which uses positional captures and
additional variables or duplicate positional captures), and
therefore most configurations won't be affected at all. As a
reference point, none of the examples provided in the rewrite
documentation are affected.
I'm currently looking into this, as well as other issues published
by F5, and will provide appropriate patches shortly. Once patches
are ready, there will be a release.
--
Maxim Dounin
<a class="moz-txt-link-freetext" href="http://mdounin.ru/">http://mdounin.ru/</a>
</pre>
</blockquote>
<pre wrap="" class="moz-quote-pre">
</pre>
</blockquote>
</body>
</html>