<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div dir="auto">
<div dir="auto">FYI Maxim the fix for the buffer overrun in rewrite is a one line patch.</div>
<div dir="auto"><br>
</div>
<div dir="auto"><br>
</div>
<div dir="auto"><br>
</div>
<div id="x_composer_signature" dir="auto">
<div dir="auto" style="font-size:14px; color:#909090">Sent from my Galaxy</div>
</div>
<div dir="auto"><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>-------- Original message --------</div>
<div>From: Maxim Dounin <mdounin@mdounin.ru> </div>
<div>Date: 5/14/26 20:09 (GMT-05:00) </div>
<div>To: nginx@freenginx.org </div>
<div>Subject: Re: CVE status </div>
<div><br>
</div>
</div>
<font size="2"><span style="font-size:11pt;">
<div class="PlainText">Hello!<br>
<br>
On Thu, May 14, 2026 at 02:15:35PM -0700, bayberry.uninspired694@aceecat.org wrote:<br>
<br>
> Hi,<br>
> <br>
> does CVE-2026-42945 apply to freenginx? And if yes, will there be a point<br>
> release to fix it?<br>
> <br>
> Here's the reference:<br>
> <br>
> <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42945">https://nvd.nist.gov/vuln/detail/CVE-2026-42945</a><br>
<br>
It does apply.<br>
<br>
Note though that triggering this bug requires rather specific <br>
configuration (a matched "rewrite" which changes request arguments <br>
but continues rewrite processing, that is, without "break" or any <br>
other flags, followed by a "set" or "if" which uses positional <br>
captures or another matched rewrite which uses positional captures and <br>
additional variables or duplicate positional captures), and <br>
therefore most configurations won't be affected at all. As a <br>
reference point, none of the examples provided in the rewrite <br>
documentation are affected.<br>
<br>
I'm currently looking into this, as well as other issues published <br>
by F5, and will provide appropriate patches shortly. Once patches <br>
are ready, there will be a release.<br>
<br>
-- <br>
Maxim Dounin<br>
<a href="http://mdounin.ru/">http://mdounin.ru/</a><br>
</div>
</span></font>
</body>
</html>