-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
- -------------------------------------------------------------------------
Debian Security Advisory DSA-6496-1 [email protected]
https://www.debian.org/security/ Aron Xu
September 12, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : nginx
CVE ID : CVE-2026-42533 CVE-2026-56434 CVE-2026-60005
Multiple vulnerabilities were discovered in nginx, a high-performance web
and reverse proxy server, which may result in denial of service, memory
disclosure or potentially the execution of arbitrary code.
CVE-2026-42533
A heap buffer overflow was discovered in the nginx script engine. It
can be triggered when a map directive performs regular expression
matching and a string expression references captures modified by the
map, or when non-cacheable variables change between the script length
pass and the script copy pass.
CVE-2026-56434
Duplicate finalization of an HTTP subrequest can result in a
use-after-free. The issue is observable in configurations using
server-side includes together with proxy_pass and proxy_buffering
disabled, when an upstream response causes the same subrequest to be
posted twice.
CVE-2026-60005
ngx_http_regex_exec() could replace the captures array without
clearing r->ncaptures when the new regular expression did not match.
A subsequent unnamed capture could then access uninitialised memory,
resulting in memory disclosure.
For the stable distribution (trixie), these problems have been fixed in
version 1.26.3-3+deb13u8.
We recommend that you upgrade your nginx packages.
For the detailed security status of nginx please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/nginx
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: [email protected]
-----BEGIN PGP SIGNATURE-----
iQEzBAEBCAAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmqlMZMACgkQ+GQ1dHE8
m67lZwf/c9UOwIsnBApKnIU2iBsmyDF6uPUe1dSXTZE4Fy/8PDuZ4K3PF6QBQZLC
LXjDOrGHH9zZBBf9JOVo46WV5+mQWhPCjNzMFu5TyAizZOrkmeU3RUVlfzO7rmEA
nmMV7qK9qxlYiSvcdm+BMeu/4E65El7aSCsuYgsIGbWq9q7znddcLshLxL81HmIc
9fpO1mH7xLe9hMutqEFx/XQUP5yBOeqSCcyqjiFWTYLvtmeyi2CQxgOC1IhupZl/
4yMAInKzrM7kFao8Aj4zq7suLwAsK3RObCo4StYhawxuvnLYZZJ6NCOUl7Sg0ZCK
u61sOd+aw0zlNfsdpGBWKprm8cTGeA==
=W7Hj
-----END PGP SIGNATURE-----
