nginx (1.18.0-6ubuntu14.20) jammy-security; urgency=medium

  * SECURITY REGRESSION: "no buffer space in script copy" (LP: #2164558)
    - debian/patches/CVE-2026-42533.patch: disabled, pending further
      investigation.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 19 Aug 2026 12:57:30 -0400

nginx (1.18.0-6ubuntu14.19) jammy-security; urgency=medium

  * SECURITY UPDATE: DoS and possible code execution via map directive
    - debian/patches/CVE-2026-42533.patch: Fix logic in auto/modules,
      src/http/modules/ngx_http_fastcgi_module.c,
      src/http/modules/ngx_http_grpc_module.c,
      src/http/modules/ngx_http_index_module.c,
      src/http/modules/ngx_http_proxy_module.c,
      src/http/modules/ngx_http_rewrite_module.c,
      src/http/modules/ngx_http_scgi_module.c,
      src/http/modules/ngx_http_try_files_module.c,
      src/http/modules/ngx_http_uwsgi_module.c, src/http/ngx_http_script.c,
      src/http/ngx_http_script.h, src/stream/ngx_stream_script.c,
      src/stream/ngx_stream_script.h.
    - CVE-2026-42533

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 28 Jul 2026 13:56:10 -0400

nginx (1.18.0-6ubuntu14.18) jammy-security; urgency=medium

  * SECURITY REGRESSION: Security fix may break ABI (LP: #2161362)
    - debian/patches/CVE-2026-42533-*.patch: Disabled for now.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 20 Jul 2026 15:12:42 -0400

nginx (1.18.0-6ubuntu14.17) jammy-security; urgency=medium

  * SECURITY UPDATE: DoS and possible code execution via map directive
    - debian/patches/CVE-2026-42533-pre1.patch: Script: simplified copy capture
      codes. in src/http/ngx_http_script.c, src/stream/ngx_stream_script.c.
    - debian/patches/CVE-2026-42533-1.patch: Script: buffer overrun protection.
      in src/http/ngx_http_script.c, src/http/ngx_http_script.h,
      src/stream/ngx_stream_script.c, src/stream/ngx_stream_script.h.
    - debian/patches/CVE-2026-42533-2.patch: Script: buffer overrun protection
      in direct script usage. in src/http/modules/ngx_http_fastcgi_module.c,
      src/http/modules/ngx_http_grpc_module.c,
      src/http/modules/ngx_http_index_module.c,
      src/http/modules/ngx_http_proxy_module.c,
      src/http/modules/ngx_http_scgi_module.c,
      src/http/modules/ngx_http_try_files_module.c,
      src/http/modules/ngx_http_uwsgi_module.c.
    - debian/patches/CVE-2026-42533-3.patch: Script: avoid garbage at the end of
      the result string in src/http/modules/ngx_http_rewrite_module.c,
      src/http/ngx_http_script.c, src/http/ngx_http_script.h,
      src/stream/ngx_stream_script.c.
    - debian/patches/CVE-2026-42533-4.patch: Access log: buffer overrun
      protection. in src/http/modules/ngx_http_log_module.c,
      src/stream/ngx_stream_log_module.c.
    - CVE-2026-42533
  * SECURITY UPDATE: use-after-free in ngx_http_ssi_module module
    - debian/patches/CVE-2026-56434.patch: Avoid duplicate subrequest
      finalization in src/http/ngx_http_request.c.
    - CVE-2026-56434
  * SECURITY UPDATE: uninitialized memory access in ngx_http_slice_module
    - debian/patches/CVE-2026-60005.patch: Fixed uninitialized memory read
      caused by stale regex captures. in src/http/ngx_http_variables.c.
    - CVE-2026-60005

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 16 Jul 2026 09:14:55 -0400

nginx (1.18.0-6ubuntu14.16) jammy-security; urgency=medium

  * SECURITY UPDATE: heap overflow via large headers
    - debian/patches/CVE-2026-42055.patch: limit header length for HTTP/2 and
      gRPC in src/http/modules/ngx_http_grpc_module.c.
    - CVE-2026-42055
  * SECURITY UPDATE: heap overread in ngx_http_charset_module
    - debian/patches/CVE-2026-48142.patch: Charset: fixed another rare buffer
      overread in recode_from_utf8() in
      src/http/modules/ngx_http_charset_filter_module.c.
    - CVE-2026-48142

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 19 Jun 2026 09:56:31 -0400

nginx (1.18.0-6ubuntu14.15) jammy-security; urgency=medium

  * SECURITY UPDATE: HTTP/2 Bomb denial of service
    - debian/patches/CVE-2026-49975.patch: updated to patch from Debian's
      1.26.3-3+deb13u6 package which was modified to not break ABI by
      storing the information in a new ngx_http_header_count_module module.
      Thanks to Miao Wang and Jan Mojžíš for the modified patch!
    - CVE-2026-49975

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 10 Jun 2026 16:12:55 -0400

nginx (1.18.0-6ubuntu14.14) jammy-security; urgency=medium

  * SECURITY REGRESSION: ABI change breaking external modules (LP: #2155992)
    - debian/patches/CVE-2026-49975.patch: disable for now, pending further
      investigation.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 09 Jun 2026 07:45:51 -0400

nginx (1.18.0-6ubuntu14.13) jammy-security; urgency=medium

  * SECURITY UPDATE: HTTP/2 Bomb denial of service
    - debian/patches/CVE-2026-49975.patch: Added max_headers directive. in
      src/http/ngx_http_core_module.c, src/http/ngx_http_core_module.h,
      src/http/ngx_http_request.c, src/http/ngx_http_request.h,
      src/http/v2/ngx_http_v2.c.
    - CVE-2026-49975

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 05 Jun 2026 07:38:10 -0400

nginx (1.18.0-6ubuntu14.12) jammy-security; urgency=medium

  * SECURITY UPDATE: resolver use-after-free in OCSP
    - debian/patches/CVE-2026-40701.patch: OCSP: resolve cleanup on connection
      close in src/event/ngx_event_openssl_stapling.c.
    - CVE-2026-40701
  * SECURITY UPDATE: Buffer overread in the ngx_http_charset_module
    - debian/patches/CVE-2026-42934.patch: Charset: fix buffer over-read in
      recode_from_utf8(). in src/http/modules/ngx_http_charset_filter_module.c.
    - CVE-2026-42934
  * SECURITY UPDATE: Buffer overread in the ngx_http_scgi_module and
    ngx_http_uwsgi_module
    - debian/patches/CVE-2026-42946-1.patch: Upstream: reset parsing state after
      invalid status line in src/http/modules/ngx_http_scgi_module.c,
      src/http/modules/ngx_http_uwsgi_module.c.
    - debian/patches/CVE-2026-42946-2.patch: Upstream: fixed parsing of split
      status lines in src/http/modules/ngx_http_proxy_module.c,
      src/http/modules/ngx_http_scgi_module.c,
      src/http/modules/ngx_http_uwsgi_module.c.
    - CVE-2026-42946
  * SECURITY UPDATE: Buffer overflow in the ngx_http_rewrite_module
    - debian/patches/CVE-2026-9256.patch: Rewrite: fix buffer overflow with
      overlapping captures in src/http/ngx_http_script.c.
    - CVE-2026-9256

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Sat, 30 May 2026 10:32:05 -0400

nginx (1.18.0-6ubuntu14.11) jammy-security; urgency=medium

  [ Thomas Ward ]
  * SECURITY UPDATE: buffer overrun in ngx_http_rewrite_module
    (LP: #2152577)
    - d/patches/cve-2026-42945.patch: Apply upstream commit/fix
      for CVE
    - CVE-2026-42945

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 14 May 2026 09:55:52 +0200

# For older changelog entries, run 'apt-get changelog nginx-doc'
