-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 05 Jun 2026 12:23:48 +0000 Source: nginx Binary: libnginx-mod-http-geoip libnginx-mod-http-geoip-dbgsym libnginx-mod-http-image-filter libnginx-mod-http-image-filter-dbgsym libnginx-mod-http-perl libnginx-mod-http-perl-dbgsym libnginx-mod-http-xslt-filter libnginx-mod-http-xslt-filter-dbgsym libnginx-mod-mail libnginx-mod-mail-dbgsym libnginx-mod-stream libnginx-mod-stream-dbgsym libnginx-mod-stream-geoip libnginx-mod-stream-geoip-dbgsym nginx nginx-dbgsym nginx-extras Architecture: armel Version: 1.22.1-9+deb12u8 Distribution: bookworm-security Urgency: medium Maintainer: armel Build Daemon (arm-conova-02) Changed-By: Jan Mojžíš Description: libnginx-mod-http-geoip - GeoIP HTTP module for Nginx libnginx-mod-http-image-filter - HTTP image filter module for Nginx libnginx-mod-http-perl - Perl module for Nginx libnginx-mod-http-xslt-filter - XSLT Transformation module for Nginx libnginx-mod-mail - Mail module for Nginx libnginx-mod-stream - Stream module for Nginx libnginx-mod-stream-geoip - GeoIP Stream module for Nginx nginx - small, powerful, scalable web/proxy server nginx-extras - nginx web/proxy server (extended version) Changes: nginx (1.22.1-9+deb12u8) bookworm-security; urgency=medium . * Apply both patches to fix CVE-2026-42946. In the previous version, only one part of the patch was applied, so the fix was incomplete. This really fixes CVE-2026-42946, thanks to charles@debian.org for pointing it out. * d/p/CVE-2026-42946.patch rename to d/p/CVE-2026-42946.2.patch * d/p/CVE-2026-42946.1.patch add * backport fix for buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-9256) from upstream 1.30.2 nginx. * d/p/CVE-2026-9256.patch add * backport max_headers directive from upstream nginx. It limits the number of request headers accepted from clients. Fixes remote denial-of-service exploit. And move max_headers from core module to the ngx_http_header_count_module to avoid potential ABI breakage and keep all the 3rd party modules compatible with the new version of nginx without recompilation. A big thanks to Miao Wang for preparing the modification. Fixes TEMP-1138794-BADE22. * d/p/FIX-HTTP2bomb.patch add Checksums-Sha1: 69808f8ac9fd872d3f4dcb5e0516317229f20a70 36852 libnginx-mod-http-geoip-dbgsym_1.22.1-9+deb12u8_armel.deb a9a9d69a5355123f65a597f0eafc183e0cab59a1 85736 libnginx-mod-http-geoip_1.22.1-9+deb12u8_armel.deb 4e6c53060a12f5ce25ad7f6a8fa54306ebf50104 44508 libnginx-mod-http-image-filter-dbgsym_1.22.1-9+deb12u8_armel.deb 9f793cc53f12603f0e0129f99fc14f6a06899360 89696 libnginx-mod-http-image-filter_1.22.1-9+deb12u8_armel.deb 9b81c3a2cb2b6ed8ce27f9c0103044282298af6d 98492 libnginx-mod-http-perl-dbgsym_1.22.1-9+deb12u8_armel.deb 902fb5f00e47975eb9913b1dd26f69d2b4712974 95236 libnginx-mod-http-perl_1.22.1-9+deb12u8_armel.deb 86731cc8e8029ba9c2ec50178fab442f033ac763 53068 libnginx-mod-http-xslt-filter-dbgsym_1.22.1-9+deb12u8_armel.deb 50d16baaccd4d32e4443ed16e93584501470d83b 86936 libnginx-mod-http-xslt-filter_1.22.1-9+deb12u8_armel.deb eee5b5918617a1b3220e3714f8eaeb9c169756ed 109492 libnginx-mod-mail-dbgsym_1.22.1-9+deb12u8_armel.deb 445b0cb6c66b5a722f8beb8eb11e5bb6a98f24c7 115180 libnginx-mod-mail_1.22.1-9+deb12u8_armel.deb 4c49efd71369611213f49da76b652014f80a4241 173396 libnginx-mod-stream-dbgsym_1.22.1-9+deb12u8_armel.deb 9bb1398bda349ff396dcea816aa633ffd705cf83 22772 libnginx-mod-stream-geoip-dbgsym_1.22.1-9+deb12u8_armel.deb a307c82aeea5fe9013a5bcc25e989598e0519ee6 85096 libnginx-mod-stream-geoip_1.22.1-9+deb12u8_armel.deb 6abc1595af1f5339878e369bdf41f97425abb9f2 134716 libnginx-mod-stream_1.22.1-9+deb12u8_armel.deb a15a1dc6d1599eff9e0446468b1ac2d8d2586e16 1100524 nginx-dbgsym_1.22.1-9+deb12u8_armel.deb bd0fa0e645a98ebd423de5985dcea82c8345f214 81336 nginx-extras_1.22.1-9+deb12u8_armel.deb 61e5516b626814ca4a8ab7c941e5730ac3473dae 14097 nginx_1.22.1-9+deb12u8_armel-buildd.buildinfo 406b8d9621e896e0983bb851b9b4f78a50d23cbf 463568 nginx_1.22.1-9+deb12u8_armel.deb Checksums-Sha256: a588bfc57059c3299480de49b5f3ae9e979f47c5557c56757d215ad29b39a1df 36852 libnginx-mod-http-geoip-dbgsym_1.22.1-9+deb12u8_armel.deb 5cd7f3194171db59ba0d912fd5410ef0b949aba63bf0730fab5646af9c10989b 85736 libnginx-mod-http-geoip_1.22.1-9+deb12u8_armel.deb bb9bdf6caffa891d8f0a7b1093df9a20c756ff054e095a5a929dabb2ca509637 44508 libnginx-mod-http-image-filter-dbgsym_1.22.1-9+deb12u8_armel.deb c001b42f7346bb230320eb48522f1b1b6bf771d530476cdc367a9ef054a6e1e9 89696 libnginx-mod-http-image-filter_1.22.1-9+deb12u8_armel.deb 5126131fc0b7270450b5504a933e7cbaeddfe19beeb5b925b8b3feb9e33b3048 98492 libnginx-mod-http-perl-dbgsym_1.22.1-9+deb12u8_armel.deb 7dc67956d28f2ff6143b80e0e27e089a255e1ee41a64f6bcb73389bfacc31316 95236 libnginx-mod-http-perl_1.22.1-9+deb12u8_armel.deb cb72d9912c115125b00fa5978675366766b0c6530919d9faf331758e59bf0216 53068 libnginx-mod-http-xslt-filter-dbgsym_1.22.1-9+deb12u8_armel.deb 4e0a4a4ba48e7f3c2707f5215a49c1916a5d335a94f7c474988bc91a91ec9232 86936 libnginx-mod-http-xslt-filter_1.22.1-9+deb12u8_armel.deb 08b4a1d3d306c127fc7e6b53f5f43db7ac2b922e7a4a73d413960f243331bc83 109492 libnginx-mod-mail-dbgsym_1.22.1-9+deb12u8_armel.deb 68f1dea13b847e5761081442f1ce77002db2c04e78db6d54188377ead2856394 115180 libnginx-mod-mail_1.22.1-9+deb12u8_armel.deb 954ef438d7196d51d2c03261e04a637719ceb9ca6fc57b2aa7dc4fb3c7453fd7 173396 libnginx-mod-stream-dbgsym_1.22.1-9+deb12u8_armel.deb 8eeb4fc99f4b28d33b9aa893a44c8025e8c8e070271e4c1f8ab1cfa199007132 22772 libnginx-mod-stream-geoip-dbgsym_1.22.1-9+deb12u8_armel.deb f39b049cbe802aa75b74516d274420cb444d5943193d4a10195bcbc05d3059e0 85096 libnginx-mod-stream-geoip_1.22.1-9+deb12u8_armel.deb 8c667a80da71ad30ecaeb36ad40c18326024b70d33e40872c1ea58bd97e6cfcc 134716 libnginx-mod-stream_1.22.1-9+deb12u8_armel.deb bbfcb4d59400d332d06630ac84aef28f74a82bd9a49eba4a9aabb91239dfd3da 1100524 nginx-dbgsym_1.22.1-9+deb12u8_armel.deb c486b347fafc944c0acb33be0a7b26cb27f1d63e9a484d1f568518f4676db29a 81336 nginx-extras_1.22.1-9+deb12u8_armel.deb 0f42e045bde4a816597fc6f1255fab58e0e0036807b91eedf86a5d1581e6a7d9 14097 nginx_1.22.1-9+deb12u8_armel-buildd.buildinfo 240cbe5a2588947abdb8de6001941619943a1209f1bbd930a18656f2000720e5 463568 nginx_1.22.1-9+deb12u8_armel.deb Files: 7ebe4aeafac61176324c604435d98638 36852 debug optional libnginx-mod-http-geoip-dbgsym_1.22.1-9+deb12u8_armel.deb aa35906a973e4fcec0fd4f2a4ed9c524 85736 httpd optional libnginx-mod-http-geoip_1.22.1-9+deb12u8_armel.deb ed44af55f78f3ab5e828354bb79d82bf 44508 debug optional libnginx-mod-http-image-filter-dbgsym_1.22.1-9+deb12u8_armel.deb cb77ca57fc539c923eb81361b46c423c 89696 httpd optional libnginx-mod-http-image-filter_1.22.1-9+deb12u8_armel.deb 8d8e15669adbd66674e71c5316e69422 98492 debug optional libnginx-mod-http-perl-dbgsym_1.22.1-9+deb12u8_armel.deb 3d0b945d525bf59aa5f353db3f6793d3 95236 httpd optional libnginx-mod-http-perl_1.22.1-9+deb12u8_armel.deb 40a2452990d0b9f90b62fc10ab72b75a 53068 debug optional libnginx-mod-http-xslt-filter-dbgsym_1.22.1-9+deb12u8_armel.deb 4f995e05d1fd46f71d46e81441775248 86936 httpd optional libnginx-mod-http-xslt-filter_1.22.1-9+deb12u8_armel.deb 579420c0af3bfe250969686f6d17cc36 109492 debug optional libnginx-mod-mail-dbgsym_1.22.1-9+deb12u8_armel.deb b9fca09e1b5b0e1a5d244b624bd4b9db 115180 httpd optional libnginx-mod-mail_1.22.1-9+deb12u8_armel.deb eb4c03b32e9f504d8b18f36c8bcbc040 173396 debug optional libnginx-mod-stream-dbgsym_1.22.1-9+deb12u8_armel.deb 78812072ee3ad9580677f2a74d48deec 22772 debug optional libnginx-mod-stream-geoip-dbgsym_1.22.1-9+deb12u8_armel.deb 88020bef9952eba7c266b9126704703b 85096 httpd optional libnginx-mod-stream-geoip_1.22.1-9+deb12u8_armel.deb b5e96a55aa474d376945452d9451159a 134716 httpd optional libnginx-mod-stream_1.22.1-9+deb12u8_armel.deb 1854dd5aa74f4f15e42384e6463420de 1100524 debug optional nginx-dbgsym_1.22.1-9+deb12u8_armel.deb 6a14daf9fd4514c589b4ef9f5ec13d8a 81336 httpd optional nginx-extras_1.22.1-9+deb12u8_armel.deb ee2b2254f32d1149f16a59b213c8404f 14097 httpd optional nginx_1.22.1-9+deb12u8_armel-buildd.buildinfo 8cd7012d3ff6764e5acbf93b82db9f46 463568 httpd optional nginx_1.22.1-9+deb12u8_armel.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEWHj9K9pO9l4btbD1OQKMdMnEH5MFAmokMzEACgkQOQKMdMnE H5Nm6RAA8dG9oC+Cyj6x2PPCs3aOgy0pJ+z9ydrXhurorwOcrrG2C8ZNEPkgIdkC 9jKk2UlDfg8bq/k+oFnu2Ie6uTOm+NvKXfHCyfO7W3Q4IcsgWyG6vaMN3QP9xmls JstC+yR7Ctm7v8zifhtVSrEhQVHYShWoOrCYV7EMeePgpYhtLbqrj3ijcsih+OIw f385rv7EoNAYRhq1Xc/R2KtdoBhzpatpcn5kNq2UQddL/JYtc7uIJqh/TIub0FKg umZ40/MtU2T3oIk3lYAWLenw0eDhC8FTp0GHh9bIoiZBmWP7qJzRES44D3ObtNKq WATJibpRLIhpMDpEUl1bhBgO+8koYniYgdK+Zw2jWAf02j+qOsbmqzsmUvILFCcJ qoGS3I0NXgZ/ccAg58bX854d9gKFpd4fkxbT9aDXjZfXrbYwY18AsHbHNYQ+axsN HPoWEqfzfAq+r/4mY737b8WJhPyrc1YLCrS4rTCZs6U79Ihq3EfOtO6dYrikAWJD KaeVaLQfxN2jnc2G5p7RkYSL9Xo8mnNqePfho9FWGVfpmMK1/SgP8OHnGG1FeXUa TTNHYudQngkts5xNdNiL8hO/tPCqP1BeDnr2BS/LbIXfpYBlStpbPvMspl69/Gql iNz7ippEPZF02AbeDbEFmiyxsGNUZSWK3R/DdYJW4GY1kUszSlc= =GdAK -----END PGP SIGNATURE-----