-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 05 Jun 2026 12:22:02 +0000 Source: nginx Binary: libnginx-mod-http-geoip libnginx-mod-http-geoip-dbgsym libnginx-mod-http-image-filter libnginx-mod-http-image-filter-dbgsym libnginx-mod-http-perl libnginx-mod-http-perl-dbgsym libnginx-mod-http-xslt-filter libnginx-mod-http-xslt-filter-dbgsym libnginx-mod-mail libnginx-mod-mail-dbgsym libnginx-mod-stream libnginx-mod-stream-dbgsym libnginx-mod-stream-geoip libnginx-mod-stream-geoip-dbgsym nginx nginx-dbgsym nginx-extras Architecture: armhf Version: 1.26.3-3+deb13u6 Distribution: trixie-security Urgency: medium Maintainer: armhf Build Daemon (arm-conova-03) Changed-By: Jan Mojžíš Description: libnginx-mod-http-geoip - GeoIP HTTP module for Nginx libnginx-mod-http-image-filter - HTTP image filter module for Nginx libnginx-mod-http-perl - Perl module for Nginx libnginx-mod-http-xslt-filter - XSLT Transformation module for Nginx libnginx-mod-mail - Mail module for Nginx libnginx-mod-stream - Stream module for Nginx libnginx-mod-stream-geoip - GeoIP Stream module for Nginx nginx - small, powerful, scalable web/proxy server nginx-extras - nginx web/proxy server (extended version) Changes: nginx (1.26.3-3+deb13u6) trixie-security; urgency=medium . * Apply both patches to fix CVE-2026-42946. In the previous version, only one part of the patch was applied, so the fix was incomplete. This really fixes CVE-2026-42946, thanks to charles@debian.org for pointing it out. * d/p/CVE-2026-42946.patch rename to d/p/CVE-2026-42946.2.patch * d/p/CVE-2026-42946.1.patch add * backport fix for buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-9256) from upstream 1.30.2 nginx. * d/p/CVE-2026-9256.patch add * backport max_headers directive from upstream nginx. It limits the number of request headers accepted from clients. Fixes remote denial-of-service exploit. And move max_headers from core module to the ngx_http_header_count_module to avoid potential ABI breakage and keep all the 3rd party modules compatible with the new version of nginx without recompilation. A big thanks to Miao Wang for preparing the modification. Fixes TEMP-1138794-BADE22. * d/p/FIX-HTTP2bomb.patch add Checksums-Sha1: a4988c0ee56414d97f947c3a03487b8e4d8e64d2 38392 libnginx-mod-http-geoip-dbgsym_1.26.3-3+deb13u6_armhf.deb ce8463bf4969d0d5c2cec57fd1ec2bbd6ef7d692 88444 libnginx-mod-http-geoip_1.26.3-3+deb13u6_armhf.deb 738ce6386f717b267e22680f0e965deecd0636da 45824 libnginx-mod-http-image-filter-dbgsym_1.26.3-3+deb13u6_armhf.deb 553a50dabffff4aeeac2e6afdc81b4bda139766e 91704 libnginx-mod-http-image-filter_1.26.3-3+deb13u6_armhf.deb f7e8cdb379839c73a98903d7d0d84dfc1a291e1b 108368 libnginx-mod-http-perl-dbgsym_1.26.3-3+deb13u6_armhf.deb 2eb27fa4eccf347add3b5670b0a357b327908f7c 98876 libnginx-mod-http-perl_1.26.3-3+deb13u6_armhf.deb 35c15d697fe051daf80d2d206f5a1b78a14013b1 54496 libnginx-mod-http-xslt-filter-dbgsym_1.26.3-3+deb13u6_armhf.deb af6607aceda7afc7bda7987a33faa5bacfeed4c3 90328 libnginx-mod-http-xslt-filter_1.26.3-3+deb13u6_armhf.deb b756bccb78e54e6a14fb9cd39c04feea2d4c3f4c 110772 libnginx-mod-mail-dbgsym_1.26.3-3+deb13u6_armhf.deb 013df0162acd88a023387639f6c561e84096cf13 118584 libnginx-mod-mail_1.26.3-3+deb13u6_armhf.deb a3c1892f50552aea2a06c1a10dc5db5dde9f0afb 190816 libnginx-mod-stream-dbgsym_1.26.3-3+deb13u6_armhf.deb e7a35f3b84b2f59da24f379075ecc284aa295ddf 24592 libnginx-mod-stream-geoip-dbgsym_1.26.3-3+deb13u6_armhf.deb a79e90e75c60da9cb5f3224356fc157272ac2322 87732 libnginx-mod-stream-geoip_1.26.3-3+deb13u6_armhf.deb 51af38d55576f4e73ae05cc9f320be31a44696ac 143112 libnginx-mod-stream_1.26.3-3+deb13u6_armhf.deb 162233b13ab7bcad6c2dfa637644a513b4959c49 1342688 nginx-dbgsym_1.26.3-3+deb13u6_armhf.deb 1877ac8a4b46db1b0609249757a28660e413508c 84488 nginx-extras_1.26.3-3+deb13u6_armhf.deb c6a71175b71a7fb541b1a3ebc02656804d71125b 13814 nginx_1.26.3-3+deb13u6_armhf-buildd.buildinfo ee9f48ddd0664cac1a81db5efa5510224a3f14a9 550296 nginx_1.26.3-3+deb13u6_armhf.deb Checksums-Sha256: d66f1cf2acfd36162898e097d10a2841bbd6a0cc815adfeae721e71e4adb03d5 38392 libnginx-mod-http-geoip-dbgsym_1.26.3-3+deb13u6_armhf.deb d0fd3358f82bf31efc628a86d55da0e66c56f0211a8de15d89bdca8d87ec1169 88444 libnginx-mod-http-geoip_1.26.3-3+deb13u6_armhf.deb 0e094f9b36d6c0d88013d4480704e73932a55972234a6aab4f0aded0ff5ccce2 45824 libnginx-mod-http-image-filter-dbgsym_1.26.3-3+deb13u6_armhf.deb b6ded1d4fc04222dd44c089d414cd7be6151f88b70c9c5ae5f7881c843507cf2 91704 libnginx-mod-http-image-filter_1.26.3-3+deb13u6_armhf.deb ef74a3a4ff7d4227781550f6c62cfd9963371a4a2d0181cdb712ec3e3eb09e84 108368 libnginx-mod-http-perl-dbgsym_1.26.3-3+deb13u6_armhf.deb ebb2a8acc4ac5e6323ea897e5e6c8a970821d5284f0d3d71f0b2e16cceb05cce 98876 libnginx-mod-http-perl_1.26.3-3+deb13u6_armhf.deb b7b76f80e853f51c7d921d660fb4df5a42b410eee52c8c77a12b8240a22395d6 54496 libnginx-mod-http-xslt-filter-dbgsym_1.26.3-3+deb13u6_armhf.deb c3e053fe881b36d994be295c6acd90d1250fa4fb3823f74de996a3a0026acdf5 90328 libnginx-mod-http-xslt-filter_1.26.3-3+deb13u6_armhf.deb 455610e701c82b9619032d54fe1eb37bb0d9fcceaea6583b336b036ea12e1103 110772 libnginx-mod-mail-dbgsym_1.26.3-3+deb13u6_armhf.deb 4ec81a67ce35dc710c78c31e6ba7eeccfeb20ae594a63c2d80579fc7c222a56d 118584 libnginx-mod-mail_1.26.3-3+deb13u6_armhf.deb 710d2c04a68cac68717dfd8c4ee2d2759241412cc0e31577d8536125fc66ce96 190816 libnginx-mod-stream-dbgsym_1.26.3-3+deb13u6_armhf.deb 4ccd7cec80a793b0e9db534a1f885ca3b81f87ac9958aac0082890eee6942f67 24592 libnginx-mod-stream-geoip-dbgsym_1.26.3-3+deb13u6_armhf.deb cdbdb165e7c80f302a361a5e3f9d968e0a3a1efbc46c718807b551d2e87f43c4 87732 libnginx-mod-stream-geoip_1.26.3-3+deb13u6_armhf.deb aeedeaa542fd141a3f2ca6d88c1e0c0b1a6c58aa443a6541093083c93dc4c689 143112 libnginx-mod-stream_1.26.3-3+deb13u6_armhf.deb 3c1a5c2ae79531f336082b54737e015b54f6784f0936a548f5a6a8364941ce1e 1342688 nginx-dbgsym_1.26.3-3+deb13u6_armhf.deb 183bc4566f1faaab2fc79973d688ff07aec6e83505c2ce238571b62fba1680e9 84488 nginx-extras_1.26.3-3+deb13u6_armhf.deb 9d9ff2aab080d06a5035baeb207f11d686a895498d9e3980b42c3432c45f576a 13814 nginx_1.26.3-3+deb13u6_armhf-buildd.buildinfo 4f3614806975f8f87188531a78285fc9f24aa94f3e1bbecd215797dec7c0ef96 550296 nginx_1.26.3-3+deb13u6_armhf.deb Files: caeeab2a40451fcb9a18d67c510e94d3 38392 debug optional libnginx-mod-http-geoip-dbgsym_1.26.3-3+deb13u6_armhf.deb 61c5bb691db78fb03395c816d27bf4de 88444 httpd optional libnginx-mod-http-geoip_1.26.3-3+deb13u6_armhf.deb c7003850ded07b0845ec273674fb83a6 45824 debug optional libnginx-mod-http-image-filter-dbgsym_1.26.3-3+deb13u6_armhf.deb 59c946e6b10e7cf47caa25a0c84cb73b 91704 httpd optional libnginx-mod-http-image-filter_1.26.3-3+deb13u6_armhf.deb e9d9e6155954efa4209c7ec8ece52bcd 108368 debug optional libnginx-mod-http-perl-dbgsym_1.26.3-3+deb13u6_armhf.deb 6dd9c1eb31bb464f5482c578fe002d7e 98876 httpd optional libnginx-mod-http-perl_1.26.3-3+deb13u6_armhf.deb 4333891d15caab38047b1edd6fa6ec04 54496 debug optional libnginx-mod-http-xslt-filter-dbgsym_1.26.3-3+deb13u6_armhf.deb 2d94b2ddba0413c9adda16f6b58a17a6 90328 httpd optional libnginx-mod-http-xslt-filter_1.26.3-3+deb13u6_armhf.deb 6212f292ef55c6e5d7f01f536682477c 110772 debug optional libnginx-mod-mail-dbgsym_1.26.3-3+deb13u6_armhf.deb 84b0653f31986d440bc49622f3cc0595 118584 httpd optional libnginx-mod-mail_1.26.3-3+deb13u6_armhf.deb 4741aeb2f6e690175af2e7cc9447c534 190816 debug optional libnginx-mod-stream-dbgsym_1.26.3-3+deb13u6_armhf.deb 8aa57e35dcdf489684837110efbd2d53 24592 debug optional libnginx-mod-stream-geoip-dbgsym_1.26.3-3+deb13u6_armhf.deb 1f9499d2775279826ecb8fbe22623114 87732 httpd optional libnginx-mod-stream-geoip_1.26.3-3+deb13u6_armhf.deb 7e5f2e3bcc5abbbea158c94eec4328b6 143112 httpd optional libnginx-mod-stream_1.26.3-3+deb13u6_armhf.deb 9ac70d572d882d65f7769875b3bb50fa 1342688 debug optional nginx-dbgsym_1.26.3-3+deb13u6_armhf.deb 201c55f71525e5ee6cf5441b1e6cd1e3 84488 httpd optional nginx-extras_1.26.3-3+deb13u6_armhf.deb 62d573bcc17f123f6f2750a0f503dacd 13814 httpd optional nginx_1.26.3-3+deb13u6_armhf-buildd.buildinfo e52f360421cb6b16d389487fa1ef0e64 550296 httpd optional nginx_1.26.3-3+deb13u6_armhf.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEElFiH1oZRZh1t4FSiXVp1sEH/1mIFAmokM1QACgkQXVp1sEH/ 1mLdKw//X/5tRXNQPdLqrwK+RGrtdGnYqv0fxK/oeUSBJn87Io1Dzj3P4rjjzA1V w5mPT5JxFgs4DBWxIOjomlo2T9y/rslxGKyQoIih92cZt8S7BHqe1pvVrs9Yvql9 SBfsTqp6zPYrFZIUPvn5U1xKVQ/0wwpUgKC3FZokHNESgyFiBqOYCYEy9Nv81VHT gZQUX68Kd3mIdWPwLfiRPez6a7T2j0EGWNVFvRCoP2wrpNKL1+hQyI63p36HpA6j PFgyv/kTfhVV9Enw2pNOULM+Y8nigybzCSPqQDsvF4nWo2ONxapGGcebxWQg34DQ 6Wbw6or0botiuqdrnzWn2517OxIGcq7wqFRs1wUe2aahMuNZxdS67np//rpZXCjG AMMVvBw5Zm3w9DzTzf5Ci44rEoNRZD8TVXC7FCtuUpIEvdV+5gEM1yUq3GEnamic +uLVhxcLruD8ml0pHMMLFUnY4VspcachNqYzcjPWkPr8QVJFfzf8V7ZkRbIjqTXn PuN9cg/CqZ4eE1IAsS4sT9iV4uAcjnYH3joJcEiR4MtvEdSiz4cF2qWw4wEK+9Vs OUFugdysHMvICM8g1GDSfo6YEUcE2MDA2rwOeCFfNgFbsIpJ5LfvXafM0zbwl7Jl lHZmjNwZb6IuzcSSZUf7T/Y8i+VmNNV0C1MK0Iu9KEE1IzuqHCo= =81nw -----END PGP SIGNATURE-----