Release date:
2026-09-24 07:55:16 UTC
Description:
* SECURITY UPDATE: denial of service via an unbounded number of HTTP/2
request header lines
- debian/patches/CVE-2026-49975.patch: add the max_headers directive
(default 1000) and enforce it in ngx_http_process_request_headers() and
ngx_http_v2_state_process_header(), so a client can no longer drive
unbounded per-request header-list growth over HTTP/2; the counter is
appended to the end of struct ngx_http_request_s (not inside
ngx_http_headers_in_t, which is embedded by value and would shift every
later request field) and max_headers to the end of
ngx_http_core_srv_conf_t, so every existing field offset is preserved
and prebuilt third-party dynamic modules stay ABI-compatible
- CVE-2026-49975
Updated packages:
-
libnginx-mod-http-auth-pam_1.14.0-0ubuntu1.11+tuxcare.els9_amd64.deb
sha:773480cfd85c76d83aa7b1932f9d220897115f16
-
libnginx-mod-http-cache-purge_1.14.0-0ubuntu1.11+tuxcare.els9_amd64.deb
sha:831d7bbfe88e17679c629ee5ba1a4f73800dac8c
-
libnginx-mod-http-dav-ext_1.14.0-0ubuntu1.11+tuxcare.els9_amd64.deb
sha:039f97a370069577b8a19423609ceb46ce4f6d2d
-
libnginx-mod-http-echo_1.14.0-0ubuntu1.11+tuxcare.els9_amd64.deb
sha:574805919b9a410d2bea215cf230912d53a09702
-
libnginx-mod-http-fancyindex_1.14.0-0ubuntu1.11+tuxcare.els9_amd64.deb
sha:2f3b8ce120b6b4c8ecb32c220797496958433cf2
-
libnginx-mod-http-geoip_1.14.0-0ubuntu1.11+tuxcare.els9_amd64.deb
sha:a8a475f1731f0a69f9232a851bafe32d6f7ee5d5
-
libnginx-mod-http-headers-more-filter_1.14.0-0ubuntu1.11+tuxcare.els9_amd64.deb
sha:922330bdd6e9ef58462423f6387bf8784aac6085
-
libnginx-mod-http-image-filter_1.14.0-0ubuntu1.11+tuxcare.els9_amd64.deb
sha:fcf9a78943cf6a4f29da05e0b79250e87821296c
-
libnginx-mod-http-lua_1.14.0-0ubuntu1.11+tuxcare.els9_amd64.deb
sha:42644205d86143ed7945d057d358e8554b326ff3
-
libnginx-mod-http-ndk_1.14.0-0ubuntu1.11+tuxcare.els9_amd64.deb
sha:967908ae7b39379e9919b443f05cd786cf91f27d
-
libnginx-mod-http-perl_1.14.0-0ubuntu1.11+tuxcare.els9_amd64.deb
sha:fd8d2db0c58468d2096ea6da9209e3454b2a42bd
-
libnginx-mod-http-subs-filter_1.14.0-0ubuntu1.11+tuxcare.els9_amd64.deb
sha:93054084202324bfe00430052214e933bf54c521
-
libnginx-mod-http-uploadprogress_1.14.0-0ubuntu1.11+tuxcare.els9_amd64.deb
sha:59c4860fe1edddde18de366241e05b9e354a7c35
-
libnginx-mod-http-upstream-fair_1.14.0-0ubuntu1.11+tuxcare.els9_amd64.deb
sha:b3d049a3462ce20c68b677fda8988694a2dd5223
-
libnginx-mod-http-xslt-filter_1.14.0-0ubuntu1.11+tuxcare.els9_amd64.deb
sha:0b59bb567c473ca2fa038f773c49a81b36d9f419
-
libnginx-mod-mail_1.14.0-0ubuntu1.11+tuxcare.els9_amd64.deb
sha:e5617193ec360a0b59503b0b642157d50a37b99b
-
libnginx-mod-nchan_1.14.0-0ubuntu1.11+tuxcare.els9_amd64.deb
sha:969386548c56bbf4f8714023ad88e68d889d311c
-
libnginx-mod-rtmp_1.14.0-0ubuntu1.11+tuxcare.els9_amd64.deb
sha:29f87494ec751939cf651fb55f6ee9ec6604994b
-
libnginx-mod-stream_1.14.0-0ubuntu1.11+tuxcare.els9_amd64.deb
sha:1d3bd2c4f40f235aea0611f5d95ff355dd87bf57
-
nginx_1.14.0-0ubuntu1.11+tuxcare.els9_all.deb
sha:5166a399b29268fba7e1d43658afbea7707cfd31
-
nginx-common_1.14.0-0ubuntu1.11+tuxcare.els9_all.deb
sha:bcf29bf601ebbd23dd4e64d20c960614cd9827b8
-
nginx-core_1.14.0-0ubuntu1.11+tuxcare.els9_amd64.deb
sha:af47e30fa1e8818b415519e0a347add270537389
-
nginx-doc_1.14.0-0ubuntu1.11+tuxcare.els9_all.deb
sha:d81981440844648b21cceb5618618a0208a825ff
-
nginx-extras_1.14.0-0ubuntu1.11+tuxcare.els9_amd64.deb
sha:57998afbc4d42e1914b5a2b81df69cd174cc7713
-
nginx-full_1.14.0-0ubuntu1.11+tuxcare.els9_amd64.deb
sha:b7b422bc82a8373bfd98368c0aed61b42d29f415
-
nginx-light_1.14.0-0ubuntu1.11+tuxcare.els9_amd64.deb
sha:b505dd81458f45c869782a02f7d40dab9c2e09bb
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
