Skip to content

Commit babfa30

Browse files
CBL-Mariner-Botakhila-gurujujslobodzian
authored
Merge PR "[AUTO-CHERRYPICK] [High] Patch nginx for CVE-2026-49975 - branch 3.0-dev" microsoft#17634
Co-authored-by: Akhila Guruju <v-guakhila@microsoft.com> Co-authored-by: jslobodzian <joslobo@microsoft.com>
1 parent a0c563c commit babfa30

2 files changed

Lines changed: 152 additions & 1 deletion

File tree

‎SPECS/nginx/CVE-2026-49975.patch‎

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
From 148dfa3d5f59442041193e01b3ab29addf2dc8e6 Mon Sep 17 00:00:00 2001
2+
From: Maxim Dounin <mdounin@mdounin.ru>
3+
Date: Fri, 24 May 2024 00:20:01 +0300
4+
Subject: [PATCH] Added max_headers directive.
5+
6+
The directive limits the number of request headers accepted from clients.
7+
While the total amount of headers is believed to be sufficiently limited
8+
by the existing buffer size limits (client_header_buffer_size and
9+
large_client_header_buffers), the additional limit on the number of headers
10+
might be beneficial to better protect backend servers.
11+
12+
Requested by Maksim Yevmenkin.
13+
14+
Signed-off-by: Elijah Zupancic <e.zupancic@f5.com>
15+
Origin: <https://freenginx.org/hg/nginx/rev/199dc0d6b05be814b5c811876c20af58cd361fea>
16+
17+
Upstream Patch reference: https://github.com/nginx/nginx/commit/365694160a85229a7cb006738de9260d49ff5fa2.patch
18+
Upstream PR: https://github.com/nginx/nginx/pull/1116
19+
---
20+
src/http/ngx_http_core_module.c | 10 ++++++++++
21+
src/http/ngx_http_core_module.h | 2 ++
22+
src/http/ngx_http_request.c | 9 +++++++++
23+
src/http/ngx_http_request.h | 1 +
24+
src/http/v2/ngx_http_v2.c | 9 +++++++++
25+
src/http/v3/ngx_http_v3_request.c | 9 +++++++++
26+
6 files changed, 40 insertions(+)
27+
28+
diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c
29+
index a2ff53f82f..0c46106db6 100644
30+
--- a/src/http/ngx_http_core_module.c
31+
+++ b/src/http/ngx_http_core_module.c
32+
@@ -252,6 +252,13 @@ static ngx_command_t ngx_http_core_commands[] = {
33+
offsetof(ngx_http_core_srv_conf_t, large_client_header_buffers),
34+
NULL },
35+
36+
+ { ngx_string("max_headers"),
37+
+ NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
38+
+ ngx_conf_set_num_slot,
39+
+ NGX_HTTP_SRV_CONF_OFFSET,
40+
+ offsetof(ngx_http_core_srv_conf_t, max_headers),
41+
+ NULL },
42+
+
43+
{ ngx_string("ignore_invalid_headers"),
44+
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG,
45+
ngx_conf_set_flag_slot,
46+
@@ -3511,6 +3518,7 @@ ngx_http_core_create_srv_conf(ngx_conf_t *cf)
47+
cscf->request_pool_size = NGX_CONF_UNSET_SIZE;
48+
cscf->client_header_timeout = NGX_CONF_UNSET_MSEC;
49+
cscf->client_header_buffer_size = NGX_CONF_UNSET_SIZE;
50+
+ cscf->max_headers = NGX_CONF_UNSET_UINT;
51+
cscf->ignore_invalid_headers = NGX_CONF_UNSET;
52+
cscf->merge_slashes = NGX_CONF_UNSET;
53+
cscf->underscores_in_headers = NGX_CONF_UNSET;
54+
@@ -3552,6 +3560,8 @@ ngx_http_core_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
55+
return NGX_CONF_ERROR;
56+
}
57+
58+
+ ngx_conf_merge_uint_value(conf->max_headers, prev->max_headers, 1000);
59+
+
60+
ngx_conf_merge_value(conf->ignore_invalid_headers,
61+
prev->ignore_invalid_headers, 1);
62+
63+
diff --git a/src/http/ngx_http_core_module.h b/src/http/ngx_http_core_module.h
64+
index 6062d3a232..a13d7ade56 100644
65+
--- a/src/http/ngx_http_core_module.h
66+
+++ b/src/http/ngx_http_core_module.h
67+
@@ -199,6 +199,8 @@ typedef struct {
68+
69+
ngx_msec_t client_header_timeout;
70+
71+
+ ngx_uint_t max_headers;
72+
+
73+
ngx_flag_t ignore_invalid_headers;
74+
ngx_flag_t merge_slashes;
75+
ngx_flag_t underscores_in_headers;
76+
diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
77+
index 7305af132d..a9573a6207 100644
78+
--- a/src/http/ngx_http_request.c
79+
+++ b/src/http/ngx_http_request.c
80+
@@ -1494,6 +1494,15 @@ ngx_http_process_request_headers(ngx_event_t *rev)
81+
82+
/* a header line has been parsed successfully */
83+
84+
+ if (r->headers_in.count++ >= cscf->max_headers) {
85+
+ r->lingering_close = 1;
86+
+ ngx_log_error(NGX_LOG_INFO, c->log, 0,
87+
+ "client sent too many header lines");
88+
+ ngx_http_finalize_request(r,
89+
+ NGX_HTTP_REQUEST_HEADER_TOO_LARGE);
90+
+ break;
91+
+ }
92+
+
93+
h = ngx_list_push(&r->headers_in.headers);
94+
if (h == NULL) {
95+
ngx_http_close_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
96+
diff --git a/src/http/ngx_http_request.h b/src/http/ngx_http_request.h
97+
index 7a77498eb5..48eb43eb0f 100644
98+
--- a/src/http/ngx_http_request.h
99+
+++ b/src/http/ngx_http_request.h
100+
@@ -184,6 +184,7 @@ typedef struct {
101+
102+
typedef struct {
103+
ngx_list_t headers;
104+
+ ngx_uint_t count;
105+
106+
ngx_table_elt_t *host;
107+
ngx_table_elt_t *connection;
108+
diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c
109+
index 49ea25edef..efe22903fa 100644
110+
--- a/src/http/v2/ngx_http_v2.c
111+
+++ b/src/http/v2/ngx_http_v2.c
112+
@@ -1823,6 +1823,15 @@ ngx_http_v2_state_process_header(ngx_http_v2_connection_t *h2c, u_char *pos,
113+
}
114+
115+
} else {
116+
+ cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);
117+
+
118+
+ if (r->headers_in.count++ >= cscf->max_headers) {
119+
+ ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
120+
+ "client sent too many header lines");
121+
+ ngx_http_finalize_request(r, NGX_HTTP_REQUEST_HEADER_TOO_LARGE);
122+
+ goto error;
123+
+ }
124+
+
125+
h = ngx_list_push(&r->headers_in.headers);
126+
if (h == NULL) {
127+
return ngx_http_v2_connection_error(h2c,
128+
diff --git a/src/http/v3/ngx_http_v3_request.c b/src/http/v3/ngx_http_v3_request.c
129+
index 6865e14664..7bb61311d9 100644
130+
--- a/src/http/v3/ngx_http_v3_request.c
131+
+++ b/src/http/v3/ngx_http_v3_request.c
132+
@@ -665,6 +665,15 @@ ngx_http_v3_process_header(ngx_http_request_t *r, ngx_str_t *name,
133+
}
134+
135+
} else {
136+
+ cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);
137+
+
138+
+ if (r->headers_in.count++ >= cscf->max_headers) {
139+
+ ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
140+
+ "client sent too many header lines");
141+
+ ngx_http_finalize_request(r, NGX_HTTP_REQUEST_HEADER_TOO_LARGE);
142+
+ return NGX_ERROR;
143+
+ }
144+
+
145+
h = ngx_list_push(&r->headers_in.headers);
146+
if (h == NULL) {
147+
ngx_http_close_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);

‎SPECS/nginx/nginx.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ Name: nginx
66
# Currently on "stable" version of nginx from https://nginx.org/en/download.html.
77
# Note: Stable versions are even (1.20), mainline versions are odd (1.21)
88
Version: 1.28.3
9-
Release: 4%{?dist}
9+
Release: 5%{?dist}
1010
License: BSD-2-Clause
1111
Vendor: Microsoft Corporation
1212
Distribution: Azure Linux
@@ -31,6 +31,7 @@ Patch8: CVE-2026-42934.patch
3131
Patch9: CVE-2026-42945.patch
3232
Patch10: CVE-2026-42946.patch
3333
Patch11: CVE-2026-9256.patch
34+
Patch12: CVE-2026-49975.patch
3435

3536
# njs patches start at 1001 to keep them separate from nginx patches
3637
Patch1001: CVE-2026-8711.patch
@@ -183,6 +184,9 @@ rm -rf nginx-tests
183184
%dir %{_sysconfdir}/%{name}
184185

185186
%changelog
187+
* Fri Jun 05 2026 Akhila Guruju <v-guakhila@microsoft.com> - 1.28.3-5
188+
- Patch for CVE-2026-49975
189+
186190
* Wed May 27 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.28.3-4
187191
- Patch for CVE-2026-9256
188192

0 commit comments

Comments
 (0)