{"id":182826,"date":"2026-08-11T04:54:22","date_gmt":"2026-08-11T02:54:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve"},"modified":"2026-08-11T04:54:22","modified_gmt":"2026-08-11T02:54:22","slug":"v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","status":"publish","type":"post","link":"https:\/\/prohoster.info\/az\/blog\/news\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","title":{"rendered":"freenginx v\u0259 nginx-d\u0259 m\u0259lumatlar\u0131 yazmadan \u0259vv\u0259l m\u0259tn d\u0259yi\u015f\u0259ninin \u00f6l\u00e7\u00fcs\u00fcn\u00fc yoxlama \u0259lav\u0259 edilib (+ CVE).","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

<\/i><\/a>
3 <\/p>\n

Q\u0131sa<\/b>: 2026-c\u0131 ild\u0259 a\u015fkarlanm\u0131\u015f \u00fc\u00e7\u00fcnc\u00fc tampon a\u015f\u0131m\u0131 (v\u0259 F5-\u0259 g\u00f6r\u0259 ASLR yoxdursa RCE) il\u0259 \u00fczl\u0259\u015fdikd\u0259n sonra, freenginx-in inki\u015faf\u00e7\u0131s\u0131 Maksim Dunin bunun dayand\u0131r\u0131lma vaxt\u0131 g\u0259ldiyini d\u00fc\u015f\u00fcnd\u00fc v\u0259 m\u0259hsuluna d\u0259yi\u015f\u0259n yaz\u0131lmadan \u0259vv\u0259l ondan d\u0259yi\u015f\u0259nin \u00f6l\u00e7\u00fcs\u00fcn\u00fc yoxlama\u011f\u0131 \u0259lav\u0259 etdi. Bu yenilik oradan nginx-\u0259 g\u00f6t\u00fcr\u00fcld\u00fc ki, \u00fcmid verir ki, bu m\u00f6vzuda yeni CVE-l\u0259rin yaranmas\u0131 dayand\u0131r\u0131lacaq.<\/p>\n

\u0130ndi detallara ke\u00e7\u0259k.<\/p>\n

19 iyun tarixind\u0259 komit<\/a> freenginx-d\u0259 d\u0259yi\u015f\u0259n \u00fc\u00e7\u00fcn tamponun sonunu g\u00f6st\u0259r\u0259c\u0259k end sah\u0259sini \u0259lav\u0259 edir. \u018fvv\u0259l orada yaln\u0131z onun ba\u015flan\u011f\u0131c\u0131n\u0131 (pos) g\u00f6st\u0259r\u0259n bir g\u00f6st\u0259rici var idi, laz\u0131m olan uzunluq \u0259vv\u0259ld\u0259n hesablan\u0131rd\u0131 (v\u0259 h\u0259l\u0259 d\u0259 hesablan\u0131r), v\u0259 d\u0259yi\u015f\u0259n\u0259 m\u0259lumat\u0131n kopyalanmas\u0131 zaman\u0131 \u0259vv\u0259lc\u0259d\u0259n d\u00fczg\u00fcn hesablanm\u0131\u015f uzunlu\u011fun m\u0259lumat\u0131n tamponda yerl\u0259\u015f\u0259c\u0259yini t\u0259min ed\u0259c\u0259yi g\u00f6zl\u0259nilirdi. T\u0259\u0259ss\u00fcf ki, 2026-c\u0131 ilin may ay\u0131nda iki d\u0259f\u0259 m\u00fcxt\u0259lif n\u0259z\u0259r\u0259 almamalar\u0131n s\u0259b\u0259bi il\u0259 bu bel\u0259 olmam\u0131\u015fd\u0131r (1 (linux.org.ru)<\/a>, 2 (linux.org.ru)<\/a>), bu is\u0259 tampon a\u015fmalar\u0131na v\u0259 pis n\u0259tic\u0259l\u0259r\u0259 s\u0259b\u0259b olurdur. Art\u0131q, d\u0259yi\u015f\u0259n \u00fc\u00e7\u00fcn tampon yarad\u0131ld\u0131qda, onun sonuna olan g\u00f6st\u0259rici d\u0259 doldurulur, m\u0259lumat\u0131 d\u0259yi\u015f\u0259n\u0259 yazmazdan \u0259vv\u0259l, \u0259g\u0259r m\u0259lumat ona s\u0131\u011fm\u0131rsa, sor\u011funun emal\u0131 idar\u0259 olunan \u015f\u0259kild\u0259 s\u0259hvl\u0259 ba\u015fa \u00e7atd\u0131r\u0131lacaq. Y\u0259ni uzunluq hesablamas\u0131 il\u0259 ba\u011fl\u0131 s\u0259hvl\u0259r h\u0259l\u0259 d\u0259 m\u00f6vcud ola bil\u0259r, lakin indi onlar yadda\u015fda he\u00e7 bir z\u0259r\u0259r verm\u0259y\u0259c\u0259k, yaln\u0131z konkret http sor\u011fusunu u\u011fursuzla\u015fd\u0131racaq. Sonrak\u0131 komitl\u0259r (2 (freenginx.org)<\/a>, 3 (freenginx.org)<\/a>) kodun dig\u0259r yerl\u0259rind\u0259 b\u0259nz\u0259r bir t\u0259hl\u00fck\u0259sizlik t\u0259dbiri \u0259lav\u0259 edildi, daxil olmaqla giri\u015f jurnal\u0131n\u0131n apar\u0131lmas\u0131 koduna. 7 iyulda freenginx 1.31.3<\/a>, bu d\u00fcz\u0259li\u015fi \u0259hat\u0259 ed\u0259n versiya burax\u0131lm\u0131\u015fd\u0131r.<\/p>\n

<\/p>\n

15 iyulda bu komitl\u0259r nginx t\u0259r\u0259find\u0259n \u0259l\u0259 ke\u00e7irildi (1 (github.com)<\/a>, 2 (github.com)<\/a>, 3 (github.com)<\/a>, s\u0259b\u0259bsiz d\u0259yi\u015fdir\u0259r\u0259k ikinci v\u0259 \u00fc\u00e7\u00fcnc\u00fc yeri d\u0259yi\u015fdirdi), problem\u0259 CVE-2026-42533<\/a>, F5 is\u0259 r\u0259smi SA (f5.com)<\/a>.<\/p>\n

<\/noindex><\/p>\n

Bu d\u0259f\u0259 konkret z\u0259iflikl\u0259 ba\u011fl\u0131: o, map direktivinin \u00f6z\u0259ll\u0259\u015fdirilmi\u015f parametrl\u0259ri il\u0259 regexp-l\u0259rd\u0259n istifad\u0259 edilm\u0259si zaman\u0131 meydana g\u0259lir. Onun meydana g\u0259lm\u0259si \u00fc\u00e7\u00fcn laz\u0131m olan dig\u0259r \u015f\u0259rtl\u0259rl\u0259 ba\u011fl\u0131 komitd\u0259ki m\u0259tnl\u0259 SA-da olan m\u0259tn aras\u0131nda bir q\u0259d\u0259r f\u0259rq var: SA-da g\u00f6st\u0259rilib ki, g\u0259l\u0259c\u0259kd\u0259 map-dan qalan \u00f6z\u0259ll\u0259\u015fdirilmi\u015f parametr istifad\u0259 edil\u0259r\u0259k bir s\u0259tirin hesablanmas\u0131 laz\u0131m olacaq, \u0259vv\u0259ll\u0259r bu map-\u0131n n\u0259tic\u0259sind\u0259n \u0259vv\u0259l. Komit izah\u0131nda, bu add\u0131mlar aras\u0131nda \u00f6z\u0259ll\u0259\u015fdirilmi\u015f parametr olan d\u0259yi\u015f\u0259nin s\u0131f\u0131rlanmas\u0131 da i\u015ftirak edir. H\u0259r nec\u0259 olursa olsun, \u0259ks\u0259r i\u015fl\u0259klikd\u0259 olan nginx-l\u0259rd\u0259 bel\u0259 bir \u015feyin ba\u015f verm\u0259si g\u00fcman etmir, buna g\u00f6r\u0259 d\u0259 z\u0259iflik geni\u015f \u015f\u0259kild\u0259 cazib\u0259dar olmay\u0131b. H\u0259m\u00e7inin qeyd etm\u0259k laz\u0131md\u0131r ki, bu konkret v\u0259ziyy\u0259td\u0259 uzunluq hesablamas\u0131 il\u0259 ba\u011fl\u0131 d\u00fcz\u0259li\u015fl\u0259r d\u0259 g\u00f6r\u00fcnm\u00fcr (ya da m\u0259n yax\u015f\u0131 axtarmad\u0131m?), yaln\u0131z problemi idar\u0259 olunan http sor\u011fusunun u\u011fursuzlu\u011funa \u00e7evirm\u0259k \u00fc\u00e7\u00fcn m\u00fchafiz\u0259 var. Ancaq 19 iyulda freenginx-d\u0259 m\u00fc\u0259yy\u0259n d\u00fcz\u0259li\u015fl\u0259r \u0259lav\u0259 edilmi\u015fdir (5bfb<\/a>, 7622<\/a>, b906<\/a>S\u0131xl\u0131qla bel\u0259 bir v\u0259ziyy\u0259t \u00fc\u00e7\u00fcn uzunlu\u011fu hesablama \u00e7\u0259tindir, ancaq d\u0259qiq dem\u0259k olmur. <\/p>\n

Z\u0259iflik nginx 0.9.6 versiyas\u0131nda meydana \u00e7\u0131x\u0131b, d\u00fcz\u0259li\u015fl\u0259r is\u0259 freenginx 1.31.3, nginx 1.30.4, nginx 1.31.3 versiyalar\u0131na daxil edilib.<\/p>\n

SA nginx haqq\u0131nda bir s\u0131ra \u015f\u0259xsl\u0259r\u0259 ba\u011f\u0131ms\u0131z z\u0259iflik bildiri\u015fl\u0259ri v\u0259 \"koordinasiyal\u0131 m\u0259lumat a\u00e7\u0131qlama standartlar\u0131na\" riay\u0259t etdikl\u0259ri \u00fc\u00e7\u00fcn t\u0259\u015f\u0259kk\u00fcrl\u0259r bildirilir:<\/p>\n

<\/p>\n

F5, Ming Xuan, DKD (@pidifn), Ji\u2019an Zhou v\u0259 AntAISecurityLab-dan Zhen Yan, Rafael Gacek, EVO.company-dan Sergii Negodiuk, Calif.io-dan Lam Jun Rong, Winfunc Research (winfunc.com)-dan Mufeed VH, Vexera AI-n\u0131 tan\u0131y\u0131r (https:\/\/vexera.ai<\/a>), Tu Tran Dinh (@1w4y), Stan Shaw (cyberstan), qianshuidewajueji, zenneth (randomguy6407), depthfirst-dan Zhenpeng (Leo) Lin, Lukas Johannes Moeller, Vodafone T\u00fcrkiye-dan Melih Tolga Sahin, Ayoub Nabil Boubagrat (GitHub: @ayoubnabil), v\u0259 Milan Jovic (Kljunowsky) bu problemi m\u00fcst\u0259qil \u015f\u0259kild\u0259 diqq\u0259timiz\u0259 \u00e7atd\u0131rd\u0131\u011f\u0131 v\u0259 koordinasiya olunmu\u015f a\u00e7\u0131qlama standartlar\u0131na riay\u0259t etdiyi \u00fc\u00e7\u00fcn t\u0259\u015f\u0259kk\u00fcr edir.<\/p>\n

<\/noindex><\/p><\/blockquote>\n

Freenginx-d\u0259 d\u00fcz\u0259li\u015fl\u0259rl\u0259 ba\u011fl\u0131 \u0259trafl\u0131 m\u0259lumat, faktiki olaraq, kommit zaman\u0131 veril\u0259n bir mesajla il\u0259 m\u0259hdudla\u015f\u0131r. T \ud83e\udd47Python 3.13 | ProHoster<\/a>-bu d\u00fcz\u0259li\u015f he\u00e7 \"t\u0259hl\u00fck\u0259sizlik\" (security) adl\u0131 imza, n\u0259 d\u0259 \"d\u00fcz\u0259li\u015f\" (bugfix) il\u0259 qeyd edilm\u0259mi\u015f, yaln\u0131z \"\u0259lav\u0259\" (feature) olaraq qeyd olunmu\u015fdur. G\u00f6r\u00fcn\u00fcr, m\u00fc\u0259llif bu problemi kritik hesab etm\u0259yib. F5-d\u0259n bildir\u0259n \u015f\u0259xsl\u0259rin problem haqda ifad\u0259l\u0259ri il\u0259 freenginx-d\u0259n al\u0131nan commiti aras\u0131nda nec\u0259 ba\u011fl\u0131l\u0131q oldu\u011funu, onlar (v\u0259 ya ba\u015fqalar\u0131) freenginx m\u00fc\u0259llifin\u0259 problem bar\u0259d\u0259 m\u0259lumat verib-verilm\u0259diyini \u00f6yr\u0259nm\u0259k m\u00fcmk\u00fcn olmay\u0131b. <\/p>\n

M\u0259nb\u0259: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

3 TL;DR: \u0421\u0442\u043e\u043b\u043a\u043d\u0443\u0432\u0448\u0438\u0441\u044c \u0441 \u0442\u0440\u0435\u0442\u044c\u0438\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c \u0437\u0430 2026 \u0433\u043e\u0434 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 (\u0438, \u043f\u043e \u0432\u0435\u0440\u0441\u0438\u0438 F5, RCE \u0435\u0441\u043b\u0438 \u043d\u0435\u0442 ASLR) \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u0440\u0435\u0433\u044d\u043a\u0441\u043f\u0430\u043c\u0438 \u0438 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u043c\u0438, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a freenginx \u041c\u0430\u043a\u0441\u0438\u043c \u0414\u0443\u043d\u0438\u043d \u0440\u0435\u0448\u0438\u043b, \u0447\u0442\u043e \u043f\u043e\u0440\u0430 \u044d\u0442\u043e \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u0442\u044c, \u0438 \u0434\u043e\u0431\u0430\u0432\u0438\u043b \u0432 \u0441\u0432\u043e\u0439 \u043f\u0440\u043e\u0434\u0443\u043a\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434 \u0442\u0435\u043c \u043a\u0430\u043a \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0432 \u043d\u0435\u0451 \u0434\u0430\u043d\u043d\u044b\u0435. \u041e\u0442\u0442\u0443\u0434\u0430 \u044d\u0442\u043e \u043d\u043e\u0432\u043e\u0432\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0443\u0442\u0430\u0449\u0438\u043b\u0438 \u043a \u0441\u0435\u0431\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":9,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182826","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Freenginx v\u0259 nginx-d\u0259 m\u0259lumatlar\u0131n yaz\u0131lmadan \u0259vv\u0259l m\u0259tn d\u0259yi\u015f\u0259ninin \u00f6l\u00e7\u00fcs\u00fcn\u00fc yoxlamaq \u00fc\u00e7\u00fcn olacaq (+ CVE) | ProHoster","description":"3 TL;DR: 2026-c\u0131 il \u00fc\u00e7\u00fcn a\u015fkarlanan \u00fc\u00e7\u00fcnc\u00fc tampon a\u015f\u0131m\u0131 il\u0259 (v\u0259 F5-in versiyas\u0131na g\u00f6r\u0259,","canonical_url":"https:\/\/prohoster.info\/az\/blog\/news\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"az_AZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 freenginx \u0438 nginx \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u043e\u0439 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434 \u0442\u0435\u043c \u043a\u0430\u043a \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0432 \u043d\u0435\u0451 \u0434\u0430\u043d\u043d\u044b\u0435 (+ CVE) | ProHoster","og:description":"3 TL;DR: \u0421\u0442\u043e\u043b\u043a\u043d\u0443\u0432\u0448\u0438\u0441\u044c \u0441 \u0442\u0440\u0435\u0442\u044c\u0438\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c \u0437\u0430 2026 \u0433\u043e\u0434 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 (\u0438, \u043f\u043e \u0432\u0435\u0440\u0441\u0438\u0438 F5.","og:url":"https:\/\/prohoster.info\/az\/blog\/news\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-08-11T02:54:22+00:00","article:modified_time":"2026-08-11T02:54:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"182826","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-08-11 06:43:49","updated":"2026-08-11 06:43:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/182826","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/comments?post=182826"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/182826\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/media?parent=182826"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/categories?post=182826"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/tags?post=182826"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}