{"id":182826,"date":"2026-08-11T04:54:22","date_gmt":"2026-08-11T02:54:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve"},"modified":"2026-08-11T04:54:22","modified_gmt":"2026-08-11T02:54:22","slug":"v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","title":{"rendered":"I freenginx og nginx er der tilf\u00f8jet kontrol af st\u00f8rrelsen p\u00e5 tekstvariablen, f\u00f8r der skrives data til den (+ CVE)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

<\/i><\/a>
3 <\/p>\n

TL;DR<\/b>: St\u00f8dt p\u00e5 den tredje buffer overflow, der blev opdaget i 2026 (og if\u00f8lge F5, RCE hvis der ikke er ASLR) ved arbejde med regex og variabler, besluttede udvikleren af freenginx, Maksim Dunin, at det var p\u00e5 tide at stoppe dette, og han tilf\u00f8jede en kontrol af variabelst\u00f8rrelsen, f\u00f8r der skrives data til den. Dette nytilkomne blev derefter taget over af nginx, hvilket giver h\u00e5b om at stoppe nye CVE p\u00e5 dette omr\u00e5de.<\/p>\n

Her er detaljerne.<\/p>\n

Den 19. juni blev der foretaget commit<\/a> i freenginx, som tilf\u00f8jer et felt 'end' til variabelbeskrivelsen, der angiver slutningen af \u200b\u200bbufferen. Tidligere var der kun en peger til begyndelsen (pos), den n\u00f8dvendige l\u00e6ngde blev beregnet (og beregnes stadig) p\u00e5 forh\u00e5nd, og p\u00e5 tidspunktet for kopiering af data til variablen blev det antaget, at den korrekt beregnede l\u00e6ngde tidligere ville sikre, at dataene passer ind i bufferet. Desv\u00e6rre har der to gange i maj 2026 v\u00e6ret forskellige oversight, hvilket ikke har v\u00e6ret tilf\u00e6ldet (1 (linux.org.ru)<\/a>, 2 (linux.org.ru)<\/a>), hvilket f\u00f8rte til buffer overflow og d\u00e5rlige konsekvenser. S\u00e5 nu, n\u00e5r en buffers variabel oprettes, udfyldes pekeren til dens slutning, og f\u00f8r data skrives til variablen, hvis dataene ikke passer ind, vil behandlingen af \u200b\u200banmodningen blive kontrolleret stoppet med en fejl. Det vil sige, beregningsfejlene kan forts\u00e6tte, men de vil nu ikke ramme hukommelsen, kun fejle den specifikke http-anmodning. F\u00f8lgende commits (2 (freenginx.org)<\/a>, 3 (freenginx.org)<\/a>) har tilf\u00f8jet lignende beskyttelse til andre dele af koden, inklusive koden til at f\u00f8re access-log. Den 7. juli blev version freenginx 1.31.3<\/a>, der inkluderer denne rettelse, offentliggjort.<\/p>\n

<\/p>\n

Den 15. juli blev disse commits overtaget af nginx (1 (github.com)<\/a>, 2 (github.com)<\/a>, 3 (github.com)<\/a>, af en eller anden grund byttede den pladsene p\u00e5 det andet og tredje i k\u00e6den), problemet fik tildelt CVE-2026-42533<\/a>, og F5 udgav en officiel SA (f5.com)<\/a>.<\/p>\n

<\/noindex><\/p>\n

Vedr\u00f8rende den specifikke s\u00e5rbarhed denne gang: den opst\u00e5r ved brug af map-direktivet med regex'er med udtrukne parametre. Ang\u00e5ende de \u00f8vrige n\u00f8dvendige betingelser for, at den tr\u00e6der i kraft, varierer teksten i commitbeskrivelsen og teksten i SA en smule: det er angivet i SA, at der senere skal beregnes en bestemt streng, som bruger den udtrukne parameter fra map, f\u00f8r resultatet af selve map. I commitbeskrivelsen er der et eksempel, hvor der mellem disse trin ogs\u00e5 er nulstilling af variablen, der indeholder den udtrukne parameter. Under alle omst\u00e6ndigheder vil noget s\u00e5dant sandsynligvis ikke blive m\u00f8dt i de fleste k\u00f8rte nginx'er, og s\u00e5rbarheden har derved ber\u00f8rt f\u00e5. Det er ogs\u00e5 v\u00e6rd at bem\u00e6rke, at rettelserne til beregningen af l\u00e6ngden specifikt i dette tilf\u00e6lde ikke synes at v\u00e6re til stede i de committede \u00e6ndringer (eller har jeg ikke s\u00f8gt godt nok?), der er kun en beskyttelse, der g\u00f8r problemet til en kontrolleret HTTP-anmodningsfejl. Selvom der den 19. juli blev tilf\u00f8jet nogle rettelser i freenginx,5bfb<\/a>, 7622<\/a>, b906<\/a>) til l\u00e6ngde beregning for en lignende situation, men det er ikke klart, om det er tilf\u00e6ldet. <\/p>\n

S\u00e5rbarheden opstod i version nginx 0.9.6, rettelserne kom ind i versionerne freenginx 1.31.3, nginx 1.30.4, nginx 1.31.3.<\/p>\n

I SA nginx er der givet tak til flere personer for uafh\u00e6ngige rapporter om s\u00e5rbarhed og overholdelse af \"standarder for koordineret offentligg\u00f8relse af information\":<\/p>\n

<\/p>\n

F5 anerkender Ming Xuan, DKD (@pidifn), Ji\u2019an Zhou og Zhen Yan fra AntAISecurityLab, Rafael Gacek, Sergii Negodiuk fra EVO.company, Lam Jun Rong fra Calif.io, Mufeed VH fra Winfunc Research (winfunc.com), Vexera AI (https:\/\/vexera.ai<\/a>), Tu Tran Dinh (@1w4y), Stan Shaw (cyberstan), qianshuidewajueji, zenneth (randomguy6407), Zhenpeng (Leo) Lin fra depthfirst, Lukas Johannes Moeller, Melih Tolga Sahin fra Vodafone T\u00fcrkiye, Ayoub Nabil Boubagrat (GitHub: @ayoubnabil), og Milan Jovic (Kljunowsky) for uafh\u00e6ngigt at have bragt dette problem til vores opm\u00e6rksomhed og for at f\u00f8lge de h\u00f8jeste standarder for koordineret offentligg\u00f8relse.<\/p>\n

<\/noindex><\/p><\/blockquote>\n

I freenginx er den ledsagende information om rettelsen faktisk begr\u00e6nset til meddelelsen ved commit. I changelog<\/a>- denne rettelse er ikke engang markeret med hverken \"sikkerhed\" (security) eller \"rettelse\" (bugfix), blot \"tilf\u00f8jelse\" (feature). Sandsynligvis har forfatteren ikke anset dette problem for kritisk. Hvordan de n\u00e6vnte personers rapporter om problemet forholder sig til F5 og det l\u00e5nte commit fra freenginx, og om de (eller nogen anden) informerede forfatteren af freenginx om problemet, kunne ikke afklares. <\/p>\n

Kilde: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

3 TL;DR: \u0421\u0442\u043e\u043b\u043a\u043d\u0443\u0432\u0448\u0438\u0441\u044c \u0441 \u0442\u0440\u0435\u0442\u044c\u0438\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c \u0437\u0430 2026 \u0433\u043e\u0434 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 (\u0438, \u043f\u043e \u0432\u0435\u0440\u0441\u0438\u0438 F5, RCE \u0435\u0441\u043b\u0438 \u043d\u0435\u0442 ASLR) \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u0440\u0435\u0433\u044d\u043a\u0441\u043f\u0430\u043c\u0438 \u0438 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u043c\u0438, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a freenginx \u041c\u0430\u043a\u0441\u0438\u043c \u0414\u0443\u043d\u0438\u043d \u0440\u0435\u0448\u0438\u043b, \u0447\u0442\u043e \u043f\u043e\u0440\u0430 \u044d\u0442\u043e \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u0442\u044c, \u0438 \u0434\u043e\u0431\u0430\u0432\u0438\u043b \u0432 \u0441\u0432\u043e\u0439 \u043f\u0440\u043e\u0434\u0443\u043a\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434 \u0442\u0435\u043c \u043a\u0430\u043a \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0432 \u043d\u0435\u0451 \u0434\u0430\u043d\u043d\u044b\u0435. \u041e\u0442\u0442\u0443\u0434\u0430 \u044d\u0442\u043e \u043d\u043e\u0432\u043e\u0432\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0443\u0442\u0430\u0449\u0438\u043b\u0438 \u043a \u0441\u0435\u0431\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":9,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182826","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47I freenginx og nginx har tilf\u00f8jet kontrol af st\u00f8rrelsen p\u00e5 den tekstbaserede variabel, f\u00f8r data skrives til den (+ CVE) | ProHoster","description":"3 TL;DR: St\u00f8dt p\u00e5 den tredje opdagede buffer overflow i 2026 (og if\u00f8lge F5.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 freenginx \u0438 nginx \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u043e\u0439 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434 \u0442\u0435\u043c \u043a\u0430\u043a \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0432 \u043d\u0435\u0451 \u0434\u0430\u043d\u043d\u044b\u0435 (+ CVE) | ProHoster","og:description":"3 TL;DR: \u0421\u0442\u043e\u043b\u043a\u043d\u0443\u0432\u0448\u0438\u0441\u044c \u0441 \u0442\u0440\u0435\u0442\u044c\u0438\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c \u0437\u0430 2026 \u0433\u043e\u0434 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 (\u0438, \u043f\u043e \u0432\u0435\u0440\u0441\u0438\u0438 F5.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-08-11T02:54:22+00:00","article:modified_time":"2026-08-11T02:54:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"182826","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-08-11 06:43:49","updated":"2026-08-11 06:43:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/182826","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=182826"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/182826\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=182826"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=182826"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=182826"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}