{"id":182826,"date":"2026-08-11T04:54:22","date_gmt":"2026-08-11T02:54:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve"},"modified":"2026-08-11T04:54:22","modified_gmt":"2026-08-11T02:54:22","slug":"v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","title":{"rendered":"In freenginx and nginx, a check for the size of the text variable was added before writing data into it (+ CVE)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

<\/i><\/a>
3 <\/p>\n

TL;DR<\/b>: Facing the third buffer overflow discovered in 2026 (and, according to F5, RCE if ASLR is not present) when working with regex and variables, freenginx developer Maxim Dunin decided it was time to put an end to this and added a size check for the variable before writing data into it. This innovation was then borrowed by nginx, raising hopes for the cessation of new CVEs on this topic.<\/p>\n

Now for the details.<\/p>\n

On June 19, a change was made the commit<\/a> in freenginx, adding an 'end' field to the variable descriptor indicating the end of the buffer. Previously, there was only a pointer to its start (pos), and the required length was calculated (and still is) in advance, assuming that the correctly calculated length would guarantee that the data would fit into the buffer at the moment of copying into the variable. Unfortunately, twice in May 2026, due to various oversights, this turned out not to be the case (1 (linux.org.ru)<\/a>, 2 (linux.org.ru)<\/a>), which led to buffer overflows and negative consequences. So now, when creating a buffer for a variable, a pointer to its end is also filled, and before writing data into the variable, if the data does not fit, the request processing will be deliberately concluded with an error. This means that length calculation errors may still exist, but they will now fail only the specific HTTP request instead of crashing the memory. Subsequent commits (2 (freenginx.org)<\/a>, 3 (freenginx.org)<\/a>) added similar protection in other parts of the code, including the access log management code. On July 7, version freenginx 1.31.3<\/a>, including this fix, was released.<\/p>\n

<\/p>\n

On July 15, these commits were adopted by nginx (1 (github.com)<\/a>, 2 (github.com)<\/a>, 3 (github.com)<\/a>, for some reason swapping the second and third in the chain), the issue was assigned a CVE-2026-42533<\/a>, and F5 released an official SA (f5.com)<\/a>.<\/p>\n

<\/noindex><\/p>\n

Regarding the specific vulnerability this time: it occurs when using the map directive with regexes that capture parameters. As for the other necessary conditions for it to trigger, the text in the commit description and in the SA differ slightly: the SA states that there should be a calculation of a certain string using the captured parameter left from the map before the result of that same map. In the commit description, the example includes resetting a variable that contains the captured parameter between these steps. Nevertheless, most running nginx instances are unlikely to encounter this, so the vulnerability has affected very few people. It's also worth noting that corrections for length calculations specifically in this case seem to be absent in the committed changes (or maybe I didn't search well enough?); there is only a safeguard that turns the problem into a controlled failure of the HTTP request. However, on July 19, some corrections were added in freenginx.5bfb<\/a>, 7622<\/a>, b906<\/a>) for length calculations in a similar situation, but it's not immediately clear if it's related or not. <\/p>\n

The vulnerability appeared in nginx version 0.9.6, with fixes included in freenginx versions 1.31.3, nginx 1.30.4, nginx 1.31.3.<\/p>\n

In SA nginx, acknowledgments are made to several individuals for independent reports of vulnerabilities and adherence to the \"standards of coordinated vulnerability disclosure\":<\/p>\n

<\/p>\n

F5 acknowledges Ming Xuan, DKD (@pidifn), Ji\u2019an Zhou, and Zhen Yan of AntAISecurityLab, Rafael Gacek, Sergii Negodiuk of EVO.company, Lam Jun Rong of Calif.io, Mufeed VH of Winfunc Research (winfunc.com), Vexera AI (https:\/\/vexera.ai<\/a>),<\/p>\n

<\/noindex><\/p><\/blockquote>\n

In freenginx, the accompanying information about the fix is essentially limited to the commit message. In this case, the fix isn't even marked with a 'security' or 'bugfix' label, but simply as a 'feature.' It's likely the author did not consider this issue critical. I could not determine how the reports of the problem from the mentioned individuals in F5 correlate with the commit borrowed from freenginx, and whether they (or anyone else) alerted the author of freenginx about the problem. changelog<\/a>-this fix is not marked with either a \"security\" or \"bugfix\" label, but simply as a \"feature\". It is likely that the author did not consider this issue critical. It remains unclear how the reports of the problem from the mentioned individuals at F5 relate to the commit borrowed from freenginx, or whether they (or anyone else) informed the freenginx author about the issue. <\/p>\n

Source: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

3 TL;DR: \u0421\u0442\u043e\u043b\u043a\u043d\u0443\u0432\u0448\u0438\u0441\u044c \u0441 \u0442\u0440\u0435\u0442\u044c\u0438\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c \u0437\u0430 2026 \u0433\u043e\u0434 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 (\u0438, \u043f\u043e \u0432\u0435\u0440\u0441\u0438\u0438 F5, RCE \u0435\u0441\u043b\u0438 \u043d\u0435\u0442 ASLR) \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u0440\u0435\u0433\u044d\u043a\u0441\u043f\u0430\u043c\u0438 \u0438 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u043c\u0438, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a freenginx \u041c\u0430\u043a\u0441\u0438\u043c \u0414\u0443\u043d\u0438\u043d \u0440\u0435\u0448\u0438\u043b, \u0447\u0442\u043e \u043f\u043e\u0440\u0430 \u044d\u0442\u043e \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u0442\u044c, \u0438 \u0434\u043e\u0431\u0430\u0432\u0438\u043b \u0432 \u0441\u0432\u043e\u0439 \u043f\u0440\u043e\u0434\u0443\u043a\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434 \u0442\u0435\u043c \u043a\u0430\u043a \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0432 \u043d\u0435\u0451 \u0434\u0430\u043d\u043d\u044b\u0435. \u041e\u0442\u0442\u0443\u0434\u0430 \u044d\u0442\u043e \u043d\u043e\u0432\u043e\u0432\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0443\u0442\u0430\u0449\u0438\u043b\u0438 \u043a \u0441\u0435\u0431\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":9,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182826","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47In freenginx and nginx, a check for the size of the text variable was added before writing data to it (+ CVE) | ProHoster","description":"3 TL;DR: Encountered the third discovered buffer overflow for the year 2026 (according to F5).","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 freenginx \u0438 nginx \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u043e\u0439 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434 \u0442\u0435\u043c \u043a\u0430\u043a \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0432 \u043d\u0435\u0451 \u0434\u0430\u043d\u043d\u044b\u0435 (+ CVE) | ProHoster","og:description":"3 TL;DR: \u0421\u0442\u043e\u043b\u043a\u043d\u0443\u0432\u0448\u0438\u0441\u044c \u0441 \u0442\u0440\u0435\u0442\u044c\u0438\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c \u0437\u0430 2026 \u0433\u043e\u0434 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 (\u0438, \u043f\u043e \u0432\u0435\u0440\u0441\u0438\u0438 F5.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-08-11T02:54:22+00:00","article:modified_time":"2026-08-11T02:54:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"182826","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-08-11 06:43:49","updated":"2026-08-11 06:43:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/182826","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=182826"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/182826\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=182826"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=182826"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=182826"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}