{"id":182826,"date":"2026-08-11T04:54:22","date_gmt":"2026-08-11T02:54:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve"},"modified":"2026-08-11T04:54:22","modified_gmt":"2026-08-11T02:54:22","slug":"v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","title":{"rendered":"U freenginx i nginx dodana je provjera veli\u010dine tekstualne varijable prije nego \u0161to se u nju zapisu podaci (+ CVE)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

<\/i><\/a>
3 <\/p>\n

TL;DR<\/b>: Suo\u010div\u0161i se s tre\u0107im otkrivenim prelivanjem bafera u 2026. godini (i, prema verziji F5, RCE ako nema ASLR) prilikom rada s regularnim izrazima i varijablama, programer freenginx-a Maksim Dunin odlu\u010dio je da je vreme da to prestane i dodao je proveru veli\u010dine varijable pre nego \u0161to u nju upi\u0161e podatke. Ova novina je preuzeta od strane nginx-a, \u0161to daje nadu u prestanak novih CVE na ovu temu.<\/p>\n

Sada detalji.<\/p>\n

19. juna je napravljen commit<\/a> u freenginx-u, dodaju\u0107i u opisiva\u010d varijable polje end koje pokazuje na kraj bafera. Ranije je tu bio samo pokaziva\u010d na po\u010detak (pos), potrebna du\u017eina se ra\u010dunala (i sada se ra\u010duna) unapred, i u trenutku kopiranja podataka u varijablu se smatralo da unapred izra\u010dunata du\u017eina garantuje da podaci stanu u bafer. Na\u017ealost, ve\u0107 dva puta u maju 2026. godine zbog razli\u010ditih previd\u00e2 to nije bilo slu\u010daj (1 (linux.org.ru)<\/a>, 2 (linux.org.ru)<\/a>), \u0161to je dovodilo do prelivanja bafera i lo\u0161ih posledica. Tako, sada se prilikom kreiranja bafera varijable popunjava i pokaziva\u010d na njen kraj, a pre upisivanja podataka u varijablu, ako podaci ne staju, obrada zahteva \u0107e se kontrolisano zavr\u0161iti s gre\u0161kom. To zna\u010di da gre\u0161ke u izra\u010dunavanju du\u017eine jo\u0161 uvek mogu postojati, ali sada ne\u0107e o\u0161tetiti memoriju, ve\u0107 samo neuspeh konkretnog http zahteva. Slede\u0107im commit-ima (2 (freenginx.org)<\/a>, 3 (freenginx.org)<\/a>) dodata je sli\u010dna za\u0161tita na druge delove koda, uklju\u010duju\u0107i kod vo\u0111enja access-loga. 7. jula je objavljena verzija freenginx 1.31.3<\/a>, koja uklju\u010duje ovo ispravku.<\/p>\n

<\/p>\n

15. jula su ti commit-i preuzeti od nginx-a (1 (github.com)<\/a>, 2 (github.com)<\/a>, 3 (github.com)<\/a>, iz nekog razloga prevr\u0107u\u0107i drugi i tre\u0107i u lancu), problemu je dodeljen CVE-2026-42533<\/a>, a F5 je objavio slu\u017ebeni SA (f5.com)<\/a>.<\/p>\n

<\/noindex><\/p>\n

\u0160to se ti\u010de konkretne ranjivosti ovaj put: ona se manifestira pri kori\u0161tenju direktive map s regularnim izrazima s ozna\u010denim parametrima. \u0160to se ti\u010de ostalih uvjeta neophodnih za njeno aktiviranje, tekst u opisu commit-a i tekst u SA se malo razlikuju: u SA je navedeno da bi trebalo izra\u010dunati neku string koja koristi ozna\u010deni parametar, pre nego \u0161to rezultat ovog istog mapa. U opisu commit-a, u primjeru izme\u0111u ovih koraka, postoji i resetiranje varijable koja sadr\u017ei ozna\u010deni parametar. Kako god, u ve\u0107ini instaliranih nginx-ova ovako ne\u0161to verovatno ne\u0107e biti prisutno, pa je ranjivost na taj na\u010din malo koga pogodila. Tako\u0111e, treba napomenuti da se ispravka kalkulacije du\u017eine konkretno u ovom slu\u010daju u zakomitaranim promjenama \u010dini da nema (ili sam lo\u0161e tra\u017eio?), postoji samo za\u0161tita koja pretvara problem u kontrolisanu gre\u0161ku HTTP zahteva. Ipak, 19. jula je u freenginx dodano nekoliko ispravki (5bfb<\/a>, 7622<\/a>, b906<\/a>) za kalkulaciju du\u017eine za sli\u010dnu situaciju, ali nije odmah jasno da li jeste ili nije. <\/p>\n

Ranjivost se pojavila u verziji nginx 0.9.6, a ispravke su uklju\u010dene u verzije freenginx 1.31.3, nginx 1.30.4, nginx 1.31.3.<\/p>\n

U SA nginx-u se zahvaljuje mnogim osobama za neovisna izvje\u0161\u0107a o ranjivosti i po\u0161tivanje \u201estandard\u00e2 koordiniranog otkrivanja informacija\u201c:<\/p>\n

<\/p>\n

F5 se zahvaljuje Mingu Xuanu, DKD (@pidifn), Ji\u2019an Zhouu i Zhen Yanu iz AntAISecurityLab, Rafaelu Gaceku, Sergiju Negodiuku iz EVO.company, Lam Jun Rong iz Calif.io, Mufeed VH iz Winfunc Research (winfunc.com), Vexera AI (https:\/\/vexera.ai<\/a>), Tu Tranu Dinh (@1w4y), Stanu Shawu (cyberstan), qianshuidewajueji, zennethu (randomguy6407), Zhenpeng (Leo) Linu iz depthfirst, Lukasu Johannesu Moelleru, Melihu Tolgi Sahin iz Vodafone T\u00fcrkiye, Ayoubu Nabilu Boubagrat (GitHub: @ayoubnabil), i Milanu Jovicu (Kljunowsky) za to \u0161to su nam nezavisno skrenuli pa\u017enju na ovaj problem i po\u0161tovali najvi\u0161e standarde koordiniranog otkrivanja.<\/p>\n

<\/noindex><\/p><\/blockquote>\n

U freenginx, prate\u0107e informacije o ispravci zapravo se ograni\u010davaju na obave\u0161tenje prilikom commit-a. U changelog<\/a>- ova ispravka nije ozna\u010dena niti potpisom \u201esigurnost\u201c (security), niti \u201eispravka\u201c (bugfix), samo \u201edodavanje\u201c (feature). Vjerojatno autor nije smatrao ovaj problem kriti\u010dnim. Kako se povezuju izvje\u0161\u0107a o problemu od navedenih osoba u F5 i preuzet iz freenginx commit, nije bilo mogu\u0107e utvrditi jesu li oni (ili netko drugi) prijavili problem autoru freenginx. <\/p>\n

Izvor: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

3 TL;DR: \u0421\u0442\u043e\u043b\u043a\u043d\u0443\u0432\u0448\u0438\u0441\u044c \u0441 \u0442\u0440\u0435\u0442\u044c\u0438\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c \u0437\u0430 2026 \u0433\u043e\u0434 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 (\u0438, \u043f\u043e \u0432\u0435\u0440\u0441\u0438\u0438 F5, RCE \u0435\u0441\u043b\u0438 \u043d\u0435\u0442 ASLR) \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u0440\u0435\u0433\u044d\u043a\u0441\u043f\u0430\u043c\u0438 \u0438 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u043c\u0438, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a freenginx \u041c\u0430\u043a\u0441\u0438\u043c \u0414\u0443\u043d\u0438\u043d \u0440\u0435\u0448\u0438\u043b, \u0447\u0442\u043e \u043f\u043e\u0440\u0430 \u044d\u0442\u043e \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u0442\u044c, \u0438 \u0434\u043e\u0431\u0430\u0432\u0438\u043b \u0432 \u0441\u0432\u043e\u0439 \u043f\u0440\u043e\u0434\u0443\u043a\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434 \u0442\u0435\u043c \u043a\u0430\u043a \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0432 \u043d\u0435\u0451 \u0434\u0430\u043d\u043d\u044b\u0435. \u041e\u0442\u0442\u0443\u0434\u0430 \u044d\u0442\u043e \u043d\u043e\u0432\u043e\u0432\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0443\u0442\u0430\u0449\u0438\u043b\u0438 \u043a \u0441\u0435\u0431\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":9,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182826","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47U freenginx i nginx dodana je provjera veli\u010dine tekstualne varijable prije nego \u0161to se podaci zapisuju u nju (+ CVE) | ProHoster","description":"3 TL;DR: Suo\u010deni sa tre\u0107im otkrivenim prekomernim punjenjem bafera za 2026. godinu (i, prema verziji F5.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 freenginx \u0438 nginx \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u043e\u0439 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434 \u0442\u0435\u043c \u043a\u0430\u043a \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0432 \u043d\u0435\u0451 \u0434\u0430\u043d\u043d\u044b\u0435 (+ CVE) | ProHoster","og:description":"3 TL;DR: \u0421\u0442\u043e\u043b\u043a\u043d\u0443\u0432\u0448\u0438\u0441\u044c \u0441 \u0442\u0440\u0435\u0442\u044c\u0438\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c \u0437\u0430 2026 \u0433\u043e\u0434 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 (\u0438, \u043f\u043e \u0432\u0435\u0440\u0441\u0438\u0438 F5.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-08-11T02:54:22+00:00","article:modified_time":"2026-08-11T02:54:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"182826","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-08-11 06:43:49","updated":"2026-08-11 06:43:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/182826","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=182826"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/182826\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=182826"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=182826"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=182826"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}