{"id":182826,"date":"2026-08-11T04:54:22","date_gmt":"2026-08-11T02:54:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve"},"modified":"2026-08-11T04:54:22","modified_gmt":"2026-08-11T02:54:22","slug":"v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","title":{"rendered":"A freenginx \u00e9s a nginx hozz\u00e1adta a sz\u00f6veges v\u00e1ltoz\u00f3 m\u00e9ret\u00e9nek ellen\u0151rz\u00e9s\u00e9t, miel\u0151tt adatokat \u00edrna bele (+ CVE)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

<\/i><\/a>
3 <\/p>\n

R\u00f6viden \u00f6sszefoglalva<\/b>: A 2026-os \u00e9v harmadik \u00e9szlelt puffer-t\u00falcsordul\u00e1sa (\u00e9s az F5 szerint RCE, ha nincs ASLR) sor\u00e1n regul\u00e1ris kifejez\u00e9sek \u00e9s v\u00e1ltoz\u00f3k haszn\u00e1lata k\u00f6zben a freenginx fejleszt\u0151je, Makszim Dunin \u00fagy hat\u00e1rozott, itt az ideje v\u00e9get vetni ennek, \u00e9s hozz\u00e1adta a term\u00e9k\u00e9hez a v\u00e1ltoz\u00f3 m\u00e9ret\u00e9nek ellen\u0151rz\u00e9s\u00e9t, miel\u0151tt adatokat \u00edrna bele. Ezt az \u00faj\u00edt\u00e1st magukkal hozt\u00e1k az nginx-hoz is, ami rem\u00e9nyt ad arra, hogy a j\u00f6v\u0151ben ne sz\u00e1m\u00edtsunk \u00faj CVE-kre ezzel kapcsolatban.<\/p>\n

Most a r\u00e9szletek.<\/p>\n

J\u00fanius 19-\u00e9n k\u00e9sz\u00fclt commit-ra.<\/a> a freenginxben, amely a v\u00e1ltoz\u00f3 le\u00edr\u00f3j\u00e1hoz hozz\u00e1adott egy end mez\u0151t, jelezve a puffer v\u00e9g\u00e9t. Kor\u00e1bban csak a kezdeti poz\u00edci\u00f3 (pos) mutat\u00f3ja volt ott, a sz\u00fcks\u00e9ges hossz\u00fas\u00e1got el\u0151re sz\u00e1molt\u00e1k (\u00e9s most is sz\u00e1molj\u00e1k), \u00e9s a v\u00e1ltoz\u00f3ba t\u00f6rt\u00e9n\u0151 m\u00e1sol\u00e1s id\u0151pontj\u00e1ra m\u00e1r felt\u00e9telezt\u00e9k, hogy a kor\u00e1bban helyesen kisz\u00e1molt hossz\u00fas\u00e1g garant\u00e1lja, hogy az adatok belef\u00e9rnek a pufferbe. Sajnos, 2026 m\u00e1jus\u00e1ban m\u00e1r k\u00e9tszer is k\u00fcl\u00f6nb\u00f6z\u0151 figyelmetlens\u00e9gek miatt ez nem \u00edgy volt (1 (linux.org.ru)<\/a>, 2 (linux.org.ru)<\/a>), ami puffert\u00falcsordul\u00e1shoz \u00e9s kedvez\u0151tlen k\u00f6vetkezm\u00e9nyekhez vezetett. Most viszont, amikor puffer v\u00e1ltoz\u00f3 j\u00f6n l\u00e9tre, a v\u00e9g\u00e9re mutat\u00f3 mutat\u00f3 is be\u00e1ll\u00edt\u00e1sra ker\u00fcl, \u00e9s ha az adatok nem f\u00e9rnek bele a v\u00e1ltoz\u00f3ba az \u00edr\u00e1s el\u0151tt, a k\u00e9r\u00e9s feldolgoz\u00e1sa kontroll\u00e1lt k\u00f6r\u00fclm\u00e9nyek k\u00f6z\u00f6tt hib\u00e1val fejez\u0151dik be. Ez azt jelenti, hogy a hossz\u00fas\u00e1gi sz\u00e1m\u00edt\u00e1sok hib\u00e1i tov\u00e1bbra is el\u0151fordulhatnak, de ezek most m\u00e1r nem ram-ot fognak \u00fctni, hanem csak egy konkr\u00e9t http-k\u00e9r\u00e9st fognak elutas\u00edtani. A k\u00f6vetkez\u0151 commitok (2 (freenginx.org)<\/a>, 3 (freenginx.org)<\/a>) hasonl\u00f3 v\u00e9delmet vezettek be a k\u00f3d m\u00e1s r\u00e9szein is, bele\u00e9rtve az access-log kezel\u00e9s\u00e9nek k\u00f3dj\u00e1t. J\u00falius 7-\u00e9n megjelent a k\u00f6vetkez\u0151 verzi\u00f3: freenginx 1.31.3<\/a>, amely tartalmazza ezt a jav\u00edt\u00e1st.<\/p>\n

<\/p>\n

J\u00falius 15-\u00e9n ezeket az elk\u00f6telez\u00e9seket \u00e1tvette az nginx (1 (github.com)<\/a>, 2 (github.com)<\/a>, 3 (github.com)<\/a>, valami\u00e9rt felcser\u00e9lve a m\u00e1sodikat \u00e9s a harmadikat a l\u00e1ncban), a probl\u00e9m\u00e1t pedig \u00e9rdemelt CVE-2026-42533<\/a>, az F5 pedig kiadta az hivatalos SA (f5.com)<\/a>.<\/p>\n

<\/noindex><\/p>\n

A konkr\u00e9t sebezhet\u0151s\u00e9ggel kapcsolatosan: ez a map direkt\u00edv\u00e1k haszn\u00e1latakor jelentkezik, amelyek kiemelt param\u00e9terekkel rendelkez\u0151 regul\u00e1ris kifejez\u00e9seket alkalmaznak. A t\u00f6bbi sz\u00fcks\u00e9ges felt\u00e9tel, amely a m\u0171k\u00f6d\u00e9s\u00e9hez sz\u00fcks\u00e9ges, elt\u00e9r a commit le\u00edr\u00e1sban \u00e9s a SA sz\u00f6veg\u00e9ben: a SA-ban az \u00e1ll, hogy k\u00e9s\u0151bb egy bizonyos string kisz\u00e1m\u00edt\u00e1sa t\u00f6rt\u00e9nik, amely a map-b\u00f3l sz\u00e1rmaz\u00f3 kiemelt param\u00e9tert haszn\u00e1lja, m\u00e9g miel\u0151tt a map eredm\u00e9nye meg\u00e9rkezik. A commit le\u00edr\u00e1s\u00e1ban azonban a p\u00e9ld\u00e1ban e l\u00e9p\u00e9sek k\u00f6z\u00f6tt szerepel egy v\u00e1ltoz\u00f3 null\u00e1z\u00e1sa, amely a kiemelt param\u00e9tert tartalmazza. B\u00e1rhogy is legyen, a legt\u00f6bb fut\u00f3 nginx p\u00e9ld\u00e1nyban val\u00f3sz\u00edn\u0171leg nem lesz ilyen helyzet, \u00edgy a sebezhet\u0151s\u00e9g ilyen m\u00f3don keveseket \u00e9rintett. \u00c9rdemes megjegyezni, hogy a hosszm\u00e9r\u00e9si jav\u00edt\u00e1sokban a konkr\u00e9t esetben a commitokban l\u00e1tsz\u00f3lag nincsenek (vagy rosszul kerestem?), csup\u00e1n egy v\u00e9delem van, amely a probl\u00e9m\u00e1t kontroll\u00e1lt HTTP-k\u00e9r\u00e9s hib\u00e1v\u00e1 alak\u00edtja. B\u00e1r j\u00falius 19-\u00e9n a freenginxhez valamilyen jav\u00edt\u00e1sok ker\u00fcltek be5bfb<\/a>, 7622<\/a>, b906<\/a>) a hasonl\u00f3 helyzetek hossz\u00e1nak sz\u00e1m\u00edt\u00e1s\u00e1hoz, de azonnal nem lehet megmondani, hogy ez az, vagy sem. <\/p>\n

A sebezhet\u0151s\u00e9g az nginx 0.9.6 verzi\u00f3ban jelent meg, a jav\u00edt\u00e1sok a freenginx 1.31.3, nginx 1.30.4, nginx 1.31.3 verzi\u00f3kban ker\u00fcltek be.<\/p>\n

A SA nginx t\u00f6bb szem\u00e9lynek k\u00f6sz\u00f6netet mond az independent sebezhet\u0151s\u00e9gi bejelent\u00e9sek\u00e9rt \u00e9s a \"koordin\u00e1lt t\u00e1j\u00e9koztat\u00e1s standardjainak\" betart\u00e1s\u00e1\u00e9rt:<\/p>\n

<\/p>\n

Az F5 elismeri Ming Xuant, DKD-t (@pidifn), Ji\u2019an Zhou-t \u00e9s Zhen Yan-t az AntAISecurityLab-t\u00f3l, Rafael Gacek-t, Sergii Negodiuk-ot az EVO.company-t\u00f3l, Lam Jun Rong-ot a Calif.io-t\u00f3l, Mufeed VH-t a Winfunc Research-t\u0151l (winfunc.com), Vexera AI-t (https:\/\/vexera.ai<\/a>), Tu Tran Dinh-nek (@1w4y), Stan Shaw-nak (cyberstan), qianshuidewajueji-nek, zenneth-nek (randomguy6407), Zhenpeng (Leo) Lin-nek a depthfirst-t\u0151l, Lukas Johannes Moeller-nek, Melih Tolga Sahin-nak a Vodafone T\u00fcrkiye-t\u0151l, Ayoub Nabil Boubagratnak (GitHub: @ayoubnabil), \u00e9s Milan Jovic-nak (Kljunowsky) az\u00e9rt, hogy f\u00fcggetlen\u00fcl felh\u00edvt\u00e1k figyelm\u00fcnket erre a probl\u00e9m\u00e1ra, \u00e9s k\u00f6vett\u00e9k a koordin\u00e1lt k\u00f6zz\u00e9t\u00e9tel legmagasabb szabv\u00e1nyait.<\/p>\n

<\/noindex><\/p><\/blockquote>\n

A freenginxhez tartoz\u00f3 k\u00eds\u00e9r\u0151 inform\u00e1ci\u00f3 a jav\u00edt\u00e1sokr\u00f3l l\u00e9nyeg\u00e9ben a commit \u00fczenetre korl\u00e1toz\u00f3dik. Az OpenBSD 7.6 kiad\u00e1s<\/a>- ez a jav\u00edt\u00e1s m\u00e9g csak nem is az \"biztons\u00e1g\" (security) vagy \"jav\u00edt\u00e1s\" (bugfix) alatt van megjel\u00f6lve, hanem egyszer\u0171en \"hozz\u00e1ad\u00e1s\" (feature). Val\u00f3sz\u00edn\u0171leg a szerz\u0151 nem tartotta ezt a probl\u00e9m\u00e1t kritikusnak. A F5 \u00e1ltal megjelent probl\u00e9mabejelent\u00e9sek \u00e9s a freenginx-b\u0151l sz\u00e1rmaz\u00f3 commit k\u00f6z\u00f6tti kapcsolat felt\u00e1r\u00e1s\u00e1ra, hogy t\u00e1j\u00e9koztatt\u00e1k-e \u0151t (vagy b\u00e1rki m\u00e1st) a freenginx szerz\u0151j\u00e9nek a probl\u00e9m\u00e1r\u00f3l, nem siker\u00fclt f\u00e9nyt der\u00edteni. <\/p>\n

Forr\u00e1s: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

3 TL;DR: \u0421\u0442\u043e\u043b\u043a\u043d\u0443\u0432\u0448\u0438\u0441\u044c \u0441 \u0442\u0440\u0435\u0442\u044c\u0438\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c \u0437\u0430 2026 \u0433\u043e\u0434 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 (\u0438, \u043f\u043e \u0432\u0435\u0440\u0441\u0438\u0438 F5, RCE \u0435\u0441\u043b\u0438 \u043d\u0435\u0442 ASLR) \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u0440\u0435\u0433\u044d\u043a\u0441\u043f\u0430\u043c\u0438 \u0438 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u043c\u0438, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a freenginx \u041c\u0430\u043a\u0441\u0438\u043c \u0414\u0443\u043d\u0438\u043d \u0440\u0435\u0448\u0438\u043b, \u0447\u0442\u043e \u043f\u043e\u0440\u0430 \u044d\u0442\u043e \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u0442\u044c, \u0438 \u0434\u043e\u0431\u0430\u0432\u0438\u043b \u0432 \u0441\u0432\u043e\u0439 \u043f\u0440\u043e\u0434\u0443\u043a\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434 \u0442\u0435\u043c \u043a\u0430\u043a \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0432 \u043d\u0435\u0451 \u0434\u0430\u043d\u043d\u044b\u0435. \u041e\u0442\u0442\u0443\u0434\u0430 \u044d\u0442\u043e \u043d\u043e\u0432\u043e\u0432\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0443\u0442\u0430\u0449\u0438\u043b\u0438 \u043a \u0441\u0435\u0431\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":9,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182826","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A freenginx \u00e9s nginx eset\u00e9ben a sz\u00f6veges v\u00e1ltoz\u00f3 m\u00e9ret\u00e9nek ellen\u0151rz\u00e9s\u00e9t bevezett\u00e9k, miel\u0151tt adatokat \u00edrn\u00e1nak bele (+ CVE) | ProHoster","description":"3 TL;DR: A 2026-os \u00e9v harmadik \u00e9szlelt buffert\u00falcsordul\u00e1s\u00e1val tal\u00e1lkozva (\u00e9s F5 v\u00e9lem\u00e9nye szerint.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 freenginx \u0438 nginx \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u043e\u0439 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434 \u0442\u0435\u043c \u043a\u0430\u043a \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0432 \u043d\u0435\u0451 \u0434\u0430\u043d\u043d\u044b\u0435 (+ CVE) | ProHoster","og:description":"3 TL;DR: \u0421\u0442\u043e\u043b\u043a\u043d\u0443\u0432\u0448\u0438\u0441\u044c \u0441 \u0442\u0440\u0435\u0442\u044c\u0438\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c \u0437\u0430 2026 \u0433\u043e\u0434 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 (\u0438, \u043f\u043e \u0432\u0435\u0440\u0441\u0438\u0438 F5.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-08-11T02:54:22+00:00","article:modified_time":"2026-08-11T02:54:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"182826","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-08-11 06:43:49","updated":"2026-08-11 06:43:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/182826","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=182826"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/182826\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=182826"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=182826"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=182826"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}