{"id":182227,"date":"2026-06-18T08:48:05","date_gmt":"2026-06-18T06:48:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-nginx-1-31-2-s-ustraneniem-uyazvimostej-ekspluatiruemyh-cherez-http-3-http2-i-grpc"},"modified":"2026-06-18T08:48:05","modified_gmt":"2026-06-18T06:48:05","slug":"obnovlenie-nginx-1-31-2-s-ustraneniem-uyazvimostej-ekspluatiruemyh-cherez-http-3-http2-i-grpc","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/obnovlenie-nginx-1-31-2-s-ustraneniem-uyazvimostej-ekspluatiruemyh-cherez-http-3-http2-i-grpc","title":{"rendered":"Aggiornamento di nginx 1.31.2 con correzioni per vulnerabilit\u00e0 sfruttabili tramite HTTP\/3, HTTP2 e gRPC","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
\u00c8 stata rilasciata la versione principale di nginx 1.31.2, che continua lo sviluppo di nuove funzionalit\u00e0, e parallelamente \u00e8 stata rilasciata la versione stabile supportata di nginx 1.30.3, alla quale vengono apportate solo modifiche relative alla correzione di gravi bug e vulnerabilit\u00e0. Negli aggiornamenti sono state corrette 3 vulnerabilit\u00e0:<\/p>\n
\n
CVE-2026-42530 \u2014 access to already freed memory (use-after-free) in the implementation of the HTTP\/3 protocol. This issue has been assigned a critical severity level (9.2 out of 10), potentially allowing remote code execution with the permissions of a worker process when handling a specially crafted QUIC session.\n
CVE-2026-42055 \u2014 buffer overflow in the ngx_http_proxy_v2_module and ngx_http_grpc_module, occurring when proxying specially crafted requests over HTTP\/2 or to a gRPC backend. This issue has been assigned a critical severity level (9.2 out of 10), permitting remote code execution. The vulnerability manifests in configurations with the setting \n\u00abignore_invalid_headers off;\u00bb and a high value for \u00ablarge_client_header_buffers\u00bb.<\/p>\n
CVE-2026-48142 \u2014 reading from an area outside the allocated buffer when processing specially crafted requests leading to the recoding of text in UTF-8 encoding using the ngx_http_charset_module. The vulnerability appears in configurations with the directive \u00abcharset_map\u00bb where in the location block directives \u00absource_charset utf-8\u00bb and \u00abcharset other_encoding\u00bb are present. This issue has been assigned a medium severity level (6.3 out of 10), allowing for potential memory leak of the worker process's content.\n<\/ul>\n
Oltre alla correzione delle vulnerabilit\u00e0, la versione nginx 1.31.2 introduce la variabile $ssl_sigalgs, che contiene gli algoritmi di firma digitale dichiarati dal client nel messaggio ClientHello durante la negoziazione della connessione TLS. Per la generazione dell'identificatore trasmesso tramite la variabile $request_id, \u00e8 stato utilizzato l'algoritmo di hash SipHash-2-4. \n Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"