{"id":182826,"date":"2026-08-11T04:54:22","date_gmt":"2026-08-11T02:54:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve"},"modified":"2026-08-11T04:54:22","modified_gmt":"2026-08-11T02:54:22","slug":"v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","title":{"rendered":"N\u00eb freenginx dhe nginx u shtua kontrolli i madh\u00ebsis\u00eb s\u00eb variablave tekstuale para se t'i shkruanin ato (+ CVE)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

<\/i><\/a>
3 <\/p>\n

TL;DR<\/b>: Takuar p\u00ebrball\u00eb mbushjes s\u00eb tret\u00eb t\u00eb zbuluar p\u00ebr vitin 2026 (dhe, sipas F5, RCE n\u00ebse nuk ka ASLR) gjat\u00eb pun\u00ebs me regexp dhe variablat, zhvilluesi i freenginx, Maksim Dunin, vendosi se ishte koha p\u00ebr ta ndalur k\u00ebt\u00eb dhe shtoi n\u00eb produktin e tij nj\u00eb kontroll t\u00eb madh\u00ebsis\u00eb s\u00eb variablave para se t\u00eb shkruhet n\u00eb to. Nga aty ky novacion u mor dhe p\u00ebr n\u00eb nginx, q\u00eb jep shpres\u00eb p\u00ebr t\u00eb ndaluar CVE t\u00eb reja mbi k\u00ebt\u00eb tem\u00eb.<\/p>\n

Tani detajet.<\/p>\n

M\u00eb 19 qershor u realizua komit<\/a> n\u00eb freenginx, q\u00eb shton n\u00eb p\u00ebrshkrimin e variablave nj\u00eb fush\u00eb end, e cila tregon fundin e buffer-it. M\u00eb par\u00eb aty kishte vet\u00ebm nj\u00eb tregues n\u00eb fillimin e tij (pos), dhe gjat\u00ebsia e nevojshme llogaritej (dhe tani llogaritet) paraprakisht, dhe n\u00eb momentin e kopjimit t\u00eb t\u00eb dh\u00ebnave n\u00eb variablat supozohej se gjat\u00ebsia e llogaritur sakt\u00eb m\u00eb par\u00eb siguron se t\u00eb dh\u00ebnat do t\u00eb hyjn\u00eb n\u00eb buffer. Fatkeq\u00ebsisht, tashm\u00eb dy her\u00eb n\u00eb maj 2026 p\u00ebr shkak t\u00eb l\u00ebshimeve t\u00eb ndryshme kjo nuk ishte e v\u00ebrtet\u00eb (1 (linux.org.ru)<\/a>, 2 (linux.org.ru)<\/a>), e cila rezultoi n\u00eb mbushje t\u00eb buffer-it dhe pasoja t\u00eb k\u00ebqija. Ashtu q\u00eb tani, gjat\u00eb krijimit t\u00eb buffer-it variabla, plot\u00ebsohet gjithashtu treguesi n\u00eb fundin e saj, dhe para se t\u00eb shkruhen t\u00eb dh\u00ebnat n\u00eb variabl\u00eb, n\u00ebse t\u00eb dh\u00ebnat nuk hyjn\u00eb, p\u00ebrpunimi i k\u00ebrkes\u00ebs do t\u00eb p\u00ebrfundoj\u00eb n\u00eb m\u00ebnyr\u00eb t\u00eb kontrolluar me nj\u00eb gabim. Pra, gabimet e llogaritjes s\u00eb gjat\u00ebsis\u00eb mund t\u00eb vazhdojn\u00eb t\u00eb ekzistojn\u00eb, por ato tani nuk do t\u00eb godasin memorien, por vet\u00ebm do t\u00eb d\u00ebshtojn\u00eb k\u00ebrkes\u00ebn specifike http. Me komit\u00ebt e ardhshme (2 (freenginx.org)<\/a>, 3 (freenginx.org)<\/a>) u shtua nj\u00eb mbrojtje e ngjashme n\u00eb vende t\u00eb tjera t\u00eb kodit, duke p\u00ebrfshir\u00eb kodin e mbajtjes s\u00eb access-logut. M\u00eb 7 korrik, u publikua versione freenginx 1.31.3<\/a>, duke p\u00ebrfshir\u00eb k\u00ebt\u00eb rregullim.<\/p>\n

<\/p>\n

M\u00eb 15 korrik k\u00ebto komitete u mor\u00ebn nga nginx (1 (github.com)<\/a>, 2 (github.com)<\/a>, 3 (github.com)<\/a>, p\u00ebr \u00e7udi k\u00ebmbimi i dyt\u00eb dhe t\u00eb tret\u00eb n\u00eb zinxhir), problemit iu caktua CVE-2026-42533<\/a>, dhe F5 publikoi nj\u00eb SA (f5.com)<\/a>.<\/p>\n

<\/noindex><\/p>\n

N\u00eb lidhje me nj\u00eb dob\u00ebsi t\u00eb caktuar k\u00ebt\u00eb her\u00eb: ajo shfaqet kur p\u00ebrdoret direktiva map me regex me parametra t\u00eb dalluesh\u00ebm. P\u00ebrsa i p\u00ebrket kushteve t\u00eb tjera t\u00eb nevojshme p\u00ebr aktivizimin e saj, teksti n\u00eb p\u00ebrshkrimin e komitit dhe teksti n\u00eb SA paksa ndryshojn\u00eb: n\u00eb SA \u00ebsht\u00eb p\u00ebrmendur se m\u00eb von\u00eb duhet t\u00eb llogaritet nj\u00eb varg, i cili p\u00ebrdor parametrin e dalluesh\u00ebm q\u00eb mbetet nga map, p\u00ebrpara se rezultati i k\u00ebtij map. N\u00eb p\u00ebrshkrimin e komitit n\u00eb shembullin nd\u00ebrmjet k\u00ebtyre hapave merr pjes\u00eb gjithashtu zeroja e nj\u00eb variabli, q\u00eb p\u00ebrmban parametrin e dalluesh\u00ebm. Si\u00e7 mund t\u00eb jet\u00eb, n\u00eb shumic\u00ebn e nginx-ave t\u00eb instaluar, nj\u00eb gj\u00eb e till\u00eb ka shum\u00eb mund\u00ebsi t\u00eb mos e gjej\u00eb, dhe dob\u00ebsia n\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb ka prekur pak njer\u00ebz. \u00cbsht\u00eb po ashtu p\u00ebr t'u v\u00ebn\u00eb re se nuk duket se korrigjimi i llogaritjes s\u00eb gjat\u00ebsi specifike n\u00eb k\u00ebt\u00eb rast n\u00eb korrigjimet e komituara \u00ebsht\u00eb i pranish\u00ebm (ose nuk kam k\u00ebrkuar mir\u00eb?), ka vet\u00ebm mbrojtje, e cila e shnd\u00ebrron problemin n\u00eb nj\u00eb d\u00ebshtim t\u00eb kontrolluar t\u00eb HTTP-s\u00eb. Megjithat\u00eb, m\u00eb 19 korrik n\u00eb freenginx jan\u00eb shtuar disa korrigjime (5bfb<\/a>, 7622<\/a>, b906<\/a>) p\u00ebr llogaritjen e gjat\u00ebsi p\u00ebr nj\u00eb situat\u00eb t\u00eb ngjashme, por nuk \u00ebsht\u00eb e qart\u00eb n\u00ebse \u00ebsht\u00eb kjo ose jo. <\/p>\n

Dob\u00ebsia u shfaq n\u00eb versionin nginx 0.9.6, korrigjimet arrit\u00ebn n\u00eb versionet freenginx 1.31.3, nginx 1.30.4, nginx 1.31.3.<\/p>\n

N\u00eb SA nginx jan\u00eb shprehur fal\u00ebnderime p\u00ebr disa persona p\u00ebr raportet e tyre t\u00eb pavarura mbi vulnerabilitetin dhe p\u00ebr respektohen «standardet e zbulimit t\u00eb koordinuar t\u00eb informacionit»:<\/p>\n

<\/p>\n

F5 i jep fal\u00ebnderime Ming Xuan, DKD (@pidifn), Ji\u2019an Zhou dhe Zhen Yan nga AntAISecurityLab, Rafael Gacek, Sergii Negodiuk nga EVO.company, Lam Jun Rong nga Calif.io, Mufeed VH nga Winfunc Research (winfunc.com), Vexera AI (https:\/\/vexera.ai<\/a>), Tu Tran Dinh (@1w4y), Stan Shaw (cyberstan), qianshuidewajueji, zenneth (randomguy6407), Zhenpeng (Leo) Lin t\u00eb depthfirst, Lukas Johannes Moeller, Melih Tolga Sahin t\u00eb Vodafone T\u00fcrkiye, Ayoub Nabil Boubagrat (GitHub: @ayoubnabil), dhe Milan Jovic (Kljunowsky) p\u00ebr sjelljen e pavarur t\u00eb k\u00ebtij problemi n\u00eb v\u00ebmendjen ton\u00eb dhe p\u00ebr ndjekjen e standardeve m\u00eb t\u00eb larta t\u00eb zbuluar t\u00eb koordinuar.<\/p>\n

<\/noindex><\/p><\/blockquote>\n

N\u00eb freenginx, informacioni shoq\u00ebrues p\u00ebr korrigjimin n\u00eb fakt \u00ebsht\u00eb i kufizuar n\u00eb mesazhin gjat\u00eb komitit. N\u00eb changelog<\/a>- Ky riparim as q\u00eb \u00ebsht\u00eb sh\u00ebnuar me asnj\u00eb Firm\u00eb «siguria» (security), as «riparim» (bugfix), thjesht «shtes\u00eb» (feature). Ndoshta autori nuk e konsideronte k\u00ebt\u00eb problem kritik. Si lidhen raportet mbi problemin nga k\u00ebta individ\u00eb n\u00eb F5 me komitin e marr\u00eb nga freenginx, dhe n\u00ebse ata (apo dikush tjet\u00ebr) i kan\u00eb raportuar problemin autorit t\u00eb freenginx, nuk \u00ebsht\u00eb arritur t\u00eb zbulohet. <\/p>\n

Burimi: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

3 TL;DR: \u0421\u0442\u043e\u043b\u043a\u043d\u0443\u0432\u0448\u0438\u0441\u044c \u0441 \u0442\u0440\u0435\u0442\u044c\u0438\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c \u0437\u0430 2026 \u0433\u043e\u0434 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 (\u0438, \u043f\u043e \u0432\u0435\u0440\u0441\u0438\u0438 F5, RCE \u0435\u0441\u043b\u0438 \u043d\u0435\u0442 ASLR) \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u0440\u0435\u0433\u044d\u043a\u0441\u043f\u0430\u043c\u0438 \u0438 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u043c\u0438, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a freenginx \u041c\u0430\u043a\u0441\u0438\u043c \u0414\u0443\u043d\u0438\u043d \u0440\u0435\u0448\u0438\u043b, \u0447\u0442\u043e \u043f\u043e\u0440\u0430 \u044d\u0442\u043e \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u0442\u044c, \u0438 \u0434\u043e\u0431\u0430\u0432\u0438\u043b \u0432 \u0441\u0432\u043e\u0439 \u043f\u0440\u043e\u0434\u0443\u043a\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434 \u0442\u0435\u043c \u043a\u0430\u043a \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0432 \u043d\u0435\u0451 \u0434\u0430\u043d\u043d\u044b\u0435. \u041e\u0442\u0442\u0443\u0434\u0430 \u044d\u0442\u043e \u043d\u043e\u0432\u043e\u0432\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0443\u0442\u0430\u0449\u0438\u043b\u0438 \u043a \u0441\u0435\u0431\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":9,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182826","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47N\u00eb freenginx dhe nginx u shtua kontrolli i madh\u00ebsis\u00eb s\u00eb variabl\u00ebs tekstuale para se t\u00eb shkruhet n\u00eb t\u00eb (+ CVE) | ProHoster","description":"3 TL;DR: Duke u p\u00ebrballur me nj\u00eb e p\u00ebrdit\u00ebsuar t\u00eb tret\u00eb t\u00eb gjetur p\u00ebr vitin 2026, mbushja e buffer-it (dhe, sipas versionit F5.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 freenginx \u0438 nginx \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u043e\u0439 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434 \u0442\u0435\u043c \u043a\u0430\u043a \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0432 \u043d\u0435\u0451 \u0434\u0430\u043d\u043d\u044b\u0435 (+ CVE) | ProHoster","og:description":"3 TL;DR: \u0421\u0442\u043e\u043b\u043a\u043d\u0443\u0432\u0448\u0438\u0441\u044c \u0441 \u0442\u0440\u0435\u0442\u044c\u0438\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c \u0437\u0430 2026 \u0433\u043e\u0434 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 (\u0438, \u043f\u043e \u0432\u0435\u0440\u0441\u0438\u0438 F5.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-08-11T02:54:22+00:00","article:modified_time":"2026-08-11T02:54:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"182826","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-08-11 06:43:49","updated":"2026-08-11 06:43:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/182826","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=182826"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/182826\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=182826"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=182826"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=182826"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}