{"id":182826,"date":"2026-08-11T04:54:22","date_gmt":"2026-08-11T02:54:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve"},"modified":"2026-08-11T04:54:22","modified_gmt":"2026-08-11T02:54:22","slug":"v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","title":{"rendered":"N\u00eb freenginx dhe nginx u shtua kontrolli i madh\u00ebsis\u00eb s\u00eb variabl\u00ebs tekstuale para se t\u00eb regjistrohej informacioni n\u00eb t\u00eb (+ CVE)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

<\/i><\/a>
3 <\/p>\n

TL;DR<\/b>: P\u00ebrball\u00eb mbushjes s\u00eb tret\u00eb t\u00eb zbuluar p\u00ebr vitin 2026 q\u00eb ndodhi (dhe, sipas F5, RCE n\u00ebse nuk ka ASLR) gjat\u00eb pun\u00ebs me regex dhe variablat, zhvilluesi i freenginx, Maksim Dunin, vendosi se ishte koha ta ndalonte k\u00ebt\u00eb, dhe shtoi n\u00eb produktin e tij kontrollin e madh\u00ebsis\u00eb s\u00eb variabl\u00ebs para se t\u00eb shkruante t\u00eb dh\u00ebna n\u00eb t\u00eb. Nga aty ky risi u mor dhe nga nginx, e cila jep shpres\u00eb p\u00ebr t\u00eb ndalur CVE t\u00eb reja mbi k\u00ebt\u00eb tem\u00eb.<\/p>\n

Tani detajet.<\/p>\n

M\u00eb 19 qershor u b\u00eb komit<\/a> n\u00eb freenginx, q\u00eb shton n\u00eb p\u00ebrshkrimin e variabl\u00ebs nj\u00eb fush\u00eb end, e cila tregon fundin e mbushjes. M\u00eb par\u00eb kishte vet\u00ebm nj\u00eb tregues drejt fillimit t\u00eb tij (pos), dhe gjat\u00ebsia e nevojshme llogaritej (dhe tani llogaritet) paraprakisht, dhe n\u00eb momentin e kopjimit t\u00eb t\u00eb dh\u00ebnave n\u00eb variab\u00ebl supozohej se gjat\u00ebsia e llogaritur m\u00eb par\u00eb do t\u00eb garantonte q\u00eb t\u00eb dh\u00ebnat t\u00eb gjenin vend n\u00eb mbushje. Fatkeq\u00ebsisht, dy her\u00eb n\u00eb maj 2026 p\u00ebr shkak t\u00eb mang\u00ebsive t\u00eb ndryshme, kjo nuk ka qen\u00eb k\u00ebshtu (1 (linux.org.ru)<\/a>, 2 (linux.org.ru)<\/a>), q\u00eb ka \u00e7uar n\u00eb mbushje t\u00eb mbushjes dhe pasojat e k\u00ebqija. Pra tani, kur krijohet mbushja, plotesohet gjithashtu dhe treguesi i fundit t\u00eb saj, dhe para se t\u00eb shkruhen t\u00eb dh\u00ebnat n\u00eb variab\u00ebl, n\u00ebse t\u00eb dh\u00ebnat nuk hyn\u00eb, p\u00ebrpunimi i k\u00ebrkes\u00ebs do t\u00eb mbyllet n\u00eb m\u00ebnyr\u00eb t\u00eb kontrolluar me nj\u00eb gabim. Dometh\u00ebn\u00eb, gabimet n\u00eb llogaritjen e gjat\u00ebsis\u00eb mund t\u00eb ndodhin p\u00ebrs\u00ebri, por tani do t\u00eb d\u00ebshtojn\u00eb vet\u00ebm nj\u00eb k\u00ebrkes\u00eb t\u00eb ve\u00e7ant\u00eb http, dhe nuk do t\u00eb d\u00ebmtojn\u00eb memorien. Me angazhimet e ardhshme (2 (freenginx.org)<\/a>, 3 (freenginx.org)<\/a>) mbrojtja e ngjashme u shtua n\u00eb vende t\u00eb tjera t\u00eb kodit, duke p\u00ebrfshir\u00eb kodin p\u00ebr mbajtjen e access-logut. M\u00eb 7 korrik u publikua versioni freenginx 1.31.3<\/a>, q\u00eb p\u00ebrfshin k\u00ebt\u00eb rregullim.<\/p>\n

<\/p>\n

M\u00eb 15 korrik k\u00ebta angazhime u mor\u00ebn nga nginx (1 (github.com)<\/a>, 2 (github.com)<\/a>, 3 (github.com)<\/a>, p\u00ebr ndonj\u00eb arsye nd\u00ebrruan vendet e dyt\u00eb dhe t\u00eb tret\u00eb n\u00eb zinxhir), problemit iu dha CVE-2026-42533<\/a>, dhe F5 publikoi zyrtarisht SA (f5.com)<\/a>.<\/p>\n

<\/noindex><\/p>\n

Sa lidhje me nj\u00eb dob\u00ebsi t\u00eb ve\u00e7ant\u00eb k\u00ebt\u00eb her\u00eb: ajo shfaqet gjat\u00eb p\u00ebrdorimit t\u00eb direktiv\u00ebs map me regex me parametra t\u00eb dh\u00ebn\u00eb. N\u00eb lidhje me kushtet e tjera t\u00eb nevojshme p\u00ebr funksionimin e saj, teksti n\u00eb p\u00ebrshkrimin e komitetit dhe teksti n\u00eb SA paksa ndryshojn\u00eb: n\u00eb SA thuhet se p\u00ebr m\u00eb von\u00eb duhet t\u00eb ket\u00eb nj\u00eb llogaritje t\u00eb nj\u00eb vargu, i cili p\u00ebrdor parametrin e dh\u00ebn\u00eb, i mbetur nga map, para se t\u00eb sillet rezultati i po atij map. N\u00eb p\u00ebrshkrimin e komitetit, n\u00eb shembujt midis k\u00ebtyre hapave merr pjes\u00eb gjithashtu rivler\u00ebsimi i nj\u00eb variabli q\u00eb p\u00ebrmban parametrin e dh\u00ebn\u00eb. \u00c7far\u00ebdo q\u00eb t\u00eb ndodh\u00eb, n\u00eb shumic\u00ebn e nginx-ve t\u00eb funksionuar, nj\u00eb gj\u00eb e till\u00eb ndoshta nuk do t\u00eb haset, dhe k\u00ebshtu dob\u00ebsia n\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb ka prekur pak njer\u00ebz. Duhet gjithashtu t\u00eb theksohet se rregullimet e llogaritjes s\u00eb gjat\u00eb n\u00eb k\u00ebt\u00eb rast t\u00eb ve\u00e7ant\u00eb n\u00eb rregullimet e komituara duket se nuk ekzistojn\u00eb (ose ndoshta nuk kam k\u00ebrkuar si\u00e7 duhet?), ka vet\u00ebm mbrojtje q\u00eb e shnd\u00ebrron problemin n\u00eb nj\u00eb d\u00ebshtim t\u00eb kontrolluar t\u00eb HTTP-s\u00eb. Edhe pse m\u00eb 19 korrik n\u00eb freenginx jan\u00eb shtuar disa rregullime5bfb<\/a>, 7622<\/a>, b906<\/a>) t\u00eb llogaritjes s\u00eb gjat\u00eb p\u00ebr nj\u00eb situat\u00eb t\u00eb ngjashme, por nuk kuptohet menj\u00ebher\u00eb n\u00ebse \u00ebsht\u00eb k\u00ebshtu apo jo. <\/p>\n

Dob\u00ebsia shfaqet n\u00eb versionin nginx 0.9.6, rregullimet jan\u00eb p\u00ebrfshir\u00eb n\u00eb versionet freenginx 1.31.3, nginx 1.30.4, nginx 1.31.3.<\/p>\n

N\u00eb SA nginx jan\u00eb shprehur fal\u00ebnderime p\u00ebr disa persona p\u00ebr mesazhet e tyre t\u00eb pavarura rreth dob\u00ebsive dhe p\u00ebr p\u00ebrmbushjen e «standardeve t\u00eb zbulimit t\u00eb koordinuar t\u00eb informacionit»:<\/p>\n

<\/p>\n

F5 i njofton Ming Xuan, DKD (@pidifn), Ji\u2019an Zhou, dhe Zhen Yan t\u00eb AntAISecurityLab, Rafael Gacek, Sergii Negodiuk t\u00eb EVO.company, Lam Jun Rong t\u00eb Calif.io, Mufeed VH t\u00eb Winfunc Research (winfunc.com), Vexera AI (https:\/\/vexera.ai<\/a>), Tu Tran Dinh (@1w4y), Stan Shaw (cyberstan), qianshuidewajueji, zenneth (randomguy6407), Zhenpeng (Leo) Lin t\u00eb depthfirst, Lukas Johannes Moeller, Melih Tolga Sahin t\u00eb Vodafone T\u00fcrkiye, Ayoub Nabil Boubagrat (GitHub: @ayoubnabil), dhe Milan Jovic (Kljunowsky) p\u00ebr njoftimin e pavarur t\u00eb k\u00ebtij problemi dhe p\u00ebr ndjekjen e standardeve m\u00eb t\u00eb larta t\u00eb shp\u00ebrndarjes t\u00eb koordinuara.<\/p>\n

<\/noindex><\/p><\/blockquote>\n

N\u00eb freenginx, informacioni shoq\u00ebrues mbi rregullimin n\u00eb fakt kufizohet n\u00eb njoftimin gjat\u00eb komitetit. N\u00eb changelog<\/a>- ky korrigjim as nuk \u00ebsht\u00eb sh\u00ebnuar me n\u00ebnshkrimin «siguri» (security), as «korrigjim» (bugfix), thjesht «shtes\u00eb» (feature). Probabiliteti \u00ebsht\u00eb q\u00eb autori nuk e ka konsideruar k\u00ebt\u00eb problem kritik. Si lidhen mesazhet rreth problemit nga ata t\u00eb p\u00ebrmendur n\u00eb F5 dhe komiti i marr\u00eb nga freenginx, n\u00ebse ata (ose dikush tjet\u00ebr) e kan\u00eb njoftuar autorin e freenginx-it p\u00ebr problemin, nuk \u00ebsht\u00eb arritur t\u00eb zbulohet. <\/p>\n

Burimi: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

3 TL;DR: \u0421\u0442\u043e\u043b\u043a\u043d\u0443\u0432\u0448\u0438\u0441\u044c \u0441 \u0442\u0440\u0435\u0442\u044c\u0438\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c \u0437\u0430 2026 \u0433\u043e\u0434 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 (\u0438, \u043f\u043e \u0432\u0435\u0440\u0441\u0438\u0438 F5, RCE \u0435\u0441\u043b\u0438 \u043d\u0435\u0442 ASLR) \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u0440\u0435\u0433\u044d\u043a\u0441\u043f\u0430\u043c\u0438 \u0438 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u043c\u0438, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a freenginx \u041c\u0430\u043a\u0441\u0438\u043c \u0414\u0443\u043d\u0438\u043d \u0440\u0435\u0448\u0438\u043b, \u0447\u0442\u043e \u043f\u043e\u0440\u0430 \u044d\u0442\u043e \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u0442\u044c, \u0438 \u0434\u043e\u0431\u0430\u0432\u0438\u043b \u0432 \u0441\u0432\u043e\u0439 \u043f\u0440\u043e\u0434\u0443\u043a\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434 \u0442\u0435\u043c \u043a\u0430\u043a \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0432 \u043d\u0435\u0451 \u0434\u0430\u043d\u043d\u044b\u0435. \u041e\u0442\u0442\u0443\u0434\u0430 \u044d\u0442\u043e \u043d\u043e\u0432\u043e\u0432\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0443\u0442\u0430\u0449\u0438\u043b\u0438 \u043a \u0441\u0435\u0431\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":9,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182826","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47N\u00eb freenginx dhe nginx u shtua kontrolli i madh\u00ebsis\u00eb s\u00eb variablit tekstual para se t\u00eb regjistrojm\u00eb t\u00eb dh\u00ebna n\u00eb t\u00eb (+ CVE) | ProHoster","description":"3 TL;DR: Ballafaquar me mbinxehjen e tret\u00eb t\u00eb zbuluar p\u00ebr vitin 2026 (dhe, sipas F5.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 freenginx \u0438 nginx \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u043e\u0439 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434 \u0442\u0435\u043c \u043a\u0430\u043a \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0432 \u043d\u0435\u0451 \u0434\u0430\u043d\u043d\u044b\u0435 (+ CVE) | ProHoster","og:description":"3 TL;DR: \u0421\u0442\u043e\u043b\u043a\u043d\u0443\u0432\u0448\u0438\u0441\u044c \u0441 \u0442\u0440\u0435\u0442\u044c\u0438\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c \u0437\u0430 2026 \u0433\u043e\u0434 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 (\u0438, \u043f\u043e \u0432\u0435\u0440\u0441\u0438\u0438 F5.","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-08-11T02:54:22+00:00","article:modified_time":"2026-08-11T02:54:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"182826","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-08-11 06:43:49","updated":"2026-08-11 06:43:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/182826","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=182826"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/182826\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=182826"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=182826"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=182826"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}