{"id":182826,"date":"2026-08-11T04:54:22","date_gmt":"2026-08-11T02:54:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve"},"modified":"2026-08-11T04:54:22","modified_gmt":"2026-08-11T02:54:22","slug":"v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","title":{"rendered":"I freenginx och nginx har en kontroll av storleken p\u00e5 textvariabeln lagts till innan data skrivs till den (+ CVE)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

<\/i><\/a>
3 <\/p>\n

TL;DR<\/b>: St\u00e4lld inf\u00f6r den tredje buffer\u00f6verskridningen som uppt\u00e4cktes under 2026 (och enligt F5, RCE om ASLR inte anv\u00e4nds) vid arbete med regexp och variabler, best\u00e4mde sig utvecklaren av freenginx, Maxim Dunin, f\u00f6r att det var dags att s\u00e4tta stopp f\u00f6r detta, och la till en kontroll av variabelns storlek innan den skrivs. Detta nyheter har nu \u00e4ven tagits till nginx, vilket ger hopp om att nya CVE p\u00e5 detta tema snart kan upph\u00f6ra.<\/p>\n

Nu detaljer.<\/p>\n

Den 19 juni gjordes commit<\/a> i freenginx, vilket l\u00e4gger till ett f\u00e4lt till variabeln som anger slutet av bufferten. Tidigare fanns bara en pekare till b\u00f6rjan (pos), och den n\u00f6dv\u00e4ndiga l\u00e4ngden ber\u00e4knades (och ber\u00e4knas fortfarande) i f\u00f6rv\u00e4g, och vid kopiering av data till variabeln f\u00f6rutsattes det att r\u00e4tt dimensionerad l\u00e4ngd skulle s\u00e4kerst\u00e4lla att data skulle f\u00e5 plats i bufferten. Tyv\u00e4rr har det vid tv\u00e5 tillf\u00e4llen i maj 2026, p\u00e5 grund av olika f\u00f6rbiseenden, visat sig att s\u00e5 inte var fallet (1 (linux.org.ru)<\/a>, 2 (linux.org.ru)<\/a>), vilket ledde till buffert\u00f6verskridningar och negativa konsekvenser. Nu, n\u00e4r bufferten f\u00f6r variabeln skapas, fylls \u00e4ven pekaren till dess slut, och innan data skrivs till variabeln, om data inte f\u00e5r plats, kommer behandlingen av f\u00f6rfr\u00e5gan kontrollerat att avslutas med ett fel. Det inneb\u00e4r att l\u00e4ngdber\u00e4kningsfel fortfarande kan intr\u00e4ffa, men de kommer nu inte l\u00e4ngre att krossa minnet, utan endast misslyckas med den aktuella http-f\u00f6rfr\u00e5gan. De f\u00f6ljande committerna (2 (freenginx.org)<\/a>, 3 (freenginx.org)<\/a>) har lagt till liknande skydd p\u00e5 andra st\u00e4llen i koden, inklusive koden f\u00f6r accessloggen. Den 7 juli publicerades versionen freenginx 1.31.3<\/a>, som inneh\u00e5ller denna fix.<\/p>\n

<\/p>\n

Den 15 juli blev dessa commits adopterade av nginx (1 (github.com)<\/a>, 2 (github.com)<\/a>, 3 (github.com)<\/a>, av n\u00e5gon anledning i omv\u00e4nd ordning mellan den andra och den tredje i kedjan), problemet tilldelades CVE-2026-42533<\/a>, och F5 sl\u00e4ppte en officiell SA (f5.com)<\/a>.<\/p>\n

<\/noindex><\/p>\n

Ang\u00e5ende den specifika s\u00e5rbarheten denna g\u00e5ng: den uppst\u00e5r n\u00e4r man anv\u00e4nder map-direktiv med regex som har matchande parametrar. Betr\u00e4ffande de andra n\u00f6dv\u00e4ndiga villkoren f\u00f6r att den ska utl\u00f6sas skiljer sig texten i commitbeskrivningen och texten i SA n\u00e5got: i SA anges att det senare b\u00f6r ske en ber\u00e4kning av en specifik str\u00e4ng som anv\u00e4nder den matchade parametern fr\u00e5n map, tidigare \u00e4n resultatet av samma map. I commitbeskrivningen ing\u00e5r det dessutom en nollst\u00e4llning av en variabel som inneh\u00e5ller den matchade parametern mellan dessa steg. Hur som helst kommer s\u00e5dana situationer troligtvis inte att finnas i de flesta k\u00f6rda nginx:er, och d\u00e4rmed har s\u00e5rbarheten p\u00e5verkat f\u00e5. Det \u00e4r ocks\u00e5 v\u00e4rt att p\u00e5peka att det, i de committade \u00e4ndringarna, tycks saknas n\u00e5gra r\u00e4ttelser f\u00f6r ber\u00e4kning av l\u00e4ngden specifikt i detta fall (eller s\u00e5 letade jag d\u00e5ligt?), det finns bara ett skydd som omvandlar problemet till en kontrollerad felaktig http-f\u00f6rfr\u00e5gan. \u00c4ven den 19 juli tillf\u00f6rdes vissa r\u00e4ttelser i freenginx.5bfb<\/a>, 7622<\/a>, b906<\/a>) ber\u00e4kning av l\u00e4ngden f\u00f6r en liknande situation, men det \u00e4r sv\u00e5rt att omedelbart avg\u00f6ra om det \u00e4r det eller inte. <\/p>\n

S\u00e5rbarheten uppkom i nginx version 0.9.6, och r\u00e4ttelserna kom i versionerna freenginx 1.31.3, nginx 1.30.4, nginx 1.31.3.<\/p>\n

\u0412 SA nginx \u0443\u043a\u0430\u0437\u0430\u043d\u044b \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u043d\u043e\u0441\u0442\u0438 \u0440\u044f\u0434\u0443 \u043b\u0438\u0446 \u0437\u0430 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u044b\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0441\u043e\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u0435 «\u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043e\u0432 \u0441\u043a\u043e\u043e\u0440\u0434\u0438\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438»:<\/p>\n

<\/p>\n

F5 acknowledges Ming Xuan, DKD (@pidifn), Ji’an Zhou, and Zhen Yan of AntAISecurityLab, Rafael Gacek, Sergii Negodiuk of EVO.company, Lam Jun Rong of Calif.io, Mufeed VH of Winfunc Research (winfunc.com), Vexera AI (https:\/\/vexera.ai<\/a>), Tu Tran Dinh (@1w4y), Stan Shaw (cyberstan), qianshuidewajueji, zenneth (randomguy6407), Zhenpeng (Leo) Lin fr\u00e5n depthfirst, Lukas Johannes Moeller, Melih Tolga Sahin fr\u00e5n Vodafone T\u00fcrkiye, Ayoub Nabil Boubagrat (GitHub: @ayoubnabil) och Milan Jovic (Kljunowsky) f\u00f6r att de oberoende har tagit upp detta problem med oss och f\u00f6ljt de h\u00f6gsta standarderna f\u00f6r samordnad informationsl\u00e4mning.<\/p>\n

<\/noindex><\/p><\/blockquote>\n

I freenginx begr\u00e4nsas den tillh\u00f6rande informationen om r\u00e4ttelsen praktiskt taget till meddelandet i commit. I changelog<\/a>-\u0435 \u0434\u0430\u043d\u043d\u043e\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u0430\u0436\u0435 \u043d\u0435 \u043f\u043e\u043c\u0435\u0447\u0435\u043d\u043e \u043d\u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u044c\u044e «\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c» (security), \u043d\u0438 «\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435» (bugfix), \u043f\u0440\u043e\u0441\u0442\u043e «\u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0435» (feature). \u0412\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0430\u0432\u0442\u043e\u0440 \u043d\u0435 \u0441\u0447\u0438\u0442\u0430\u043b \u0434\u0430\u043d\u043d\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439. \u041a\u0430\u043a \u0441\u043e\u043e\u0442\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u0445 \u043b\u0438\u0446 \u0432 F5 \u0438 \u0437\u0430\u0438\u043c\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0438\u0437 freenginx \u043a\u043e\u043c\u043c\u0438\u0442, \u0441\u043e\u043e\u0431\u0449\u0430\u043b\u0438 \u043b\u0438 \u043e\u043d\u0438 (\u0438\u043b\u0438 \u043a\u0442\u043e-\u0442\u043e \u0435\u0449\u0451) \u043f\u0440\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0430\u0432\u0442\u043e\u0440\u0443 freenginx, \u0432\u044b\u044f\u0441\u043d\u0438\u0442\u044c \u043d\u0435 \u0443\u0434\u0430\u043b\u043e\u0441\u044c. <\/p>\n

K\u00e4lla: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

3 TL;DR: \u0421\u0442\u043e\u043b\u043a\u043d\u0443\u0432\u0448\u0438\u0441\u044c \u0441 \u0442\u0440\u0435\u0442\u044c\u0438\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c \u0437\u0430 2026 \u0433\u043e\u0434 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 (\u0438, \u043f\u043e \u0432\u0435\u0440\u0441\u0438\u0438 F5, RCE \u0435\u0441\u043b\u0438 \u043d\u0435\u0442 ASLR) \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u0440\u0435\u0433\u044d\u043a\u0441\u043f\u0430\u043c\u0438 \u0438 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u043c\u0438, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a freenginx \u041c\u0430\u043a\u0441\u0438\u043c \u0414\u0443\u043d\u0438\u043d \u0440\u0435\u0448\u0438\u043b, \u0447\u0442\u043e \u043f\u043e\u0440\u0430 \u044d\u0442\u043e \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u0442\u044c, \u0438 \u0434\u043e\u0431\u0430\u0432\u0438\u043b \u0432 \u0441\u0432\u043e\u0439 \u043f\u0440\u043e\u0434\u0443\u043a\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434 \u0442\u0435\u043c \u043a\u0430\u043a \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0432 \u043d\u0435\u0451 \u0434\u0430\u043d\u043d\u044b\u0435. \u041e\u0442\u0442\u0443\u0434\u0430 \u044d\u0442\u043e \u043d\u043e\u0432\u043e\u0432\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0443\u0442\u0430\u0449\u0438\u043b\u0438 \u043a \u0441\u0435\u0431\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":9,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182826","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47I freenginx och nginx har storlekskontrollen f\u00f6r textvariabler lagts till innan data skrivs in i dem (+ CVE) | ProHoster","description":"3 TL;DR: I m\u00f6tet med den tredje uppt\u00e4ckta buffer\u00f6verskridningen f\u00f6r \u00e5r 2026 (och enligt F5.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 freenginx \u0438 nginx \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u043e\u0439 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434 \u0442\u0435\u043c \u043a\u0430\u043a \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0432 \u043d\u0435\u0451 \u0434\u0430\u043d\u043d\u044b\u0435 (+ CVE) | ProHoster","og:description":"3 TL;DR: \u0421\u0442\u043e\u043b\u043a\u043d\u0443\u0432\u0448\u0438\u0441\u044c \u0441 \u0442\u0440\u0435\u0442\u044c\u0438\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c \u0437\u0430 2026 \u0433\u043e\u0434 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 (\u0438, \u043f\u043e \u0432\u0435\u0440\u0441\u0438\u0438 F5.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-08-11T02:54:22+00:00","article:modified_time":"2026-08-11T02:54:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"182826","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-08-11 06:43:49","updated":"2026-08-11 06:43:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/182826","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=182826"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/182826\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=182826"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=182826"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=182826"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}