-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 05 Jun 2026 12:22:02 +0000 Source: nginx Binary: libnginx-mod-http-geoip libnginx-mod-http-geoip-dbgsym libnginx-mod-http-image-filter libnginx-mod-http-image-filter-dbgsym libnginx-mod-http-perl libnginx-mod-http-perl-dbgsym libnginx-mod-http-xslt-filter libnginx-mod-http-xslt-filter-dbgsym libnginx-mod-mail libnginx-mod-mail-dbgsym libnginx-mod-stream libnginx-mod-stream-dbgsym libnginx-mod-stream-geoip libnginx-mod-stream-geoip-dbgsym nginx nginx-dbgsym nginx-extras Architecture: s390x Version: 1.26.3-3+deb13u6 Distribution: trixie-security Urgency: medium Maintainer: s390x Build Daemon (ziehrer) Changed-By: Jan Mojžíš Description: libnginx-mod-http-geoip - GeoIP HTTP module for Nginx libnginx-mod-http-image-filter - HTTP image filter module for Nginx libnginx-mod-http-perl - Perl module for Nginx libnginx-mod-http-xslt-filter - XSLT Transformation module for Nginx libnginx-mod-mail - Mail module for Nginx libnginx-mod-stream - Stream module for Nginx libnginx-mod-stream-geoip - GeoIP Stream module for Nginx nginx - small, powerful, scalable web/proxy server nginx-extras - nginx web/proxy server (extended version) Changes: nginx (1.26.3-3+deb13u6) trixie-security; urgency=medium . * Apply both patches to fix CVE-2026-42946. In the previous version, only one part of the patch was applied, so the fix was incomplete. This really fixes CVE-2026-42946, thanks to charles@debian.org for pointing it out. * d/p/CVE-2026-42946.patch rename to d/p/CVE-2026-42946.2.patch * d/p/CVE-2026-42946.1.patch add * backport fix for buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-9256) from upstream 1.30.2 nginx. * d/p/CVE-2026-9256.patch add * backport max_headers directive from upstream nginx. It limits the number of request headers accepted from clients. Fixes remote denial-of-service exploit. And move max_headers from core module to the ngx_http_header_count_module to avoid potential ABI breakage and keep all the 3rd party modules compatible with the new version of nginx without recompilation. A big thanks to Miao Wang for preparing the modification. Fixes TEMP-1138794-BADE22. * d/p/FIX-HTTP2bomb.patch add Checksums-Sha1: c143ea04da90fdb886a9c0df8c990e75c2e271f0 37448 libnginx-mod-http-geoip-dbgsym_1.26.3-3+deb13u6_s390x.deb 52d6bd50c872879ec5152f0983a640b3f5def817 88916 libnginx-mod-http-geoip_1.26.3-3+deb13u6_s390x.deb 8e51df1128292e33b015a812d772070ad3c3d77b 45796 libnginx-mod-http-image-filter-dbgsym_1.26.3-3+deb13u6_s390x.deb ed69cd2c0e79dfbd62717459f33b3e150cce93e1 92544 libnginx-mod-http-image-filter_1.26.3-3+deb13u6_s390x.deb e8b1053868f39ac8d717c3232f9ce9158861f542 109048 libnginx-mod-http-perl-dbgsym_1.26.3-3+deb13u6_s390x.deb 909b7a8c0027d917c64ad89471f1ab521e7e5a81 100516 libnginx-mod-http-perl_1.26.3-3+deb13u6_s390x.deb 99e30349e0773f6828237e8121d7d3ea85012cb7 54404 libnginx-mod-http-xslt-filter-dbgsym_1.26.3-3+deb13u6_s390x.deb f8af43136d9bd01079198f3d633b6945fbbd3575 90996 libnginx-mod-http-xslt-filter_1.26.3-3+deb13u6_s390x.deb a2d65dca1032739835a1fb94c3381979fc9c9035 106228 libnginx-mod-mail-dbgsym_1.26.3-3+deb13u6_s390x.deb 138062cb2db7212ac2ae384d72a5562942765381 123004 libnginx-mod-mail_1.26.3-3+deb13u6_s390x.deb 2079b46642c9970eb429fadc121df944952aa4e2 187288 libnginx-mod-stream-dbgsym_1.26.3-3+deb13u6_s390x.deb 23743dbbcf79a340aa9d9653e3d781f19af31252 23028 libnginx-mod-stream-geoip-dbgsym_1.26.3-3+deb13u6_s390x.deb 0197bb85ba8cc31aeb4596ba9529362d42510b91 88104 libnginx-mod-stream-geoip_1.26.3-3+deb13u6_s390x.deb 52fab3067419f4ef3f58bc50f93a2f5415073efc 151472 libnginx-mod-stream_1.26.3-3+deb13u6_s390x.deb f28c555eda98345479b392334d1e7f26c628321b 1350284 nginx-dbgsym_1.26.3-3+deb13u6_s390x.deb 0e4f8476ca044374420c7e5683b143d9ada4315e 84488 nginx-extras_1.26.3-3+deb13u6_s390x.deb 4fad04640b3210a16ffaf335ee81d4a353634de5 13695 nginx_1.26.3-3+deb13u6_s390x-buildd.buildinfo e6a72ae993ebf285a3878b27600db0762de2cdcb 598148 nginx_1.26.3-3+deb13u6_s390x.deb Checksums-Sha256: a4d67fd1c8f3270626db1a0fa8f5c2545db392c151292cb5e6ce552c08f7b05f 37448 libnginx-mod-http-geoip-dbgsym_1.26.3-3+deb13u6_s390x.deb a7ca0c03af4ab8b26528a3af7d368b68e363cd9a558cba573714169b6905a132 88916 libnginx-mod-http-geoip_1.26.3-3+deb13u6_s390x.deb ea5f6dd4f4fefc46b55e331c0510ddab333720c944761eea8fe3047a357b8ae6 45796 libnginx-mod-http-image-filter-dbgsym_1.26.3-3+deb13u6_s390x.deb 63cc59d8a332b9ef00a9f710f90f4f6fdc7da1f10243822ab44043eb1792b318 92544 libnginx-mod-http-image-filter_1.26.3-3+deb13u6_s390x.deb e444d088677a5a8dc130caba2fb8ea8d7db5b84e82ed1ccec1f5b841001bab09 109048 libnginx-mod-http-perl-dbgsym_1.26.3-3+deb13u6_s390x.deb 26c66f1e52f09a8ff37aafbae77aab9581f2db4d84a7ef9e0d35deb0702201af 100516 libnginx-mod-http-perl_1.26.3-3+deb13u6_s390x.deb 625a0b3234dcb08500d9d433b187559a5c12715b67a3ea1044b7d9f49614a471 54404 libnginx-mod-http-xslt-filter-dbgsym_1.26.3-3+deb13u6_s390x.deb ab920823be5d688d7d5a05b9ccb4f9177600cf4ee46eeab2a3adc57aa311b39f 90996 libnginx-mod-http-xslt-filter_1.26.3-3+deb13u6_s390x.deb 94bf08236288f458b96c5f0f8bd76a9e014747128ed8b7974c4f7e58d3547b01 106228 libnginx-mod-mail-dbgsym_1.26.3-3+deb13u6_s390x.deb 5d75bf17911038dfb72b13e2f4b485550e6391897217518341e78e96062e8e3a 123004 libnginx-mod-mail_1.26.3-3+deb13u6_s390x.deb 652b60037aac67aeb574226c7e77eb0a3dd0d233473ed8ae1d2a97533fbb32bf 187288 libnginx-mod-stream-dbgsym_1.26.3-3+deb13u6_s390x.deb 3ad68f6175d6efe76da468e63bd5af952c7041d1987da72ce4f208453c89b091 23028 libnginx-mod-stream-geoip-dbgsym_1.26.3-3+deb13u6_s390x.deb dadfaa481ab1be89c28d383fd94da54600ff5e85a26d5e3166e435eee974a5af 88104 libnginx-mod-stream-geoip_1.26.3-3+deb13u6_s390x.deb f16aba318fc14bd442a63804235b291af660bcb2217c49516fc374f8a26a5cf0 151472 libnginx-mod-stream_1.26.3-3+deb13u6_s390x.deb 6756fbea466e6a5059634c568ce930a04b759c32e5b3b3c9cde92987f86b2334 1350284 nginx-dbgsym_1.26.3-3+deb13u6_s390x.deb d9a74c13e6effaf432cb0c0b01eb2000d48b2297b35103ab99dd9cace20dcb48 84488 nginx-extras_1.26.3-3+deb13u6_s390x.deb 474d604f260ec8a5ba60936b8e50f2c4221d6f7637885c93c03bdfbc0fc48ea3 13695 nginx_1.26.3-3+deb13u6_s390x-buildd.buildinfo f577557cf3639e031f25b9a155ea5319f730580352b45ef73debecc3406ab9ae 598148 nginx_1.26.3-3+deb13u6_s390x.deb Files: de5aa38430efd1f75eebbae66b49b1a3 37448 debug optional libnginx-mod-http-geoip-dbgsym_1.26.3-3+deb13u6_s390x.deb dfd4ecb6512a90837131c6dfe10a6bc3 88916 httpd optional libnginx-mod-http-geoip_1.26.3-3+deb13u6_s390x.deb 3ac52b6ba9c1ee038ebaf46d965a6d76 45796 debug optional libnginx-mod-http-image-filter-dbgsym_1.26.3-3+deb13u6_s390x.deb 89af0f69f8c1b8d4c6399e5bda11dedd 92544 httpd optional libnginx-mod-http-image-filter_1.26.3-3+deb13u6_s390x.deb 755ba586708a8c18e1322e5db30fec18 109048 debug optional libnginx-mod-http-perl-dbgsym_1.26.3-3+deb13u6_s390x.deb 4119489767cd0976c593e5f32754c946 100516 httpd optional libnginx-mod-http-perl_1.26.3-3+deb13u6_s390x.deb 3dcc2ebcbc92eff3e2216fbc54a37b72 54404 debug optional libnginx-mod-http-xslt-filter-dbgsym_1.26.3-3+deb13u6_s390x.deb ead722c5954a78f0f602d54bc9aa4ebb 90996 httpd optional libnginx-mod-http-xslt-filter_1.26.3-3+deb13u6_s390x.deb dfffce7ce22d198f918d75dae1bd4e34 106228 debug optional libnginx-mod-mail-dbgsym_1.26.3-3+deb13u6_s390x.deb 9c7eaa5281dbdaf8dce20540a3186d5b 123004 httpd optional libnginx-mod-mail_1.26.3-3+deb13u6_s390x.deb 54f30276dbd8a1813f5f91787c0a9ae3 187288 debug optional libnginx-mod-stream-dbgsym_1.26.3-3+deb13u6_s390x.deb aa6963e95a0b372bb9d767ef5b297a19 23028 debug optional libnginx-mod-stream-geoip-dbgsym_1.26.3-3+deb13u6_s390x.deb ca2d504ff5b63b30d5a3dd892621308b 88104 httpd optional libnginx-mod-stream-geoip_1.26.3-3+deb13u6_s390x.deb 4e7c291829c74194b1ba99c9e2f63afa 151472 httpd optional libnginx-mod-stream_1.26.3-3+deb13u6_s390x.deb b99308acb07e22775ba93727e5616c33 1350284 debug optional nginx-dbgsym_1.26.3-3+deb13u6_s390x.deb 0ebbf26bd5e4f761fa79f894ae21ad8a 84488 httpd optional nginx-extras_1.26.3-3+deb13u6_s390x.deb 2cfcc3232b72745f3b602173e0c5cb7f 13695 httpd optional nginx_1.26.3-3+deb13u6_s390x-buildd.buildinfo 35a2ed7fa0471439b8f2466b4936c2d0 598148 httpd optional nginx_1.26.3-3+deb13u6_s390x.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEl0BM/nR+Oj597wRWMWUFebkHnoQFAmokMywACgkQMWUFebkH noRB7Q//TIQfIt8/S33gi+p847ZnvIrDzARJ7MMVR8d8l6P9cc/oh8Fxd7Bmn35e /g/9L6QQ8V9ikC1gUwrWn91eBEGSwkVIMnT1csjjc4eROtpr5XfHSC51ZUgL+Bsj r2dEr9FuebymdtxmfKZIWC+0/LnTjXSibJDsupGKd6OzlZnd9Tn2ngS03Gqtrfa2 RqUB3hBMqVIU6oWi2SMkBOFYlCR7d0/6ftZzg9fU7u83egWYsb80y9eoS4zGkJtd YaJ5h1a7nYLeIe5egkIRK7g1P5wvBcMtx0kSLwMJQz8paWu4I3mvc+2kwvmup6xv 20xOB/PTtdJfoNnV+v8G+MfJm7X6OKFc3kYsPWGHQpWwJYyAtHSF5GNUTbFgzy7W KAqUw0I9KV+0nVByF9xLNR1B8hgyJsqRea0pFw/r0s8gJWTFEaYpq/OgSyWZwcnx 29SE3nvuAsoumEhOQhdU/urdLjMWP+1EhB/kXjkbAWlVhgou7vaFufc/IDSC4aHT F0iKGokUuZTAxF2hOzlKVDpn6CISYs5hK+anhpVpQVS020pxBFXCwkI9mRT5h79p BHSlR1qV9tyt2xHklxTwf+/5YWzUeGOSOkveHwgVQuG+7LzioQ6T3yWhPeIGWN5k bbdiZN8jaNQpGrKrTexwlpWY2cbOGjxln4/yRJXoMOelr+MIWwU= =TNfr -----END PGP SIGNATURE-----