Skip to content

Commit 7af6e59

Browse files
iAkliswindmgc
iAklis
authored and
windmgc
committed
fix(core): applied upstream nginx security patches for limiting the number of maximum headers
See: CVE-2026-49975
1 parent 7772bd8 commit 7af6e59

3 files changed

Lines changed: 129 additions & 5 deletions

File tree

‎build/openresty/patches/nginx-1.27.1_18-CVE-2026-49975.patch‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
diff --git a/bundle/nginx-1.27.1/src/http/ngx_http_core_module.c b/bundle/nginx-1.27.1/src/http/ngx_http_core_module.c
2+
index 937ffe2..d1948a7 100644
3+
--- a/bundle/nginx-1.27.1/src/http/ngx_http_core_module.c
4+
+++ b/bundle/nginx-1.27.1/src/http/ngx_http_core_module.c
5+
@@ -254,6 +254,13 @@ static ngx_command_t ngx_http_core_commands[] = {
6+
offsetof(ngx_http_core_srv_conf_t, large_client_header_buffers),
7+
NULL },
8+
9+
+ { ngx_string("max_headers"),
10+
+ NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
11+
+ ngx_conf_set_num_slot,
12+
+ NGX_HTTP_SRV_CONF_OFFSET,
13+
+ offsetof(ngx_http_core_srv_conf_t, max_headers),
14+
+ NULL },
15+
+
16+
{ ngx_string("ignore_invalid_headers"),
17+
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG,
18+
ngx_conf_set_flag_slot,
19+
@@ -3470,6 +3477,7 @@ ngx_http_core_create_srv_conf(ngx_conf_t *cf)
20+
cscf->request_pool_size = NGX_CONF_UNSET_SIZE;
21+
cscf->client_header_timeout = NGX_CONF_UNSET_MSEC;
22+
cscf->client_header_buffer_size = NGX_CONF_UNSET_SIZE;
23+
+ cscf->max_headers = NGX_CONF_UNSET_UINT;
24+
cscf->ignore_invalid_headers = NGX_CONF_UNSET;
25+
cscf->merge_slashes = NGX_CONF_UNSET;
26+
cscf->underscores_in_headers = NGX_CONF_UNSET;
27+
@@ -3511,6 +3519,8 @@ ngx_http_core_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
28+
return NGX_CONF_ERROR;
29+
}
30+
31+
+ ngx_conf_merge_uint_value(conf->max_headers, prev->max_headers, 1000);
32+
+
33+
ngx_conf_merge_value(conf->ignore_invalid_headers,
34+
prev->ignore_invalid_headers, 1);
35+
36+
diff --git a/bundle/nginx-1.27.1/src/http/ngx_http_core_module.h b/bundle/nginx-1.27.1/src/http/ngx_http_core_module.h
37+
index 765e7ff..5af748e 100644
38+
--- a/bundle/nginx-1.27.1/src/http/ngx_http_core_module.h
39+
+++ b/bundle/nginx-1.27.1/src/http/ngx_http_core_module.h
40+
@@ -198,6 +198,8 @@ typedef struct {
41+
42+
ngx_msec_t client_header_timeout;
43+
44+
+ ngx_uint_t max_headers;
45+
+
46+
ngx_flag_t ignore_invalid_headers;
47+
ngx_flag_t merge_slashes;
48+
ngx_flag_t underscores_in_headers;
49+
diff --git a/bundle/nginx-1.27.1/src/http/ngx_http_request.c b/bundle/nginx-1.27.1/src/http/ngx_http_request.c
50+
index 9593b7f..97ed5a3 100644
51+
--- a/bundle/nginx-1.27.1/src/http/ngx_http_request.c
52+
+++ b/bundle/nginx-1.27.1/src/http/ngx_http_request.c
53+
@@ -1489,6 +1489,15 @@ ngx_http_process_request_headers(ngx_event_t *rev)
54+
55+
/* a header line has been parsed successfully */
56+
57+
+ if (r->headers_in.count++ >= cscf->max_headers) {
58+
+ r->lingering_close = 1;
59+
+ ngx_log_error(NGX_LOG_INFO, c->log, 0,
60+
+ "client sent too many header lines");
61+
+ ngx_http_finalize_request(r,
62+
+ NGX_HTTP_REQUEST_HEADER_TOO_LARGE);
63+
+ break;
64+
+ }
65+
+
66+
h = ngx_list_push(&r->headers_in.headers);
67+
if (h == NULL) {
68+
ngx_http_close_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
69+
diff --git a/bundle/nginx-1.27.1/src/http/ngx_http_request.h b/bundle/nginx-1.27.1/src/http/ngx_http_request.h
70+
index 65c8333..2245280 100644
71+
--- a/bundle/nginx-1.27.1/src/http/ngx_http_request.h
72+
+++ b/bundle/nginx-1.27.1/src/http/ngx_http_request.h
73+
@@ -182,6 +182,7 @@ typedef struct {
74+
75+
typedef struct {
76+
ngx_list_t headers;
77+
+ ngx_uint_t count;
78+
79+
ngx_table_elt_t *host;
80+
ngx_table_elt_t *connection;
81+
diff --git a/bundle/nginx-1.27.1/src/http/v2/ngx_http_v2.c b/bundle/nginx-1.27.1/src/http/v2/ngx_http_v2.c
82+
index 91a28b2..c428242 100644
83+
--- a/bundle/nginx-1.27.1/src/http/v2/ngx_http_v2.c
84+
+++ b/bundle/nginx-1.27.1/src/http/v2/ngx_http_v2.c
85+
@@ -1822,6 +1822,15 @@ ngx_http_v2_state_process_header(ngx_http_v2_connection_t *h2c, u_char *pos,
86+
}
87+
88+
} else {
89+
+ cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);
90+
+
91+
+ if (r->headers_in.count++ >= cscf->max_headers) {
92+
+ ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
93+
+ "client sent too many header lines");
94+
+ ngx_http_finalize_request(r, NGX_HTTP_REQUEST_HEADER_TOO_LARGE);
95+
+ goto error;
96+
+ }
97+
+
98+
h = ngx_list_push(&r->headers_in.headers);
99+
if (h == NULL) {
100+
return ngx_http_v2_connection_error(h2c,
101+
diff --git a/bundle/nginx-1.27.1/src/http/v3/ngx_http_v3_request.c b/bundle/nginx-1.27.1/src/http/v3/ngx_http_v3_request.c
102+
index e41ad50..e457d88 100644
103+
--- a/bundle/nginx-1.27.1/src/http/v3/ngx_http_v3_request.c
104+
+++ b/bundle/nginx-1.27.1/src/http/v3/ngx_http_v3_request.c
105+
@@ -665,6 +665,15 @@ ngx_http_v3_process_header(ngx_http_request_t *r, ngx_str_t *name,
106+
}
107+
108+
} else {
109+
+ cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);
110+
+
111+
+ if (r->headers_in.count++ >= cscf->max_headers) {
112+
+ ngx_log_error(NGX_LOG_INFO, r->connection->log, 0,
113+
+ "client sent too many header lines");
114+
+ ngx_http_finalize_request(r, NGX_HTTP_REQUEST_HEADER_TOO_LARGE);
115+
+ return NGX_ERROR;
116+
+ }
117+
+
118+
h = ngx_list_push(&r->headers_in.headers);
119+
if (h == NULL) {
120+
ngx_http_close_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);

‎build/openresty/patches/ngx_lua-0.10.28_03-missing-lightud.patch‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
diff --git a/bundle/ngx_lua-0.10.28/src/ngx_http_lua_log.c b/bundle/ngx_lua-0.10.28/src/ngx_http_lua_log.c
2-
index 43ab8209..a83cc2de 100644
2+
index d18fd05..b5ace90 100644
33
--- a/bundle/ngx_lua-0.10.28/src/ngx_http_lua_log.c
44
+++ b/bundle/ngx_lua-0.10.28/src/ngx_http_lua_log.c
5-
@@ -253,10 +253,12 @@ log_wrapper(ngx_log_t *log, const char *ident, ngx_uint_t level,
5+
@@ -257,10 +257,12 @@ log_wrapper(ngx_log_t *log, const char *ident, ngx_uint_t level,
66
break;
7-
7+
88
case LUA_TLIGHTUSERDATA:
99
- *p++ = 'n';
1010
- *p++ = 'u';
@@ -16,6 +16,6 @@ index 43ab8209..a83cc2de 100644
1616
+ *p++ = 'l';
1717
+ *p++ = 'l';
1818
+ }
19-
19+
2020
break;
21-
21+

‎changelog/unreleased/kong/fix-nginx-cve-2026-49975.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
message: >-
2+
Applied upstream nginx security patches for limiting the number of maximum headers (CVE-2026-49975).
3+
type: bugfix
4+
scope: Core

0 commit comments

Comments
 (0)