-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 15 May 2026 20:26:45 +0000
Source: nginx
Architecture: source
Version: 1.30.0-4
Distribution: unstable
Urgency: medium
Maintainer: Debian Nginx Maintainers <pkg-nginx-maintainers@alioth-lists.debian.net>
Changed-By: Jan Mojžíš <janmojzis@debian.org>
Changes:
nginx (1.30.0-4) unstable; urgency=medium
.
* backport changes from upstream nginx, HTTP/3 address spoofing
(CVE-2026-40460), buffer overread in the ngx_http_scgi_module and
ngx_http_uwsgi_module (CVE-2026-42946), resolver use-after-free in OCSP
(CVE-2026-40701), buffer overread in the ngx_http_charset_module
(CVE-2026-42934), HTTP/2 request injection in the ngx_http_proxy_module
(CVE-2026-42926)
* d/p/CVE-2026-40460.patch add
* d/p/CVE-2026-42946.patch add
* d/p/CVE-2026-40701.patch add
* d/p/CVE-2026-42934.patch add
* d/p/CVE-2026-42926.patch add
Checksums-Sha1:
02b94faba97d1300f874021eea3b5adeaf1b8f61 4047 nginx_1.30.0-4.dsc
feaa22d874f40101bcc1e34fcc4d6c1f17f04d97 78336 nginx_1.30.0-4.debian.tar.xz
e134e0423b3e55a417dcd573b889de4d99b74f72 2816448 nginx_1.30.0-4.git.tar.xz
7a35423bb2919b5a84b828f3dd89de36beaec92c 17344 nginx_1.30.0-4_source.buildinfo
Checksums-Sha256:
613c21cae0543e23315ffebb1da65f3dc1f9193dc9998ec47a13bc2592000ea4 4047 nginx_1.30.0-4.dsc
2ff075f556b3e16be705c6d25ff12f6332ca14d561a5ef5612797f2f5eda195b 78336 nginx_1.30.0-4.debian.tar.xz
27137fd885948994e63ffb75b5a2967a399a12782f41ea18b511969ad41fed95 2816448 nginx_1.30.0-4.git.tar.xz
9edd9c736a38454445887b7c885b61b73f853e2d9fe93b3322ce6b713ca4e303 17344 nginx_1.30.0-4_source.buildinfo
Files:
a1881aea21f3c420805a7fcc212bbb3e 4047 httpd optional nginx_1.30.0-4.dsc
f14056098896d84f446057ce840743dd 78336 httpd optional nginx_1.30.0-4.debian.tar.xz
a0bc3bd0e9145025324bafb9716040e3 2816448 httpd None nginx_1.30.0-4.git.tar.xz
abae79d248631a6dd5b05fceb76ec457 17344 httpd optional nginx_1.30.0-4_source.buildinfo
Git-Tag-Info: tag=edd823ba5565114de901ecf1c5d8cd8155249d10 fp=d008b0c23d8479e46b9fcb9045da517496939ff9
Git-Tag-Tagger: Jan Mojžíš <jan.mojzis@gmail.com>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmoHiSoACgkQYG0ITkaD
wHl/IA/+MhltAqyZneRSUzjDzqIYginyUa3vsALltYurlBSPBsrbjohaLSX6U+gM
UcHyrRXnUkqWWUYOR7VbvgsvlC7HMwqmWHl5Y8+X8lWEotydfE5u4SHf/M35tPLs
4v9PxGAgxXeiyedOCg1cVZ2zA3V3MN36D30emkTC2xAYvPMS1ODxCDNlPbtIIBDa
uru4cN7/CQ3iZUwWq8e4W6K1I+k+JzPHaozfOKefoQLvzAvfsCoqS8G/8dpfC9pd
eVXbElR54f5cWV1IXDPdnTJ5X4By2OxiVgfQBSguzn/XimRsIK79h3BdPnj4LXtm
eOq8C0tWdg9/InJGuiSHQJvsOfYmBAoq7xWFXJri8tsnvsS6EvvDgUThBO06CQPk
2mezIG0orzrEl4AdN2Z+oX88dfjv1yg7pG7MwP/OmmHTIZO22IBWZHOp4kb0UwdK
CbT6uQwzirJjTr0FMtNHiT3nmdVVLGd5C3YXockV6FuZsdvwtIxMekhvDipuzoQV
Ak0xgnxWgw0KeTLx60Sro2jYegGNjKtMRpKv+R8oSzNu+UpSTHYvikrqEmFRFNr/
HqNELat7TPw11b9lto6ckoYQs2fI1tl71Ip9wovZJPfjKyLeGKyT0SI1ma1XSBqn
+aYVs0//JSsltn9om5Hask5STF/o7QT8Ja5pAezh1sCtyDUSjrU=
=Oh7c
-----END PGP SIGNATURE-----
