-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 15 Oct 2026 01:08:48 +0000
Source: nginx
Architecture: source
Version: 1.26.3-3+deb13u10
Distribution: trixie-security
Urgency: high
Maintainer: Debian Nginx Maintainers <pkg-nginx-maintainers@alioth-lists.debian.net>
Changed-By: Jan Mojžíš <janmojzis@debian.org>
Changes:
nginx (1.26.3-3+deb13u10) trixie-security; urgency=high
.
* Backport security fixes from upstream 1.30.6:
- d/p/CVE-2026-15176.patch: reject URI to path mapping with alias
after a rewrite changed the URI.
- d/p/CVE-2026-93479.patch: protect reserved memory when evaluating
string expressions in HTTP and stream modules, adapting the fix
to the existing ABI-preserving script backport.
- d/p/CVE-2026-95101.patch: keep skipped HTTP/3 frame payload separate
from request body data, preserving nginx-dev ABI compatibility.
- d/p/CVE-2026-97629.patch: initialize all worker session ticket keys
during key rotation.
- d/p/CVE-2026-97205.patch: limit pending asynchronous operations
to prevent the request blocked counter from overflowing.
Checksums-Sha1:
cf18a0bbb64ef4c28a3c33f3f18b8677a72e755f 3610 nginx_1.26.3-3+deb13u10.dsc
4207a2844e6542292465427e25b76e24d01a85b6 1260179 nginx_1.26.3.orig.tar.gz
f6f0589db249e48dff57d7635fd8b67042530c5b 107008 nginx_1.26.3-3+deb13u10.debian.tar.xz
7dea31a1182a8f3b5e0f6b5968cc78a212285972 8479 nginx_1.26.3-3+deb13u10_source.buildinfo
Checksums-Sha256:
b1b8dc9c2fa47dcd46844f68833bc80244220a127299be36754bbb3b5d56192e 3610 nginx_1.26.3-3+deb13u10.dsc
69ee2b237744036e61d24b836668aad3040dda461fe6f570f1787eab570c75aa 1260179 nginx_1.26.3.orig.tar.gz
22b58b7a5261cd427022544814d502935aba9d84bf2ca4e03d9f7a17e678c388 107008 nginx_1.26.3-3+deb13u10.debian.tar.xz
695b44b73a5663c3f9963fbf9019f0f3740c66f06cc94b36faf3d1997f57dd89 8479 nginx_1.26.3-3+deb13u10_source.buildinfo
Files:
ad9852438cb423c702953209e41e9fa7 3610 httpd optional nginx_1.26.3-3+deb13u10.dsc
75f8fdd88469c4d31e0715e186b2f1f9 1260179 httpd optional nginx_1.26.3.orig.tar.gz
39ae9d947b8075730bfcdda090ebe065 107008 httpd optional nginx_1.26.3-3+deb13u10.debian.tar.xz
6198ad1f7788c227ca1ea57b359e5aec 8479 httpd optional nginx_1.26.3-3+deb13u10_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJJBAEBCgAzFiEE0Aiwwj2EeeRrn8uQRdpRdJaTn/kFAmrYjm8VHGphbm1vanpp
c0BkZWJpYW4ub3JnAAoJEEXaUXSWk5/5KekQAJZE3dVfyaZSaAr/iOzimRS+x8dY
qF+Da63opgeadJrL6PIQYQDk37hZsaCkoB9ivn7Kj5YiOKF+lr8m+8hdiBpa4W5K
L2ELwOj7YCLHrduYsESbEKkRNHd4zoFlDkq7lBOxiS7TPBF6fqvGxWQPg3pGgJM2
dP5TVOMZ2+xpVSnM1fBQhwURoarQogU48bVL6PKfr1j4uo/lh5OGtrL+aoTy/o2d
pBk0qD7MMMhXBJLxbIPpgX4Hypzw3VySQ+mKQGplvVaas+Lmif8gwqOkcVo0GlR9
9BrM7fGlQlk3MyRLjSdtgUxQAcYVz1/M4dFwx0Dq53pI7wvti0YOYERUlPWvp6ne
JmwiFLe38Sk6A9YCUXtdE+ukddt6uyXl9mJqXmrs8wHcHbTLvdLpeLiGW0zcH1Hh
17E2piLxgp4APFcqSCjFZ9NCYJhUV4SxwADkhZPhErBBndDyGRca4rXZ4yPqO+SL
yxuf8rzg4lHWojg1UFTCOdYmtZUyhk2AR+8w4Xj8s+gTyc9esycZeQqXSulyJU2v
hMFXogiKJtKrS4QGp2nJjl6FI0VHKCpx21FhV09nopgXaSBT5RpEwfLdvnfKQia6
8/jeObiDvgck5VsBZjwOOUXJDRXHV3KSPuqwoOVxR5nJ2j1SSAT1Nfsv2PqPWXtY
75AxLmHQkPgXfhES
=zhcH
-----END PGP SIGNATURE-----
