From 7b45e652cc7e91fbc60cbb5f41eb4608e706bc03 Mon Sep 17 00:00:00 2001 From: Sergey Kandaurov Date: Wed, 29 Apr 2026 21:56:51 +0400 Subject: [PATCH 1/2] Upstream: reset parsing state after invalid status line Previously, it was possible to start parsing headers with a wrong parsing state after status line was not recognized, as a fallback used in the scgi and uwsgi modules. Reported by Leo Lin. CVE: CVE-2026-42946 Upstream-Status: Backport [https://github.com/nginx/nginx/commit/baef7fdac28e4e1fe26509b50b8d15603393e28e] Signed-off-by: Theo Gaige (Schneider Electric) --- src/http/modules/ngx_http_scgi_module.c | 1 + src/http/modules/ngx_http_uwsgi_module.c | 1 + 2 files changed, 2 insertions(+) diff --git a/src/http/modules/ngx_http_scgi_module.c b/src/http/modules/ngx_http_scgi_module.c index 9fc18dc..3259820 100644 --- a/src/http/modules/ngx_http_scgi_module.c +++ b/src/http/modules/ngx_http_scgi_module.c @@ -1029,6 +1029,7 @@ ngx_http_scgi_process_status_line(ngx_http_request_t *r) if (rc == NGX_ERROR) { u->process_header = ngx_http_scgi_process_header; + r->state = 0; return ngx_http_scgi_process_header(r); } diff --git a/src/http/modules/ngx_http_uwsgi_module.c b/src/http/modules/ngx_http_uwsgi_module.c index e4f721b..93bcad7 100644 --- a/src/http/modules/ngx_http_uwsgi_module.c +++ b/src/http/modules/ngx_http_uwsgi_module.c @@ -1257,6 +1257,7 @@ ngx_http_uwsgi_process_status_line(ngx_http_request_t *r) if (rc == NGX_ERROR) { u->process_header = ngx_http_uwsgi_process_header; + r->state = 0; return ngx_http_uwsgi_process_header(r); } -- 2.43.0