Month: September 2026

Security update: openssl 4.0.3 RPM and DEB packages released

openssl 4.0.3 has been added to the CodeIT repository. The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

This update fixes security vulnerabilities. Upgrading is recommended.

Major changes:

  • OpenSSL 4.0.3 is a security patch release. The most severe CVE fixed in this release is High.
  • This release incorporates the following bug fixes and mitigations:
  • Fixed a bug where `EVP_DecryptFinal()` incorrectly reported a stale success on AES-SIV authentication failure.
  • Fixed a regression in base64 encoding BIO filter introduced in OpenSSL 4.0 where incomplete writes down the BIO chain may result in the loss of encoded base64 data.

Fixed vulnerabilities:

  • Fixed DTLS retransmissions of handshake messages from a stale buffer offset. (CVE-2026-84782)
  • Fixed a use-after-free in X.509 extension cache under concurrent use. (CVE-2026-84783)
  • Fixed excessive memory allocation in relative CRLDP processing. (CVE-2026-35189)
  • Fixed QUIC unvalidated amplification credit may be over-accounted. (CVE-2026-35191)
  • Fixed potential CPU DoS via O(n^2) fragment reassembly in QUIC. (CVE-2026-42772)
  • Fixed a timing side-channel in scalar multiplication for mon-NIST EC curves. (CVE-2026-54872)
  • Fixed QUIC `STREAM` fragment metadata DoS. (CVE-2026-54873)
  • Fixed non-constant-time SM2 scalar multiplication on ARM64 and RISC-V. (CVE-2026-54875)
  • Fixed out-of-bounds access after `SSL_set_SSL_CTX()` during a handshake. (CVE-2026-72897)
  • Fixed QUIC connection-level flow control was not enforced for streams. (CVE-2026-75804)
  • Fixed a NULL pointer dereference in CMP client revocation response handling. (CVE-2026-75805)
  • Fixed an unauthenticated and undersized DTLS 1.2 AEAD record causing DoS. (CVE-2026-75806)
  • Fixed a timing side-channel in SM2 signature generation. (CVE-2026-77696)
  • Fixed an unbounded `RETIRE_CONNECTION_ID` backlog in QUIC stack implementation. (CVE-2026-84784)

The libraries with QUIC support are still shipped as a separate, non-conflicting openssl-quic-libs package, with its own .so.81.4 suffix, so that they cannot clash with the official .so.X.

Security update: NGINX 1.31.6 Mainline RPM and DEB packages with HTTP/3, Brotli, TLS 1.3 and OpenSSL 4.0.2 for EL7/EL8/EL9/EL10, Ubuntu 22.04/24.04

nginx 1.31.6 Mainline with HTTP/3 support has been added to the CodeIT repository. http2 and ngx_cache_purge are built in, and OpenSSL is linked dynamically against the official OpenSSL 4.0.2 with QUIC support. The Brotli compression module from Google and ngx_http_geoip2 ship as dynamic modules, in nginx-module-brotli and nginx-module-geoip2, which the nginx rpm pulls in automatically (kept as a dependency so that existing installations upgrade without losing those directives; it will be dropped in a few months, and both modules then become truly optional). The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

This update fixes security vulnerabilities. Upgrading is recommended.

More dynamic modules are packaged alongside and are optional: nginx-module-lua with lua-resty-core and lua-resty-lrucache, nginx-module-acme for automatic ACMEv2 certificates, nginx-module-njs, nginx-module-perl, nginx-module-xslt and nginx-module-image-filter. Each one ships its own load_module line in /etc/nginx/modules-enabled, so it works the moment it is installed and nothing has to be added to nginx.conf by hand. Lua and ACME are built for EL9, EL10 and Ubuntu; EL7 gets nginx-module-geoip instead, and njs, Perl, XSLT and image-filter are RPM only.

The same release is on Docker Hub as codeitus/nginx, built on AlmaLinux 9 from these packages and published for amd64 and arm64:

  • the newest image, from whichever pool was released last: docker pull codeitus/nginx
  • the newest Mainline image: docker pull codeitus/nginx:mainline
  • this exact release: docker pull codeitus/nginx:1.31.6

HTTP/3 needs the UDP port published as well as the TCP ones: docker run -d -p 80:80 -p 443:443 -p 443:443/udp codeitus/nginx

Major changes:

  • Change: now the QUIC transport parameters extension received in an SSL connection is always ignored.
  • Bugfix: binary upgrade refused to work if the control API socket was specified and the new nginx executable was built with the ngx_http_perl_module.
  • Bugfix: an error while evaluating a predicate in a predicate location was ignored and the predicate was treated as false.
  • Bugfix: an error during a nested location lookup might be ignored if locations given by regular expressions or predicates were configured at the current level.
  • Bugfix: a segmentation fault might occur while reading configuration if the “geo” directive with the “ranges” parameter was used and the corresponding binary base file was corrupted.

Fixed vulnerabilities:

  • Security: a heap memory buffer overflow might occur in a worker process under certain configurations when using HTTP/3 with OpenSSL 3.5.0 and earlier (CVE-2026-90439).

Security update: NGINX 1.30.5 Stable RPM and DEB packages with HTTP/3, Brotli, TLS 1.3 and OpenSSL 4.0.2 for EL7/EL8/EL9/EL10, Ubuntu 22.04/24.04

nginx 1.30.5 Stable with HTTP/3 support has been added to the CodeIT repository. http2 and ngx_cache_purge are built in, and OpenSSL is linked dynamically against the official OpenSSL 4.0.2 with QUIC support. The Brotli compression module from Google and ngx_http_geoip2 ship as dynamic modules, in nginx-module-brotli and nginx-module-geoip2, which the nginx rpm pulls in automatically (kept as a dependency so that existing installations upgrade without losing those directives; it will be dropped in a few months, and both modules then become truly optional). The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

This update fixes security vulnerabilities. Upgrading is recommended.

More dynamic modules are packaged alongside and are optional: nginx-module-lua with lua-resty-core and lua-resty-lrucache, nginx-module-acme for automatic ACMEv2 certificates, nginx-module-njs, nginx-module-perl, nginx-module-xslt and nginx-module-image-filter. Each one ships its own load_module line in /etc/nginx/modules-enabled, so it works the moment it is installed and nothing has to be added to nginx.conf by hand. Lua and ACME are built for EL9, EL10 and Ubuntu; EL7 gets nginx-module-geoip instead, and njs, Perl, XSLT and image-filter are RPM only.

The same release is on Docker Hub as codeitus/nginx, built on AlmaLinux 9 from these packages and published for amd64 and arm64:

  • the newest image, from whichever pool was released last: docker pull codeitus/nginx
  • the newest Stable image: docker pull codeitus/nginx:stable
  • this exact release: docker pull codeitus/nginx:1.30.5

HTTP/3 needs the UDP port published as well as the TCP ones: docker run -d -p 80:80 -p 443:443 -p 443:443/udp codeitus/nginx

Major changes:

  • Change: now the QUIC transport parameters extension received in an SSL connection is always ignored.

Fixed vulnerabilities:

  • Security: a heap memory buffer overflow might occur in a worker process under certain configurations when using HTTP/3 with OpenSSL 3.5.0 and earlier (CVE-2026-90439).

Security update: mod_http3 v0.0.71 RPM and DEB packages released

mod_http3 v0.0.71 has been added to the CodeIT repository. The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

This update fixes security vulnerabilities. Upgrading is recommended.

Major changes:

  • A host with “h3” in Protocols now serves HTTP/3 with the certificate mod_ssl resolved for it (SSLCertificateFile and mod_md alike), the way mod_http2 rides mod_ssl. H3CertificatePath and H3CertificateKeyPath are removed; drop them from existing configurations.
  • Select the HTTP/3 certificate by SNI, so each virtual host on a shared port serves its own certificate instead of the first host’s.
  • Give every virtual host its own mod_http3 configuration (AP_MODULE_FLAG_ALWAYS_MERGE). A host without H3 directives used to share the main server’s, so per-host settings such as H3AltSvc and H3AltSvcMaxAge were silently ignored and hosts could not carry their own certificate.
  • Test suite: stop.conf now names the same pid file as httpd.conf, so “apachectl -k stop” actually stops the server on httpd builds whose default pid file lives in run/; before, every restart in the suite kept talking to the previous server.

Fixed vulnerabilities:

  • SECURITY: Load the HTTP/3 certificate and key in post_config, while httpd still runs privileged, so a root-only key no longer fails in the unprivileged child and both mod_ssl and mod_http3 read the same files.

Security update: mod_http3 v0.0.70 RPM and DEB packages released

mod_http3 v0.0.70 has been added to the CodeIT repository. The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

This update fixes security vulnerabilities. Upgrading is recommended.

Major changes:

  • Advertised a QPACK dynamic table, sized by H3QpackTableCapacity and H3QpackBlockedStreams, so request headers compress as they do over HTTP/2.
  • Made the request worker pool tunable with H3MinWorkers, H3MaxWorkers and H3MaxWorkerIdleSeconds instead of a fixed 16 to 64 threads.
  • Added H3StreamTimeout, so a client that stops reading can no longer park a request worker until it goes away.
  • Added H3MaxStreamErrors, closing a connection whose client keeps sending malformed requests instead of answering them forever.
  • Published the mod_ssl TLS environment (SSL_PROTOCOL, SSL_CIPHER and friends) for HTTP/3 requests, which mod_ssl does not manage.
  • Added H3SessionTickets, so an operator can control whether returning clients resume instead of running a full handshake.
  • Added H3SocketBufferSize, so the QUIC socket no longer drops datagrams from an undersized OS receive buffer once a connection runs at speed.
  • Enforced H3IdleTimeout in the module event loop, so a connection with no requests is closed instead of being held open by QUIC keepalive pings.
  • Rejected a malformed HTTP/3 request with a stream error instead of closing the connection, so requests in flight beside it survive.
  • Build against httpd 2.4.x as well as trunk; response buckets and the child_stopped hook are now selected at compile time.
  • Detect the stable or devel httpd at configure time and backport the graceful drain to the 2.4.x branch.

Fixed vulnerabilities:

  • SECURITY: Updated the httpd submodule so mpm_event tolerates a connection it never accepted, ending a child crash on an ErrorDocument over HTTP/3.
  • SECURITY: Applied LimitRequestFields and LimitRequestFieldSize to HTTP/3, so a client can no longer grow a stream’s memory with unbounded headers.

NGINX 1.31.5 Mainline RPM and DEB packages with HTTP/3, Brotli, TLS 1.3 and OpenSSL 4.0.2 for EL7/EL8/EL9/EL10, Ubuntu 22.04/24.04

nginx 1.31.5 Mainline with HTTP/3 support has been added to the CodeIT repository. http2 and ngx_cache_purge are built in, and OpenSSL is linked dynamically against the official OpenSSL 4.0.2 with QUIC support. The Brotli compression module from Google and ngx_http_geoip2 ship as dynamic modules, in nginx-module-brotli and nginx-module-geoip2, which the nginx rpm pulls in automatically (kept as a dependency so that existing installations upgrade without losing those directives; it will be dropped in a few months, and both modules then become truly optional). The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

More dynamic modules are packaged alongside and are optional: nginx-module-lua with lua-resty-core and lua-resty-lrucache, nginx-module-acme for automatic ACMEv2 certificates, nginx-module-njs, nginx-module-perl, nginx-module-xslt and nginx-module-image-filter. Each one ships its own load_module line in /etc/nginx/modules-enabled, so it works the moment it is installed and nothing has to be added to nginx.conf by hand. Lua and ACME are built for EL9, EL10 and Ubuntu; EL7 gets nginx-module-geoip instead, and njs, Perl, XSLT and image-filter are RPM only.

The same release is on Docker Hub as codeitus/nginx, built on AlmaLinux 9 from these packages and published for amd64 and arm64:

  • the newest image, from whichever pool was released last: docker pull codeitus/nginx
  • the newest Mainline image: docker pull codeitus/nginx:mainline
  • this exact release: docker pull codeitus/nginx:1.31.5

HTTP/3 needs the UDP port published as well as the TCP ones: docker run -d -p 80:80 -p 443:443 -p 443:443/udp codeitus/nginx

Major changes:

  • Feature: control API.
  • Feature: predicate locations.
  • Feature: the ngx_http_json_module.
  • Feature: the “client_body_early_read” directive.
  • Bugfix: use-after-free might occur in a worker process if proxying with buffering was used and an error occurred while sending the response to an HTTP/2 client.
  • Bugfix: a worker process might not exit or “accept4() failed (9: Bad file descriptor)” alerts might appear in logs if the worker process ran out of file descriptors before graceful shutdown.
  • Bugfix: requests to FastCGI and uwsgi backends were malformed if a parameter name was too long.
  • Bugfixes in HTTP/3, ngx_http_slice_module, and ngx_http_memcached_module.