Месяц: Апрель 2026

NGINX 1.29.8 Mainline with Brotli, TLS 1.3, OpenSSL 3.5.6, HTTP/2 and HTTP/3 for Red Hat Enterprise Linux, CentOS, Rocky, Oracle, Alma Linux EL7/EL8/EL9/EL10

nginx 1.29.8 Mainline with HTTP/3 support featuring support for Multipath TCP and upgrading the default HTTP version to HTTP/1.1 with keep-alive enabled added to EL7, EL8, EL9, EL10 repositories. brotli compression module from Google, http2, ngx cache purge and ngx http geoip2 modules added or built-in. OpenSSL built dynamically using official OpenSSL 3.5.6 with QUIC support.

nginx-1.29.8 mainline version has been released featuring max_headers configuration.

    *) Feature: the "max_headers" directive.
       Thanks to Maxim Dounin.

    *) Feature: OpenSSL 4.0 compatibility.

    *) Feature: now the "include" directive inside the "geo" block supports wildcards.

    *) Bugfix: in processing of HTTP 103 (Early Hints) responses from a proxied backend.

    *) Bugfix: the $request_port and $is_request_port variables were not available in subrequests.

openssl 3.5.6 rpms released

openssl 3.5.6 rpms released and added to all supported platforms (Alma Linux, Rocky Linux, RedHat Enterprise Linux RHEL, Oracle Linux).

Fixed incorrect failure handling in RSA KEM RSASVE encapsulation.
(CVE-2026-31790)

Fixed loss of key agreement group tuple structure when the DEFAULT keyword
is used in the server-side configuration of the key-agreement group list.
(CVE-2026-2673)

Fixed potential use-after-free in DANE client code.
(CVE-2026-28387)

Fixed NULL pointer dereference when processing a delta CRL.
(CVE-2026-28388)

Fixed possible NULL dereference when processing CMS KeyAgreeRecipientInfo.
(CVE-2026-28389)

Fixed possible NULL dereference when processing CMS
KeyTransportRecipientInfo.
(CVE-2026-28390)

Fixed heap buffer overflow in hexadecimal conversion.
(CVE-2026-31789)

OpenSSL 3.5 is a release featuring QUIC server support.

We continue to build libs with quic support as a separate non-conflicting package openssl-quic-libs, files have separate .so.81.3 suffix to avoid conflicts with the official .so.3.