Рубрика: Repository

nghttp2 1.69.0 rpms released

nghttp2 1.69.0 rpms released and added to all supported platforms.

Major changes:

- src: Simplify format_hex and format_upper_hex
- build(deps): bump actions/upload-artifact from 4 to 5
- hpack: Optimize huffman decoding a bit
- Port ngtcp2_map changes
- Remove unused macros and enums
- src: Rewrite defer
- src: Remove empty parameter list from lambda
- src: Remove noexcept from ~Defer
- src: Adopt EVP_PKEY_get0_EC_KEY
- nghttpx: Avoid separate allocation for QUIC tx buffer
- src: Workaround performance regression since OpenSSL 3.0
- integration: Cope with os.ErrProcessDone
- build(deps): bump github.com/quic-go/quic-go from 0.55.0 to 0.56.0
- src: Simplify DList::remove
- src: Remove the duplicated test
- lib/CMakeLists.txt: Fix NGHTTP2_CONFIG_INSTALL_DIR path
- nghttpx: Ensure resetting downstream h2 stream
- build(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0
- Gha ubuntu arm
- src: Generate lowcase_tbl
- examples: Remove redundant cast in lowcase
- build(deps): bump actions/checkout from 5 to 6
- build(deps): bump github.com/quic-go/quic-go from 0.56.0 to 0.57.0
- Bump ngtcp2 and its dependencies
- build(deps): bump github.com/quic-go/quic-go from 0.57.0 to 0.57.1
- Fix union usage in nghttp2_data_provider_wrap
- Remove union from WorkerID
- Cancel sending RST_STREAM if stream is not found
- nghttpx: Remove stream_closed_ from Http2DownstreamConnection
- Remove extraneous semicolon
- src: Rewrite Address with std::variant
- build(deps): bump actions/upload-artifact from 5 to 6
- build(deps): bump actions/cache from 4 to 5
- build(deps): bump golang.org/x/net from 0.47.0 to 0.48.0
- build(deps): bump github.com/quic-go/quic-go from 0.57.1 to 0.58.0
- Rewrite Dockerfile with heredoc syntax
- src: Avoid strict aliasing violation
- Introduce nghttp2_strlen_lit
- build(deps): bump github.com/quic-go/quic-go from 0.58.0 to 0.59.0
- Increase default glitch rate limit to 10x
- build(deps): bump golang.org/x/net from 0.48.0 to 0.49.0
- GHA: Fix main branch in cancel-in-progress by
- Remove glitch detection for ignored DATA frame by
- Revert "src: Avoid strict aliasing violation" by
- build(deps): bump golang.org/x/net from 0.49.0 to 0.50.0
- Check nghttp2_is_fatal first
- altsvc: Avoid pointer arithmetic against NULL
- Ensure typedefs use named structs and unions
- Revert "Ensure typedefs use named structs and unions"
- build(deps): bump actions/upload-artifact from 6 to 7
- build(deps): bump golang.org/x/net from 0.50.0 to 0.51.0
- h2load: Fix bug that h2load does not stop early with -D option
- h2load: Add median, p95, and p99 metrics
- h2load: Refactor SDStat output
- h2load: Refactor metrics manual
- h2load: Add some QUIC metrics
- h2load: Plot histogram
- Amend #2619
- build(deps): bump docker/build-push-action from 6 to 7
- build(deps): bump docker/setup-buildx-action from 3 to 4
- h2load: Show certificate type and negotiated group
- nghttpd, nghttpx: Accept at most 10 connections per loop
- h2load: Support TLS resumption
- src: Avoid consteval for now
- nghttpx: Accept pending connections until it returns error
- h2load: Make the names of perf metric short and concise
- nghttpx: Rework close-wait packet generation for h3
- nghttpx: Add extra validation for non-regular path for HTTP/1.1
- nghttpx: More strict validation for h1 host
- h2load: Output the measurement results in JSON
- Src pass by value
- src: Refine Defer
- h2load: Print integral samples as integral
- h2load: Refactor with std::span
- nghttpd: Refactor with std::span
- build(deps): bump golang.org/x/net from 0.51.0 to 0.52.0
- nghttp: Refactor with std::span
- h2load: Use span for reading
- nghttp: Move span creation out of loop
- Add missing iframe state validation
- src: Refactor Buffer::write with std::span
- src: Adopt override keyword
- src: Simplify as_uint8_span with auto
- src: Review the use of iterator and range concepts
- nghttpx: Use std::span for upstream interface
- nghttpx: Modernize downstream connection with std::span
- nghttpx: Deal with partial write in API downstream connection
- build(deps): bump microsoft/setup-msbuild from 2 to 3
- nghttpx: Adopt std::span for LiveCheck read path
- Nghttpx connection write span
- Nghttpx connection read span
- nghttpx: Refactor QUIC utils with std::span
- nghttpx: Choose the sensible value for TCP_DEFER_ACCEPT
- src: Refactor riovec with std::span
- nghttpx: Simplify HTTP/2 writer
- h2load: Add --h3 option
- nghttpx: Format doc
- nghttpx: Deal with ECONNRESET for IPC socket on worker process side
- third-party: Bump neverbleed
- doc: Update h2load howto
- Bump llhttp to v9.3.1
- GHA: Add macos-26 build and remove macos-14 build
- h2load: Deal with h3 unidirectional stream closure
- src: Refine allocator with the modern memory construct
- Modernize BlockAllocator and its utility functions
- nghttpx: Rewrite LOG macros with std::source_location
- nghttpx: Amend #2671 to fix double logging
- nghttpx: Call Log ctor directly
- nghttpx: Rename LOG_ENABLED to log_enabled
- src: Remove enclosing anonymous namespace from constexpr variables
- src: Add static constexpr to ngtcp2 and nghttp3 callbacks
- OpenSSL 4.0.0 beta1 fix by @xl32
- build(deps): bump actions/github-script from 8 to 9
- build(deps): bump golang.org/x/net from 0.52.0 to 0.53.0
- GHA: Bump openssl to v4.0.0
- Optimize the decoded length estimation for Huffman encoded string
- Make header related errors stream error with glitch rate limit guard
- Bump ngtcp2 to v1.22.1
- Nghttpx ech
- nghttpx: Log the number of loaded ECH configuration in NOTICE level
- Bump aws-lc
- @trukna made their first contribution
- @cbarrick made their first contribution
- @xl32 made their first contribution

NGINX 1.30.0 Stable with ECH, Early Hints, HTTP/2 to backend, Brotli, TLS 1.3, OpenSSL 4.0.0, HTTP/2 and HTTP/3 for Red Hat Enterprise Linux, CentOS, Rocky, Oracle, Alma Linux EL7/EL8/EL9/EL10

nginx 1.30.0 stable version has been released, incorporating new features and bug fixes from the 1.29.x mainline branch — including Early Hints, HTTP/2 to backend and Encrypted ClientHello, sticky sessions support for upstreams, Multipath TCP support, the default proxy HTTP version set to HTTP/1.1 with keep-alive enabled, and more.

Nginx 1.30.0 Stable with HTTP/3 support added to EL7, EL8, EL9 and EL10 repositories.

Brotli compression module from Google, http2, ngx_cache_purge and ngx_http_geoip2 modules are built in. OpenSSL is built dynamically using official OpenSSL 4.0.0 with QUIC support.

Major changes:

— 1.30.x stable branch.

openssl 4.0.0 rpms released

openssl 4.0.0 rpms released and added to all supported platforms (Alma Linux, Rocky Linux, Red Hat Enterprise Linux RHEL, Oracle Linux).

OpenSSL 4.0.0 is a feature release adding significant new functionality to OpenSSL. This release incorporates the following potentially significant or incompatible changes:

— Removed extra leading ’00:’ when printing key data such as an RSA modulus in hexadecimal format where the first (most significant) byte is >= 0x80. — Standardized the width of hexadecimal dumps to 24 bytes for signatures (to stay within the 80 characters limit) and 16 bytes for everything else. — Lower bounds checks are now enforced when using `PKCS5_PBKDF2_HMAC` API with FIPS provider. — Added AKID verification checks when `X509_V_FLAG_X509_STRICT` is set. — Augmented CRL verification process with several additional checks. — `libcrypto` no longer cleans up globally allocated data via `atexit()`. — `BIO_snprintf()` now uses `snprintf()` provided by libc instead of internal implementation. — `OPENSSL_cleanup()` now runs in a global destructor, or not at all by default. — `ASN1_STRING` has been made opaque. — Signatures of numerous API functions, including those that are related to X509 processing, are changed to include `const` qualifiers for argument and return types, where suitable. — Deprecated `X509_cmp_time()`, `X509_cmp_current_time()`, and `X509_cmp_timeframe()` in favor of `X509_check_certificate_times()`. — Removed support for the SSLv2 Client Hello. — Removed support for SSLv3. SSLv3 has been deprecated since 2015, and OpenSSL had it disabled by default since version 1.1.0 (2016). — Removed support for engines. The `no-engine` build option and the `OPENSSL_NO_ENGINE` macro are always present. — Support of deprecated elliptic curves in TLS according to RFC 8422 was disabled at compile-time by default. To enable it, use the `enable-tls-deprecated-ec` configuration option. — Support of explicit EC curves was disabled at compile-time by default. To enable it, use the `enable-ec_explicit_curves` configuration option. — Removed `c_rehash` script tool. Use `openssl rehash` instead. — Removed the deprecated `msie-hack` option from the `openssl ca` command. — Removed `BIO_f_reliable()` implementation without replacement. It was broken since 3.0 release without any complaints. — Removed deprecated support for custom `EVP_CIPHER`, `EVP_MD`, `EVP_PKEY`, and `EVP_PKEY_ASN1` methods. — Removed deprecated fixed SSL/TLS version method functions. — Removed deprecated functions `ERR_get_state()`, `ERR_remove_state()` and `ERR_remove_thread_state()`. The `ERR_STATE` object is now always opaque. — Dropped `darwin-i386{,-cc}` and `darwin-ppc{,64}{,-cc}` targets from Configurations. This release adds the following new features: — Support for Encrypted Client Hello (ECH, RFC 9849). See `doc/designs/ech-api.md` for details. — Support for RFC 8998, signature algorithm `sm2sig_sm3`, key exchange group `curveSM2`, and tls-hybrid-sm2-mlkem post-quantum group `curveSM2MLKEM768`. — cSHAKE function support as per SP 800-185. — «ML-DSA-MU» digest algorithm support. — Support for SNMP KDF and SRTP KDF. — FIPS self tests can now be deferred and run as needed when installing the FIPS module with the `-defer_tests` option of the `openssl fipsinstall` command. — Support for using either static or dynamic VC runtime linkage on Windows. — Support for negotiated FFDHE key exchange in TLS 1.2 in accordance with RFC 7919. RFC 8422: RFC 9849: RFC 8998: SP 800-185: RFC 7919:

.so Suffix changed from 81.3 to 81.4 (/usr/lib64/libcrypto.so.81.4.0.0, /usr/lib64/libcrypto.so.81.4 -> libcrypto.so.81.4.0.0, /usr/lib64/libssl.so.81.4.0.0, /usr/lib64/libssl.so.81.4 -> libssl.so.81.4.0.0).

We continue to build libs with QUIC support as a separate non-conflicting package openssl-quic-libs, with separate .so.81.4 suffixing to avoid conflicts with the official .so.X.

Encrypted Client Hello Comes to NGINX

We are rebuilding all the packages against openssl 4.0.0 that was released today.

Our nghttp2 (as builds test tool and httpd prerequisite) pull request was accepted some days ago, so it is no more a blocker.

Nginx 1.28.x was a blocker, but team finally released nginx 1.30 with ECH support and now all the stack builds with openssl 4.

Small exception is httpd that requires some patches to fix openssl 4 build (as api changed), it will be published as openssl4.patch in src.rpm separately.

NGINX 1.29.8 Mainline with Brotli, TLS 1.3, OpenSSL 3.5.6, HTTP/2 and HTTP/3 for Red Hat Enterprise Linux, CentOS, Rocky, Oracle, Alma Linux EL7/EL8/EL9/EL10

nginx 1.29.8 Mainline with HTTP/3 support featuring support for Multipath TCP and upgrading the default HTTP version to HTTP/1.1 with keep-alive enabled added to EL7, EL8, EL9, EL10 repositories. brotli compression module from Google, http2, ngx cache purge and ngx http geoip2 modules added or built-in. OpenSSL built dynamically using official OpenSSL 3.5.6 with QUIC support.

nginx-1.29.8 mainline version has been released featuring max_headers configuration.

    *) Feature: the "max_headers" directive.
       Thanks to Maxim Dounin.

    *) Feature: OpenSSL 4.0 compatibility.

    *) Feature: now the "include" directive inside the "geo" block supports wildcards.

    *) Bugfix: in processing of HTTP 103 (Early Hints) responses from a proxied backend.

    *) Bugfix: the $request_port and $is_request_port variables were not available in subrequests.

openssl 3.5.6 rpms released

openssl 3.5.6 rpms released and added to all supported platforms (Alma Linux, Rocky Linux, RedHat Enterprise Linux RHEL, Oracle Linux).

Fixed incorrect failure handling in RSA KEM RSASVE encapsulation.
(CVE-2026-31790)

Fixed loss of key agreement group tuple structure when the DEFAULT keyword
is used in the server-side configuration of the key-agreement group list.
(CVE-2026-2673)

Fixed potential use-after-free in DANE client code.
(CVE-2026-28387)

Fixed NULL pointer dereference when processing a delta CRL.
(CVE-2026-28388)

Fixed possible NULL dereference when processing CMS KeyAgreeRecipientInfo.
(CVE-2026-28389)

Fixed possible NULL dereference when processing CMS
KeyTransportRecipientInfo.
(CVE-2026-28390)

Fixed heap buffer overflow in hexadecimal conversion.
(CVE-2026-31789)

OpenSSL 3.5 is a release featuring QUIC server support.

We continue to build libs with quic support as a separate non-conflicting package openssl-quic-libs, files have separate .so.81.3 suffix to avoid conflicts with the official .so.3.

ngtcp2 1.22.0 rpms released

ngtcp2 1.22.0 rpms released and added to all supported platforms.

As soon as ngtcp2 now requires C++23 compiler, we moved to build it with GCC 15.2.0. CentOS 7 build now requires GCC 15 runtime, as soon as we build all CentOS 7 toolset ourselves.

ngtcp2 libraries stack built with OpenSSL 3.5.5. quic client name is osslclient.

NGINX 1.29.7 Mainline with Brotli, TLS 1.3, OpenSSL 3.5.5, HTTP/2 and HTTP/3 for Red Hat Enterprise Linux, CentOS, Rocky, Oracle, Alma Linux EL7/EL8/EL9/EL10

nginx 1.29.7 Mainline with HTTP/3 support featuring support for Multipath TCP and upgrading the default HTTP version to HTTP/1.1 with keep-alive enabled added to EL7, EL8, EL9, EL10 repositories. brotli compression module from Google, http2, ngx cache purge and ngx http geoip2 modules added or built-in. OpenSSL built dynamically using official OpenSSL 3.5.1 with QUIC support.

nginx-1.29.7 mainline version has been released, introducing two significant updates: support for Multipath TCP and upgrading the default HTTP version to HTTP/1.1 with keep-alive enabled. This release also includes a security fix for the buffer overflow vulnerability in the ngx_http_dav_module (CVE-2026-27654), security fixes for the buffer overflow vulnerabilities in the ngx_http_mp4_module (CVE-2026-27784, CVE-2026-32647), security fixes for the mail session authentication vulnerabilities (CVE-2026-27651, CVE-2026-28753), and a security fix for the OCSP result bypass vulnerability in stream (CVE-2026-28755).

    *) Security: a buffer overflow might occur while handling a COPY or MOVE request in a location with "alias", allowing an attacker to modify the source or destination path outside of the document root (CVE-2026-27654).
       Thanks to Calif.io in collaboration with Claude and Anthropic Research.

    *) Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module on 32-bit platforms might cause a worker process crash, or might have potential other impact (CVE-2026-27784).Thanks to Prabhav Srinath (sprabhav7).

    *) Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module might cause a worker process crash, or might have potential other impact (CVE-2026-32647). Thanks to Xint Code and Pavel Kohout (Aisle Research).

    *) Security: a segmentation fault might occur in a worker process if the CRAM-MD5 or APOP authentication methods were used and authentication retry was enabled (CVE-2026-27651). Thanks to Arkadi Vainbrand.

    *) Security: an attacker might use PTR DNS records to inject data in auth_http requests, as well as in the XCLIENT command in the backend SMTP connection (CVE-2026-28753). Thanks to Asim Viladi Oglu Manizada, Colin Warren, Xiao Liu (Yunnan University), Yuan Tan (UC Riverside), and Bird Liu (Lanzhou University).

    *) Security: SSL handshake might succeed despite OCSP rejecting a client certificate in the stream module (CVE-2026-28755). Thanks to Mufeed VH of Winfunc Research.

    *) Feature: the "multipath" parameter of the "listen" directive.

    *) Feature: the "local" parameter of the "keepalive" directive in the "upstream" block.

    *) Change: now the "keepalive" directive in the "upstream" block is enabled by default.

    *) Change: now ngx_http_proxy_module supports keepalive by default; the default value for "proxy_http_version" is "1.1"; the "Connection" proxy header is not sent by default anymore.

    *) Bugfix: an invalid HTTP/2 request might be sent after switching to the next upstream if buffered body was used in the ngx_http_grpc_module.

NGINX 1.28.3 Stable with Brotli, TLS 1.3, OpenSSL 3.5.5, HTTP/2 and HTTP/3 for Red Hat Enterprise Linux, CentOS, Rocky, Oracle, Alma Linux EL7/EL8/EL9/EL10

nginx 1.28.4 Stable with HTTP/3 support added to EL7, EL8, EL9, EL10 repositories. brotli compression module from Google, http2, ngx cache purge and ngx http geoip2 modules added or built-in. OpenSSL built dynamically using official OpenSSL 3.5.5 with QUIC support.

nginx-1.28.3 stable version release includes a security fix for the buffer overflow vulnerability in the ngx_http_dav_module (CVE-2026-27654), security fixes for the buffer overflow vulnerabilities in the ngx_http_mp4_module (CVE-2026-27784, CVE-2026-32647), security fixes for the mail session authentication vulnerabilities (CVE-2026-27651, CVE-2026-28753), and a security fix for the OCSP result bypass vulnerability in stream (CVE-2026-28755).