Tag: http3

Security update: NGINX 1.31.6 Mainline RPM and DEB packages with HTTP/3, Brotli, TLS 1.3 and OpenSSL 4.0.2 for EL7/EL8/EL9/EL10, Ubuntu 22.04/24.04

nginx 1.31.6 Mainline with HTTP/3 support has been added to the CodeIT repository. http2 and ngx_cache_purge are built in, and OpenSSL is linked dynamically against the official OpenSSL 4.0.2 with QUIC support. The Brotli compression module from Google and ngx_http_geoip2 ship as dynamic modules, in nginx-module-brotli and nginx-module-geoip2, which the nginx rpm pulls in automatically (kept as a dependency so that existing installations upgrade without losing those directives; it will be dropped in a few months, and both modules then become truly optional). The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

This update fixes security vulnerabilities. Upgrading is recommended.

More dynamic modules are packaged alongside and are optional: nginx-module-lua with lua-resty-core and lua-resty-lrucache, nginx-module-acme for automatic ACMEv2 certificates, nginx-module-njs, nginx-module-perl, nginx-module-xslt and nginx-module-image-filter. Each one ships its own load_module line in /etc/nginx/modules-enabled, so it works the moment it is installed and nothing has to be added to nginx.conf by hand. Lua and ACME are built for EL9, EL10 and Ubuntu; EL7 gets nginx-module-geoip instead, and njs, Perl, XSLT and image-filter are RPM only.

The same release is on Docker Hub as codeitus/nginx, built on AlmaLinux 9 from these packages and published for amd64 and arm64:

  • the newest image, from whichever pool was released last: docker pull codeitus/nginx
  • the newest Mainline image: docker pull codeitus/nginx:mainline
  • this exact release: docker pull codeitus/nginx:1.31.6

HTTP/3 needs the UDP port published as well as the TCP ones: docker run -d -p 80:80 -p 443:443 -p 443:443/udp codeitus/nginx

Major changes:

  • Change: now the QUIC transport parameters extension received in an SSL connection is always ignored.
  • Bugfix: binary upgrade refused to work if the control API socket was specified and the new nginx executable was built with the ngx_http_perl_module.
  • Bugfix: an error while evaluating a predicate in a predicate location was ignored and the predicate was treated as false.
  • Bugfix: an error during a nested location lookup might be ignored if locations given by regular expressions or predicates were configured at the current level.
  • Bugfix: a segmentation fault might occur while reading configuration if the “geo” directive with the “ranges” parameter was used and the corresponding binary base file was corrupted.

Fixed vulnerabilities:

  • Security: a heap memory buffer overflow might occur in a worker process under certain configurations when using HTTP/3 with OpenSSL 3.5.0 and earlier (CVE-2026-90439).

Security update: NGINX 1.30.5 Stable RPM and DEB packages with HTTP/3, Brotli, TLS 1.3 and OpenSSL 4.0.2 for EL7/EL8/EL9/EL10, Ubuntu 22.04/24.04

nginx 1.30.5 Stable with HTTP/3 support has been added to the CodeIT repository. http2 and ngx_cache_purge are built in, and OpenSSL is linked dynamically against the official OpenSSL 4.0.2 with QUIC support. The Brotli compression module from Google and ngx_http_geoip2 ship as dynamic modules, in nginx-module-brotli and nginx-module-geoip2, which the nginx rpm pulls in automatically (kept as a dependency so that existing installations upgrade without losing those directives; it will be dropped in a few months, and both modules then become truly optional). The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

This update fixes security vulnerabilities. Upgrading is recommended.

More dynamic modules are packaged alongside and are optional: nginx-module-lua with lua-resty-core and lua-resty-lrucache, nginx-module-acme for automatic ACMEv2 certificates, nginx-module-njs, nginx-module-perl, nginx-module-xslt and nginx-module-image-filter. Each one ships its own load_module line in /etc/nginx/modules-enabled, so it works the moment it is installed and nothing has to be added to nginx.conf by hand. Lua and ACME are built for EL9, EL10 and Ubuntu; EL7 gets nginx-module-geoip instead, and njs, Perl, XSLT and image-filter are RPM only.

The same release is on Docker Hub as codeitus/nginx, built on AlmaLinux 9 from these packages and published for amd64 and arm64:

  • the newest image, from whichever pool was released last: docker pull codeitus/nginx
  • the newest Stable image: docker pull codeitus/nginx:stable
  • this exact release: docker pull codeitus/nginx:1.30.5

HTTP/3 needs the UDP port published as well as the TCP ones: docker run -d -p 80:80 -p 443:443 -p 443:443/udp codeitus/nginx

Major changes:

  • Change: now the QUIC transport parameters extension received in an SSL connection is always ignored.

Fixed vulnerabilities:

  • Security: a heap memory buffer overflow might occur in a worker process under certain configurations when using HTTP/3 with OpenSSL 3.5.0 and earlier (CVE-2026-90439).

Security update: mod_http3 v0.0.71 RPM and DEB packages released

mod_http3 v0.0.71 has been added to the CodeIT repository. The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

This update fixes security vulnerabilities. Upgrading is recommended.

Major changes:

  • A host with “h3” in Protocols now serves HTTP/3 with the certificate mod_ssl resolved for it (SSLCertificateFile and mod_md alike), the way mod_http2 rides mod_ssl. H3CertificatePath and H3CertificateKeyPath are removed; drop them from existing configurations.
  • Select the HTTP/3 certificate by SNI, so each virtual host on a shared port serves its own certificate instead of the first host’s.
  • Give every virtual host its own mod_http3 configuration (AP_MODULE_FLAG_ALWAYS_MERGE). A host without H3 directives used to share the main server’s, so per-host settings such as H3AltSvc and H3AltSvcMaxAge were silently ignored and hosts could not carry their own certificate.
  • Test suite: stop.conf now names the same pid file as httpd.conf, so “apachectl -k stop” actually stops the server on httpd builds whose default pid file lives in run/; before, every restart in the suite kept talking to the previous server.

Fixed vulnerabilities:

  • SECURITY: Load the HTTP/3 certificate and key in post_config, while httpd still runs privileged, so a root-only key no longer fails in the unprivileged child and both mod_ssl and mod_http3 read the same files.

Security update: mod_http3 v0.0.70 RPM and DEB packages released

mod_http3 v0.0.70 has been added to the CodeIT repository. The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

This update fixes security vulnerabilities. Upgrading is recommended.

Major changes:

  • Advertised a QPACK dynamic table, sized by H3QpackTableCapacity and H3QpackBlockedStreams, so request headers compress as they do over HTTP/2.
  • Made the request worker pool tunable with H3MinWorkers, H3MaxWorkers and H3MaxWorkerIdleSeconds instead of a fixed 16 to 64 threads.
  • Added H3StreamTimeout, so a client that stops reading can no longer park a request worker until it goes away.
  • Added H3MaxStreamErrors, closing a connection whose client keeps sending malformed requests instead of answering them forever.
  • Published the mod_ssl TLS environment (SSL_PROTOCOL, SSL_CIPHER and friends) for HTTP/3 requests, which mod_ssl does not manage.
  • Added H3SessionTickets, so an operator can control whether returning clients resume instead of running a full handshake.
  • Added H3SocketBufferSize, so the QUIC socket no longer drops datagrams from an undersized OS receive buffer once a connection runs at speed.
  • Enforced H3IdleTimeout in the module event loop, so a connection with no requests is closed instead of being held open by QUIC keepalive pings.
  • Rejected a malformed HTTP/3 request with a stream error instead of closing the connection, so requests in flight beside it survive.
  • Build against httpd 2.4.x as well as trunk; response buckets and the child_stopped hook are now selected at compile time.
  • Detect the stable or devel httpd at configure time and backport the graceful drain to the 2.4.x branch.

Fixed vulnerabilities:

  • SECURITY: Updated the httpd submodule so mpm_event tolerates a connection it never accepted, ending a child crash on an ErrorDocument over HTTP/3.
  • SECURITY: Applied LimitRequestFields and LimitRequestFieldSize to HTTP/3, so a client can no longer grow a stream’s memory with unbounded headers.

NGINX 1.31.5 Mainline RPM and DEB packages with HTTP/3, Brotli, TLS 1.3 and OpenSSL 4.0.2 for EL7/EL8/EL9/EL10, Ubuntu 22.04/24.04

nginx 1.31.5 Mainline with HTTP/3 support has been added to the CodeIT repository. http2 and ngx_cache_purge are built in, and OpenSSL is linked dynamically against the official OpenSSL 4.0.2 with QUIC support. The Brotli compression module from Google and ngx_http_geoip2 ship as dynamic modules, in nginx-module-brotli and nginx-module-geoip2, which the nginx rpm pulls in automatically (kept as a dependency so that existing installations upgrade without losing those directives; it will be dropped in a few months, and both modules then become truly optional). The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

More dynamic modules are packaged alongside and are optional: nginx-module-lua with lua-resty-core and lua-resty-lrucache, nginx-module-acme for automatic ACMEv2 certificates, nginx-module-njs, nginx-module-perl, nginx-module-xslt and nginx-module-image-filter. Each one ships its own load_module line in /etc/nginx/modules-enabled, so it works the moment it is installed and nothing has to be added to nginx.conf by hand. Lua and ACME are built for EL9, EL10 and Ubuntu; EL7 gets nginx-module-geoip instead, and njs, Perl, XSLT and image-filter are RPM only.

The same release is on Docker Hub as codeitus/nginx, built on AlmaLinux 9 from these packages and published for amd64 and arm64:

  • the newest image, from whichever pool was released last: docker pull codeitus/nginx
  • the newest Mainline image: docker pull codeitus/nginx:mainline
  • this exact release: docker pull codeitus/nginx:1.31.5

HTTP/3 needs the UDP port published as well as the TCP ones: docker run -d -p 80:80 -p 443:443 -p 443:443/udp codeitus/nginx

Major changes:

  • Feature: control API.
  • Feature: predicate locations.
  • Feature: the ngx_http_json_module.
  • Feature: the “client_body_early_read” directive.
  • Bugfix: use-after-free might occur in a worker process if proxying with buffering was used and an error occurred while sending the response to an HTTP/2 client.
  • Bugfix: a worker process might not exit or “accept4() failed (9: Bad file descriptor)” alerts might appear in logs if the worker process ran out of file descriptors before graceful shutdown.
  • Bugfix: requests to FastCGI and uwsgi backends were malformed if a parameter name was too long.
  • Bugfixes in HTTP/3, ngx_http_slice_module, and ngx_http_memcached_module.

Security update: openssl 4.0.2 RPM and DEB packages released

openssl 4.0.2 has been added to the CodeIT repository. The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

RedHat FIPS patches removed as per upstream, we now have stock FIPS from OpenSSL to avoid broken web servers.

This update fixes security vulnerabilities. Upgrading is recommended.

Major changes:

  • OpenSSL 4.0.2 is a security patch release. The most severe CVE fixed in this release is Moderate.
  • This release incorporates the following bug fixes and mitigations:
  • Fixed checking of authentication tags for empty ciphertexts for AEAD ciphers in CCM cipher mode.

Fixed vulnerabilities:

  • Fixed QUIC server being able to trigger double free when processing `INITIAL` packet. (CVE-2026-18798)
  • Fixed heap buffer overflow in CMS key unwrapping. (CVE-2026-63072)
  • Fixed invalid pointer dereference in CMP server via crafted `protectionAlg`. (CVE-2026-63076)
  • Fixed unbounded memory growth in QUIC server incoming channel queue. (CVE-2026-14456)
  • Fixed RPK server signature algorithm selection being able to dereference a missing certificate. (CVE-2026-14457)
  • Fixed excessive memory use buffering DTLS records for a future epoch. (CVE-2026-54874)
  • Fixed client-side memory leak in OCSP response checking. (CVE-2026-54876)
  • Fixed untrusted Sender DN being used as a format string in CMP response validation. (CVE-2026-63073)
  • Fixed CMP indefinite cache growth of `extraCerts`. (CVE-2026-63074)
  • Fixed QUIC ACK-only packet retention being able to cause memory exhaustion. (CVE-2026-63075)
  • Fixed possibility of AEAD forgeries with empty ciphertext when using `EVP_Cipher()`. (CVE-2026-75803)

The libraries with QUIC support are still shipped as a separate, non-conflicting openssl-quic-libs package, with its own .so.81.4 suffix, so that they cannot clash with the official .so.X.

NGINX 1.31.4 Mainline RPM and DEB packages with HTTP/3, Brotli, TLS 1.3 and OpenSSL 4.0.1 for EL7/EL8/EL9/EL10, Ubuntu 22.04/24.04

nginx 1.31.4 Mainline with HTTP/3 support has been added to the CodeIT repository. http2 and ngx_cache_purge are built in, and OpenSSL is linked dynamically against the official OpenSSL 4.0.1 with QUIC support. The Brotli compression module from Google and ngx_http_geoip2 ship as dynamic modules, in nginx-module-brotli and nginx-module-geoip2, which the nginx rpm pulls in automatically (kept as a dependency so that existing installations upgrade without losing those directives; it will be dropped in a few months, and both modules then become truly optional). The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 7, 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

More dynamic modules are packaged alongside and are optional: nginx-module-lua with lua-resty-core and lua-resty-lrucache, nginx-module-acme for automatic ACMEv2 certificates, nginx-module-njs, nginx-module-perl, nginx-module-xslt and nginx-module-image-filter. Each one ships its own load_module line in /etc/nginx/modules-enabled, so it works the moment it is installed and nothing has to be added to nginx.conf by hand. Lua and ACME are built for EL9, EL10 and Ubuntu; EL7 gets nginx-module-geoip instead, and njs, Perl, XSLT and image-filter are RPM only.

The same release is on Docker Hub as codeitus/nginx, built on AlmaLinux 9 from these packages and published for amd64 and arm64:

  • the newest image, from whichever pool was released last: docker pull codeitus/nginx
  • the newest Mainline image: docker pull codeitus/nginx:mainline
  • this exact release: docker pull codeitus/nginx:1.31.4

HTTP/3 needs the UDP port published as well as the TCP ones: docker run -d -p 80:80 -p 443:443 -p 443:443/udp codeitus/nginx

Major changes:

  • Feature: the “proxy_protocol” directive in the stream and mail modules now supports the PROXY protocol version 2.
  • Change: now HTTP/2 and gRPC requests to backends are always sent with the “:authority” pseudo-header, and HTTP/1.1 requests – with the “Host” header.
  • Bugfix: a segmentation fault might occur in a worker process if the “select” method was used.
  • Bugfix: incomplete gRPC responses with a non-zero “Content-Length” header line are now treated as malformed.
  • Bugfix: in binary compatibility with third-party modules using script codes; the bug had appeared in 1.31.3.
  • Bugfix: in the ngx_http_perl_module.
  • Bugfixes in HTTP/2, HTTP/3, ngx_http_image_filter_module, and ngx_http_grpc_module.

sshoq 0.5.0 RPM and DEB packages released

sshoq 0.5.0 has been added to the CodeIT repository. The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 8, 9 and 10, and for Ubuntu 22.04 and 24.04.

Major changes:

  • OpenSSH-style path quoting and escaping in the SFTP client
  • feat: show transfer progress (percentage and speed) for sftp/scp oper…
  • feat: cancel sftp/scp transfers with Ctrl+C
  • feat: OpenSSH-style cd shortcuts in the SFTP client
  • feat: support wildcards for put/get source files in the SFTP client
  • perf: pipeline SFTP transfers to remove per-chunk round-trip bottleneck
  • fix: include filepath in all sftp client/server error messages
  • sftp: follow symlinks on the client by default, add -no-follow-symlinks
  • perf: replace JSON sftp protocol with a compact binary format
  • Increase transfer window
  • sftp: continue get -r past permission-denied files

sshoq 0.4.0 rpms released

sshoq 0.4.0 rpms released and added to all supported platforms.

Major changes since 0.3.0:

– fix(auth): return error on key load failure instead of panicking on nil key – fix: print error to stderr when sshoq-server fails to start – Feature/default ssh keys from dot ssh – wildcard for get -r – SFTP client: Add readline-style arrow keys support – feat: add -scp mode for non-interactive file transfer – feat: support multiple simultaneous local and remote port forwardings – fix: correct the port forwarding syntax error message – feat: add tab completion for file paths in the SFTP client – sftp client: add wildcard/glob support to ls – sftp client: add wildcard/glob support to get – fix: reassemble chunked SFTP messages across channel data messages – fix: linux-arm64 release build and drop windows client-only pipeline

sshoq 0.3.0 rpms released

sshoq 0.3.0 rpms released and added to all supported platforms.

Major changes:

– SFTP is enabled on the server by default, but can be disabled with `sshoq-server -disable-sftp` On the client, do `sshoq -sftp user@host` to enter sftp shell. Normal commands like `ls`, `cd`, `put`, `get` etc. are supported including recursive mode (e.g. `get -r path`). Tab completion and wildcards are not implemented yet for SFTP so exact paths must be used. – fix: two small problem by @nameearly – Add sftp support by @h4sh5 – Harden SFTP server with user-scoped permission checks and fd-relative no-follow filesystem ops by @h4sh5 with @Copilot – Reject disabled SFTP channels with SSH channel-open failure by @h4sh5 with @Copilot – Add recursive directory transfers to SFTP mode by @h4sh5 with @Copilot – Harden SFTP stat: enforce ancestor-execute permissions via Fstatat by @h4sh5 with @Copilot – SFTP handler: drop privileges to the logged-in user by @h4sh5 with @Copilot in – add ownership details (user and group) to sftp ls command by @h4sh5 – allow running integration tests locally by @h4sh5 – @nameearly made their first contribution – @h4sh5 with @Copilot made their first contribution