Baoyuantop commented on issue #13631: URL: https://github.com/apache/apisix/issues/13631#issuecomment-6411232730
Closing this out: CVE-2026-49975 (“HTTP/2 Bomb”) is fixed in nginx 1.29.8+ via the `max_headers` directive. [#14041](https://github.com/apache/apisix/pull/14041) has been merged and bumps `APISIX_RUNTIME` to **1.4.0**, which ships OpenResty **1.31.1.1** (nginx **1.31.1**), so master is no longer on the vulnerable nginx core. Released APISIX packages/images still need a release that picks up runtime 1.4.0; until then the mitigations noted earlier (disable HTTP/2 if feasible, terminate HTTP/2 in front, cap worker memory) still apply to those builds. If you hit this on a build that already includes apisix-runtime 1.4.0+, please reopen with version details (`apisix version` / `openresty -V`). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
