On Wed Aug 5, 2026 at 10:03 AM CEST, Deepak Rathore via lists.openembedded.org wrote: > From: Deepak Rathore <[email protected]> > > CVE-2026-58055 affects the nghttpx proxy when forwarding HTTP/1.1 > Upgrade requests with a Content-Length header and body. > > The default recipe does not build nghttpx. Add a conditional > CVE_STATUS entry so the CVE remains unpatched if app support is > enabled, while default builds are marked not-applicable-config. > > References: > https://nvd.nist.gov/vuln/detail/CVE-2026-58055 > > Signed-off-by: Deepak Rathore <[email protected]> > --- > meta/recipes-support/nghttp2/nghttp2_1.68.1.bb | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/meta/recipes-support/nghttp2/nghttp2_1.68.1.bb > b/meta/recipes-support/nghttp2/nghttp2_1.68.1.bb > index 71d5eef8d6..29a7d26819 100644 > --- a/meta/recipes-support/nghttp2/nghttp2_1.68.1.bb > +++ b/meta/recipes-support/nghttp2/nghttp2_1.68.1.bb > @@ -17,4 +17,6 @@ PACKAGECONFIG[manpages] = "-DENABLE_DOC=ON,-DENABLE_DOC=OFF" > > EXTRA_OECMAKE = "-DENABLE_LIB_ONLY=ON -DENABLE_PYTHON_BINDINGS=OFF" > > +CVE_STATUS[CVE-2026-58055] = "${@bb.utils.contains('EXTRA_OECMAKE', > '-DENABLE_LIB_ONLY=ON', 'not-applicable-config: nghttpx proxy is not built in > the default nghttp2 configuration', 'unpatched', d)}" > + > BBCLASSEXTEND = "native nativesdk"
Hello Deepak, I'm filling in for Yoann while he's on leave. We would prefer to avoid conditional CVE_STATUS entries whenever possible. The risk is that users who enable this feature through other means think they are protected but actually no. Conditional CVE_STATUS should really be a last resort. Could you please check if the actual fix for CVE-2026-58055 can be easily backported instead? Best regards -- Fabien Thomas Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#243293): https://lists.openembedded.org/g/openembedded-core/message/243293 Mute This Topic: https://lists.openembedded.org/mt/120607272/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
