Public bug reported: Our servers pulled nginx 1.24.0-2ubuntu7.16 via unattended-upgrades, causing outages due to regex captures not being processed correctly.
Package: nginx Version: 1.24.0-2ubuntu7.16 Series: noble Regression: yes — introduced by the CVE-2026-42533 backport in 1.24.0-2ubuntu7.16 (after 1.24.0-2ubuntu7.14/7.15) debian/patches/CVE-2026-42533.patch breaks numbered regex captures ($1, $2, …) in HTTP script evaluation. Capture length is still taken from the capture group, but the source pointer is the start of the subject string (r->captures_data) instead of the capture offset (r->captures_data + cap[n]). Any capture that does not start at offset 0 is wrong. Typical result: the leading / of the URI plus a truncated prefix, often later percent- encoded as %2F…. Here's a config file that reproduces the issue: # Minimal repro for Ubuntu nginx 1.24.0-2ubuntu7.16 # (CVE-2026-42533 backport): $1 copies from the start of the URI # instead of from the capture offset. # # nginx -c $PWD/nginx.conf -p $PWD # curl -s http://127.0.0.1:18080/prefix/hello # curl -s http://127.0.0.1:18080/en/ # nginx -c $PWD/nginx.conf -p $PWD -s stop worker_processes 1; error_log error.log info; pid nginx.pid; events { worker_connections 16; } http { access_log access.log; default_type text/plain; server { listen 127.0.0.1:18080; # Capture does not start at offset 0. # Expected: [hello] # Buggy: [/pref] (first 5 bytes of the URI) location ~ ^/prefix/([a-z]+) { return 200 "[$1]\n"; } # Same bug, 2-letter locale form used in production. # Expected: [en] # Buggy: [/e] # With a percent-encoded request (quoted_uri), [/e] is re-escaped as [%2Fe] location ~ "^/([a-z]{2})/" { return 200 "[$1]\n"; } } } ** Affects: nginx (Ubuntu) Importance: Undecided Status: New ** Summary changed: - egex captures copy from the start of the URI after CVE-2026-42533 backport (1.24.0-2ubuntu7.16) + regex captures copy from the start of the URI after CVE-2026-42533 backport (1.24.0-2ubuntu7.16) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2164580 Title: regex captures copy from the start of the URI after CVE-2026-42533 backport (1.24.0-2ubuntu7.16) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/nginx/+bug/2164580/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
