Confirming this on our production server (noble, 1.24.0-2ubuntu7.16, pulled
via unattended-upgrades on 2026-08-20).
Real-world impact: a classic PHP front-controller rule
if (!-e $request_filename) {
rewrite ^/(.*)$ /index.php?s=$1 last;
}
turned "GET /api/config/getInfo" into QUERY_STRING "s=/api/config/getInf"
(leading '/' appears, trailing 'o' lost, length unchanged) — i.e. silent
data corruption, no error logged, which silently broke our PHP framework's
routing. REQUEST_URI stays correct, so the corruption is easy to misdiagnose
as truncation.
Independently reproduced with the same signature:
location ~ ^/captest/(.+)$ { return 200 "capture=[$1]\n"; }
# curl http://127.0.0.1:8899/captest/hello -> capture=[/capt] (expected
[hello])
location /rw/ { rewrite ^/rw/(.*)$ /rw_target?s=$1 last; }
# curl http://127.0.0.1:8899/rw/hello -> qs=[s=/rw/h] (expected s=hello)
The official upstream nginx:1.24 image returns the correct values with the
same config, confirming this is specific to the Ubuntu backport.
Suggested one-line fix for debian/patches/CVE-2026-42533.patch, in the
ngx_http_script_copy_capture_code() hunk (src/http/ngx_http_script.c):
set
p = r->captures_data + cap[n];
after computing len (this is the accompanying change from the upstream
script-engine rework that the backport missed), or alternatively keep the
original 1.24.0 usage "&p[cap[n]]" in the three rewritten call sites.
Also worth noting for triage: this is the second regression from this same
patch, alongside LP: #2164558 ("no buffer space in script copy", loud 500s)
which triggered the 7.17 rollback, and LP: #2161362 (ABI break, 7.15
rollback). Since 7.17 disables the patch entirely, hopefully both
regressions can be fixed before it is re-landed in 7.18+. Named captures
are affected as well (same copy_capture_code path); only captures starting
at offset 0 are immune.
** CVE added: https://cve.org/CVERecord?id=CVE-2026-42533
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2164580
Title:
regex captures copy from the start of the URI after CVE-2026-42533
backport (1.24.0-2ubuntu7.16)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/nginx/+bug/2164580/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
