DSA-6496-1 release notes and known issues

Summary

Multiple vulnerabilities were discovered in nginx, a high-performance web and reverse proxy server, which may result in denial of service, memory disclosure or potentially the execution of arbitrary code. CVE-2026-42533 A heap buffer overflow was discovered in the nginx script engine. It can be triggered when a map directive performs regular expression matching and a string expression references captures modified by the map, or when non-cacheable variables change between the script length pass and the script copy pass. CVE-2026-56434 Duplicate finalization of an HTTP subrequest can result in a use-after-free. The issue is observable in configurations using server-side includes together with proxy_pass and proxy_buffering disabled, when an upstream response causes the same subrequest to be posted twice. CVE-2026-60005 ngx_http_regex_exec() could replace the captures array without clearing r->ncaptures when the new regular expression did not match. A subsequent unnamed capture could then access uninitialised memory, resulting in memory disclosure. https://security-tracker.debian.org/tracker/DSA-6496-1

Improvements and security content

• Multiple vulnerabilities were discovered in nginx, a high-performance web and reverse proxy server, which may result in denial of service, memory disclosure or potentially the execution of arbitrary code. CVE-2026-42533 A heap buffer overflow was discovered in the nginx script engine. It can be triggered when a map directive performs regular expression matching and a string expression references captures modified by the map, or when non-cacheable variables change between the script length pass and the script copy pass. CVE-2026-56434 Duplicate finalization of an HTTP subrequest can result in a use-after-free. The issue is observable in configurations using server-side includes together with proxy_pass and proxy_buffering disabled, when an upstream response causes the same subrequest to be posted twice. CVE-2026-60005 ngx_http_regex_exec() could replace the captures array without clearing r->ncaptures when the new regular expression did not match. A subsequent unnamed capture could then access uninitialised memory, resulting in memory disclosure. https://security-tracker.debian.org/tracker/DSA-6496-1

Affected products and versions

Recommended action

Review the official publisher document before deployment.

Lifecycle connections

These links connect the publisher update to related Lifecycle records without treating the update publication date as an end-of-support date.

Official publisher evidence