linux/meta-openembedded.git/meta-webserver/recipes-httpd, branch master

nginx: upgrade 1.30.1 -> 1.30.2

2026-05-23T04:01:00+00:00

Changes with nginx 1.30.2 *) Security: a heap memory buffer overflow might occur in a worker process when using a configuration with overlapping captures in ngx_http_rewrite_module, potentially resulting in arbitrary code execution (CVE-2026-9256). Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj

nginx: upgrade 1.30.0 -> 1.30.1

2026-05-22T00:20:21+00:00

Changes with nginx 1.30.1 *) Security: when using the "proxy_set_body" directive, an attacker might inject data in the proxied request to an HTTP/2 backend (CVE-2026-42926). *) Security: a heap memory buffer overflow might occur in a worker process while handling a specially crafted request by ngx_http_rewrite_module, potentially resulting in arbitrary code execution (CVE-2026-42945). *) Security: a heap memory buffer overread might occur in a worker process while handling a specially crafted response by ngx_http_scgi_module or ngx_http_uwsgi_module, allowing an attacker to cause a disclosure of worker process memory or segmentation fault in a worker process (CVE-2026-42946). *) Security: a heap memory buffer overread might occur in a worker process while handling a specially sent response with decoding from UTF-8 via the "charset_map" directive, allowing an attacker to cause a limited disclosure of worker proccess memory or segmentation fault in a worker process (CVE-2026-42934). *) Security: when using HTTP/3, processing of connection migration might cause new QUIC streams to receive a new client address before validation, allowing an attacker to cause address spoofing (CVE-2026-40460). *) Security: use-after-free might occur during DNS server response processing if the "ssl_ocsp" directive was used, allowing an attacker to cause worker process memory corruption or segmentation fault in a worker process (CVE-2026-40701). *) Bugfix: connections with HTTP/2 backends might not be cached when using the "proxy_set_body" or "proxy_pass_request_body" directives. *) Bugfix: proxied HTTP/0.9, SCGI, or uWSGI responses might be transferred incorrectly if the first line was not fully read. Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj

hiawatha: upgrade 12.1 -> 12.2

2026-05-13T07:30:51+00:00

Changelog: ============ * Let's Encrypt script processes variables in Hiawatha configuration. * Reintroduced ssi-cgi, as requested. * Small improvements and bugfixes. * Bugfix: CAcertificates setting didn't work. Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj

apache2: upgrade 2.4.66 -> 2.4.67

2026-05-13T07:17:25+00:00

Security fixes: - CVE-2026-34059 - CVE-2026-34032 - CVE-2026-33857 - CVE-2026-33523 - CVE-2026-33007 - CVE-2026-33006 - CVE-2026-29169 - CVE-2026-29168 - CVE-2026-28780 - CVE-2026-24072 - CVE-2026-23918 See: https://archive.apache.org/dist/httpd/CHANGES_2.4.67 Signed-off-by: Liyin Zhang Signed-off-by: Khem Raj

nginx: upgrade 1.29.7 -> 1.30.0

2026-05-13T07:17:25+00:00

1.30.0 stable version has been released, incorporating new features and bug fixes from the 1.29.x mainline branch (https://nginx.org/en/CHANGES-1.30) Also dropped v1.28 support. Signed-off-by: Ankur Tyagi Signed-off-by: Khem Raj

monkey: patch CVEs

2026-04-20T14:35:36+00:00

These patches are about a number of CVEs files against the application: CVE-2025-63649, CVE-2025-63650, CVE-2025-63651, CVE-2025-63652, CVE-2025-63653, CVE-2025-63655, CVE-2025-63656, CVE-2025-63657 and CVE-2025-63658. These patches are taken from a pull request[1] that is referenced in the relevant bug report[2]. The patches don't target specific CVEs on separately, but they fix a number of CVEs altogether. Based on upstream analysis (in the linked issue) a number of these CVEs are duplicates of each other and/or not exploitable. The valid CVEs are fixed by these patches. I haven't added specific CVE info to the patches, one hand because of the above, it is hard to separate the patches by CVE, and secondarily because NVD tracks these CVEs with incorrect version info: NVD considers 1.8.6 fully fixed, even though the patches are only in the master branch, untagged at this time. After updating the recipe to 1.8.6+, the vulnerabilites will disappear from the CVE report due to this. [1]: https://github.com/monkey/monkey/pull/434 [2]: https://github.com/monkey/monkey/issues/426 Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj

monkey: upgrade 1.8.4 -> 1.8.7

2026-04-20T14:35:36+00:00

Shortlog: https://github.com/monkey/monkey/compare/v1.8.4...v1.8.7 Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj

hiawatha: Upgrade to 12.1 release

2026-04-16T19:21:07+00:00

- HTTP/2 support added via the nghttp2 library (credits to Heiko Zimmermann) — noted as experimental, so testing carefully before enabling on production servers is recommended. - mbed TLS updated from 4.0.0 to 4.1.0. - ssi-cgi removed — the release notes suggest using Hiawatha's XSLT support as a more advanced alternative. Signed-off-by: Khem Raj

sthttpd: disable C23 support to fix configure check

2026-04-16T19:21:06+00:00

Set ac_cv_prog_cc_c23=no to prevent autoconf from detecting C23 compiler support, avoiding potential build failures as the package is not yet fully ported to support C23 standard. Signed-off-by: Khem Raj

nginx: upgrade 1.29.6 -> 1.29.7

2026-03-28T15:32:48+00:00

Changes: *) Security: a buffer overflow might occur while handling a COPY or MOVE request in a location with "alias", allowing an attacker to modify the source or destination path outside of the document root (CVE-2026-27654). *) Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module on 32-bit platforms might cause a worker process crash, or might have potential other impact (CVE-2026-27784). *) Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module might cause a worker process crash, or might have potential other impact (CVE-2026-32647). *) Security: a segmentation fault might occur in a worker process if the CRAM-MD5 or APOP authentication methods were used and authentication retry was enabled (CVE-2026-27651). *) Security: an attacker might use PTR DNS records to inject data in auth_http requests, as well as in the XCLIENT command in the backend SMTP connection (CVE-2026-28753). *) Security: SSL handshake might succeed despite OCSP rejecting a client certificate in the stream module (CVE-2026-28755). *) Feature: the "multipath" parameter of the "listen" directive. *) Feature: the "local" parameter of the "keepalive" directive in the "upstream" block. *) Change: now the "keepalive" directive in the "upstream" block is enabled by default. *) Change: now ngx_http_proxy_module supports keepalive by default; the default value for "proxy_http_version" is "1.1"; the "Connection" proxy header is not sent by default anymore. *) Bugfix: an invalid HTTP/2 request might be sent after switching to the next upstream if buffered body was used in the ngx_http_grpc_module. Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj