概要
| 公開日時 | 2026-06-18 |
| 深刻度 | 評価待ち |
| モジュール | kusanagi-nginx130 |
| 対象 | Business Edition, KUSANAGI 9, Page Speed Technology, Security Edition |
脆弱性情報
kusanagi-nginx130の脆弱性情報を公開しました。修正した脆弱性は以下の通りとなります。
- Security: a heap memory buffer overflow might occur in a worker process when using a configuration with "ignore_invalid_headers off;" and "large_client_header_buffers" with large configured values when proxying a specially crafted request to HTTP/2 or gRPC backend, allowing an attacker to cause worker process memory corruption or segmentation fault in a worker process (CVE-2026-42055). Thanks to Mufeed VH of Winfunc Research.
- Security: a heap memory buffer overread might occur in a worker process while handling a specially sent response with decoding from UTF-8 via the "charset_map" directive, allowing an attacker to cause a limited disclosure of worker proccess memory or segmentation fault in a worker process (CVE-2026-48142). Thanks to Han Yan of Xiaomi and p4p3r of CYBERONE.
CVE詳細
CVSSスコアや脆弱性の報告者等、詳細については、以下の情報を参照してください。
なお、CVEの状況によっては情報がまだ公開されていない場合があります。
