From nobody Mon Jun 1 14:26:22 2026 X-Original-To: freebsd-security@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gTbqt6kq3z6g5vM for ; Mon, 01 Jun 2026 14:26:34 +0000 (UTC) (envelope-from martin@lispworks.com) Received: from mail.lispworks.com (mail.lispworks.com [46.17.166.21]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "*.lispworks.com", Issuer "Sectigo Public Server Authentication CA DV R36" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gTbqs6kSmz3dff; Mon, 01 Jun 2026 14:26:33 +0000 (UTC) (envelope-from martin@lispworks.com) Authentication-Results: mx1.freebsd.org; dkim=pass header.d=lispworks.com header.s=default header.b=lEaqaZg1; dmarc=pass (policy=none) header.from=lispworks.com; spf=pass (mx1.freebsd.org: domain of martin@lispworks.com designates 46.17.166.21 as permitted sender) smtp.mailfrom=martin@lispworks.com Received: from lwfs1-cam.cam.lispworks.com (localhost [[UNIX: localhost]]) by lwfs1-cam.cam.lispworks.com (8.18.1/8.18.1) with ESMTP id 651EQQ8M038588; Mon, 1 Jun 2026 15:26:26 +0100 (BST) (envelope-from martin@lispworks.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=lispworks.com; s=default; t=1780323986; bh=gha6hpuk3Y1wQyxFa3GoC3sRCs5y1Q4WNLp152WLf+8=; h=Date:From:To:CC:In-reply-to:Subject:References; b=lEaqaZg1W36oK2nEhSY1N2cXFgQ6enFAzmKHKByVcybcvrBRX3LFGqF50HAuF6N3x ZOZjB/SwSg9vITutgxBAMDXChEaE9F6eqKTyaBnG27e2nBhKJEKv7/S18cD/UscoSM 2iCIq7wEiwAl7DsSjWZDELLF2L6icYnvvGaLWpIFEe1W/MF6g8ngEaMe2aSDpaJy97 jZad56Yti/dUfONcJuBQVJuwI3B7yyJVGkhiChrH6XSv3pZ1TXh6hI92W49yrXdU25 dN/hYYloZmksg0CqTtHtXGk0RsDtZh6OhsGySvATz/IDqbdI+hllaZ43fC69eT1IV4 /wZzDJVux2l2w== Received: from higson.cam.lispworks.com (higson.cam.lispworks.com [192.168.1.7]) by lwfs1-cam.cam.lispworks.com (8.18.1/8.18.1) with ESMTP id 651EQM2O038566; Mon, 1 Jun 2026 15:26:22 +0100 (BST) (envelope-from martin@lispworks.com) Received: from higson.cam.lispworks.com (localhost.localdomain [127.0.0.1]) by higson.cam.lispworks.com (8.14.4) id 651EQMvp018900; Mon, 1 Jun 2026 15:26:22 +0100 Received: (from martin@localhost) by higson.cam.lispworks.com (8.14.4/8.14.4/Submit) id 651EQMeV018896; Mon, 1 Jun 2026 15:26:22 +0100 Date: Mon, 1 Jun 2026 15:26:22 +0100 Message-Id: <202606011426.651EQMeV018896@higson.cam.lispworks.com> From: Martin Simmons To: Arnaud de Prelle CC: freebsd-security@freebsd.org, fernape@freebsd.org In-reply-to: (message from Arnaud de Prelle on Sun, 31 May 2026 22:01:11 +0200) Subject: Re: nginx-1.30.2_2,3 wrongly vulnerable to CVE-2026-9256 ? References: X-Spamd-Result: default: False [-2.93 / 15.00]; NEURAL_HAM_LONG(-1.00)[-1.000]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; SUBJECT_ENDS_QUESTION(1.00)[]; NEURAL_HAM_SHORT(-0.73)[-0.735]; DMARC_POLICY_ALLOW(-0.50)[lispworks.com,none]; R_SPF_ALLOW(-0.20)[+mx]; R_DKIM_ALLOW(-0.20)[lispworks.com:s=default]; RWL_MAILSPIKE_VERYGOOD(-0.20)[46.17.166.21:from]; MIME_GOOD(-0.10)[text/plain]; MIME_TRACE(0.00)[0:+]; FREEFALL_USER(0.00)[martin]; ASN(0.00)[asn:51055, ipnet:46.17.160.0/21, country:GB]; TO_DN_SOME(0.00)[]; MISSING_XM_UA(0.00)[]; FROM_HAS_DN(0.00)[]; RCVD_TLS_LAST(0.00)[]; ARC_NA(0.00)[]; TO_MATCH_ENVRCPT_SOME(0.00)[]; MLMMJ_DEST(0.00)[freebsd-security@freebsd.org]; FROM_EQ_ENVFROM(0.00)[]; RCVD_COUNT_THREE(0.00)[4]; MID_RHS_MATCH_FROMTLD(0.00)[]; RCPT_COUNT_THREE(0.00)[3]; DKIM_TRACE(0.00)[lispworks.com:+] X-Spamd-Bar: -- X-Rspamd-Queue-Id: 4gTbqs6kSmz3dff List-Id: Security issues List-Archive: https://lists.freebsd.org/archives/freebsd-security List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-security@freebsd.org Sender: owner-freebsd-security@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list [fernape@ added] >>>>> On Sun, 31 May 2026 22:01:11 +0200, Arnaud de Prelle said: > > Hi, > > As per > - https://www.freshports.org/www/nginx/ and > - > https://vuxml.freebsd.org/freebsd/36a3131d-5600-11f1-b339-3497f65b111b.html > CVE-2026-9256 should be fixed since nginx 1.30.2,3. The contents of this URL was stale -- the VuXML now says nginx < 1.31.1,3 (since yesterday), which explains why pkg audit is detecting it. > I'm using the latest version of nginx: > # pkg info nginx | grep Version > Version : 1.30.2_2,3 > > But pkg audit -F reports this port as vulnerable to CVE-2026-9256: > # pkg audit -F > vulnxml file up-to-date > nginx-1.30.2_2,3 is vulnerable: > nginx -- heap buffer overflow in ngx_http_rewrite_module > CVE: CVE-2026-9256 > WWW: > https://vuxml.FreeBSD.org/freebsd/36a3131d-5600-11f1-b339-3497f65b111b.html > > Am I missing something ? The VuXML looks wrong to me now. nginx released both 1.30.2 and 1.31.1 to fix this CVE (https://nginx.org/en/CHANGES-1.30 and https://nginx.org/en/CHANGES). __Martin From nobody Mon Jun 1 14:47:12 2026 X-Original-To: freebsd-security@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gTcHq0hkyz6g7mk for ; Mon, 01 Jun 2026 14:47:19 +0000 (UTC) (envelope-from martin@lispworks.com) Received: from mail.lispworks.com (mail.lispworks.com [46.17.166.21]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "*.lispworks.com", Issuer "Sectigo Public Server Authentication CA DV R36" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gTcHp4KXCz3jt4; Mon, 01 Jun 2026 14:47:18 +0000 (UTC) (envelope-from martin@lispworks.com) Authentication-Results: mx1.freebsd.org; dkim=pass header.d=lispworks.com header.s=default header.b=cqbVD4rI; dmarc=pass (policy=none) header.from=lispworks.com; spf=pass (mx1.freebsd.org: domain of martin@lispworks.com designates 46.17.166.21 as permitted sender) smtp.mailfrom=martin@lispworks.com Received: from lwfs1-cam.cam.lispworks.com (localhost [[UNIX: localhost]]) by lwfs1-cam.cam.lispworks.com (8.18.1/8.18.1) with ESMTP id 651ElHKG038972; Mon, 1 Jun 2026 15:47:17 +0100 (BST) (envelope-from martin@lispworks.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=lispworks.com; s=default; t=1780325237; bh=NXStZuRTKgJ7exwo16TSCeVqmNBQptOiK1V4QQtMTpo=; h=Date:From:To:CC:In-reply-to:Subject:References; b=cqbVD4rI/c9nxg9iUik/4+hpfofBoMVyJAc08EI425rX9jRmSeLLXOphB+yg3m7Jj AeDzHOpfRIg0w/fZbkdHCYKV4est09+tsKVBDG6G8qHK71sXUXkW+GnZ2NdD07oOR4 KJ1br4oOMiWy5afPIw4bkTjpDrP4wrn82aC2XgTShPCSPfRa9OIdmySJJBTsQjqNlv bc7Zw38XgVVN/R4qiAGRAttJ/etIAHRhiMYpGLB86/hutfsB2bfqM6U0zTBPBwggWQ mqjrjmW/qhUpIumK8LIqjhzwz0nOygELkuW4YjGoigRl4eczKeCYUjXxBILB8riF+j A1m4OS1YXiZ/A== Received: from higson.cam.lispworks.com (higson.cam.lispworks.com [192.168.1.7]) by lwfs1-cam.cam.lispworks.com (8.18.1/8.18.1) with ESMTP id 651ElDun038952; Mon, 1 Jun 2026 15:47:13 +0100 (BST) (envelope-from martin@lispworks.com) Received: from higson.cam.lispworks.com (localhost.localdomain [127.0.0.1]) by higson.cam.lispworks.com (8.14.4) id 651ElD49019064; Mon, 1 Jun 2026 15:47:13 +0100 Received: (from martin@localhost) by higson.cam.lispworks.com (8.14.4/8.14.4/Submit) id 651ElC4B019060; Mon, 1 Jun 2026 15:47:12 +0100 Date: Mon, 1 Jun 2026 15:47:12 +0100 Message-Id: <202606011447.651ElC4B019060@higson.cam.lispworks.com> From: Martin Simmons To: Masachika ISHIZUKA CC: freebsd-security@freebsd.org, brnrd@freebsd.org In-reply-to: <20260531.142551.167441309236637198.ish@ish.org> (message from Masachika ISHIZUKA on Sun, 31 May 2026 14:25:51 +0900 (JST)) Subject: Re: Why xorg-server-21.1.22,1 is vulnerable References: <20260531.142551.167441309236637198.ish@ish.org> X-Spamd-Result: default: False [-4.20 / 15.00]; NEURAL_HAM_LONG(-1.00)[-1.000]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; NEURAL_HAM_SHORT(-1.00)[-0.999]; DMARC_POLICY_ALLOW(-0.50)[lispworks.com,none]; R_SPF_ALLOW(-0.20)[+mx:c]; R_DKIM_ALLOW(-0.20)[lispworks.com:s=default]; RWL_MAILSPIKE_VERYGOOD(-0.20)[46.17.166.21:from]; MIME_GOOD(-0.10)[text/plain]; MIME_TRACE(0.00)[0:+]; FREEFALL_USER(0.00)[martin]; ASN(0.00)[asn:51055, ipnet:46.17.160.0/21, country:GB]; TO_DN_SOME(0.00)[]; MISSING_XM_UA(0.00)[]; FROM_HAS_DN(0.00)[]; RCVD_TLS_LAST(0.00)[]; ARC_NA(0.00)[]; TO_MATCH_ENVRCPT_SOME(0.00)[]; RCVD_COUNT_THREE(0.00)[4]; FROM_EQ_ENVFROM(0.00)[]; MLMMJ_DEST(0.00)[freebsd-security@freebsd.org]; RCPT_COUNT_THREE(0.00)[3]; MID_RHS_MATCH_FROMTLD(0.00)[]; DKIM_TRACE(0.00)[lispworks.com:+] X-Spamd-Bar: ---- X-Rspamd-Queue-Id: 4gTcHp4KXCz3jt4 List-Id: Security issues List-Archive: https://lists.freebsd.org/archives/freebsd-security List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-security@freebsd.org Sender: owner-freebsd-security@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list [ brnrd@ added ] >>>>> On Sun, 31 May 2026 14:25:51 +0900 (JST), Masachika ISHIZUKA said: > > Hi. > > # pkg audit -F > vulnxml file up-to-date > [snip] > xorg-server-21.1.22,1 is vulnerable: > xorg-server -- Multiple vulnerabilities > CVE: CVE-2026-34003 > CVE: CVE-2026-34002 > CVE: CVE-2026-34001 > CVE: CVE-2026-34000 > CVE: CVE-2026-33999 > WWW: https://vuxml.FreeBSD.org/freebsd/7b6463c6-3813-11f1-a284-589cfc10a551.html > > Is this true ? The VuxML for xorg-server looks wrong to me now. It says xorg-server < 21.1.22,2 but xorg-server is at epoch 1, not 2. __Martin From nobody Mon Jun 1 15:18:23 2026 X-Original-To: freebsd-security@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gTd0716g8z6gB9M for ; Mon, 01 Jun 2026 15:18:47 +0000 (UTC) (envelope-from tomek@cedro.info) Received: from mail-ed1-x533.google.com (mail-ed1-x533.google.com [IPv6:2a00:1450:4864:20::533]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "WR4" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gTd0611yQz3n0j for ; Mon, 01 Jun 2026 15:18:45 +0000 (UTC) (envelope-from tomek@cedro.info) Authentication-Results: mx1.freebsd.org; dkim=pass header.d=cedro.info header.s=google header.b=gEKeTT40; dmarc=none; spf=none (mx1.freebsd.org: domain of tomek@cedro.info has no SPF policy when checking 2a00:1450:4864:20::533) smtp.mailfrom=tomek@cedro.info Received: by mail-ed1-x533.google.com with SMTP id 4fb4d7f45d1cf-68852a4fc68so753962a12.3 for ; Mon, 01 Jun 2026 08:18:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cedro.info; s=google; t=1780327119; x=1780931919; darn=freebsd.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=FAovXqt5/iOI/4gSdqhg/ZieLDJzAYstTAPp8cwuLIE=; b=gEKeTT404kvQCF0zuWd+wXNOtnYdg91QNM0/Vj0AxyEhGtHN/k10YbTxP/iBjhD1wA VaLRI6uiwC8qjLuKZMVeq5VK7g3Z+Ok9hTiPInZpWJYkn9oWMTNjKndQUOmQNTpxcK8k zQ7aUxKEm7PkIXQOxZT2w5O2sNrKttGb81FK/eBG3UYVa8qrn4EXHuyPHBGZgjK1K/N6 ARXfuwmjjwH3zbMIjbpECkMuWmNNvN9JZAg/91zKv3tKOEqzJ2qXJXnaCUzr1g7M5BR/ y/cQukRXaNpaZZ01X4DPDjHXfJLuXJhab/nAko52BpUnMD+kqo6bP7hNbWRHTrvyqoxl yekA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780327119; x=1780931919; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=FAovXqt5/iOI/4gSdqhg/ZieLDJzAYstTAPp8cwuLIE=; b=bDNiedj4S6Da7lYt70sEPsGVgJ67NVLbJBsnn3jx0Jg8FhS+ugIeSz8EbdwJrmN2FK 3m/Uvyx4MVoVTbSLYwf4lc+nfqDmh9GMXMlJ6shhYagxA5R2PDMar+JITNHPn6qMSxRB jQoPwRfeR53l4b62c/aeFr9g4uWui6ZTTyfx3Sc7MfSqYsHMKpt6WTxTjBFCScWrQjPy gu96qtQmor22kJF38zzbKAKGyG11UATm9IyOYZIZ4XD5WA8a1Gb3LNHidPow4JFSiB1u kBZta4iTVOsk/IKIULJfjAO4pCUXi3pjQ363WqbchSEv5Q20H3+Em1h9j4qe3tMxo+/z xB3Q== X-Gm-Message-State: AOJu0YxQuOpDXqKCNLSoK0ou35fwQg/z7PJtK8cVXu4pY89+CPFc3CDH 82q3jV8r+aRhJhuP+klyuWMNZt8PXiGEf9icT02MhvipC6NLoMDxq+P1GMAciRodvDmhA2qgESA FaLCwzrZF X-Gm-Gg: Acq92OF3so7qR3l/C8MIDy2rKqlJYvbSwA9Y01h0vomZFHlvxCnCx9eLFu1/VKhVu5Z Al4qx1AEKMcZ0ZH0KdW2e3V4DLcuzb35qTcFpvTKBNmumcqS8g2rbMdS5fAGJqJf4KUOOVc6pk6 r0GTYQHVlhWugNKALDqdeTPOcon2aehHZVA8w5BYnunBr8ht0evjBKyVv1iZRSLuTImiS54iux1 mmT6pk9lJYVWZNFn78kzO2/BpVOsQMYcCml7ujRiNBgTkG3lrwIMD74ZftuPXj2RtwlI8CoInzM 4J8tJ6fiKQVJHE3XzWElAgLTwAMK9brA+DGu/LtgB82gXWrVPQtdDC6f/fwznkLrouKTZy8ewPE XgewWLLon/OE5SI+2LshmIEcoOKDkKSEMurijp2MK0kBRRJV3KM1YBqOgU9GF52naSPcbfdfqEr DJNHBRHxJ6FmRyhV2bl1mjyiG7fd2yDcnhspenTTuWDo66iwzLlXdVicE5pFQC+piNRA== X-Received: by 2002:a17:907:75c2:b0:bee:959e:9ac8 with SMTP id a640c23a62f3a-bee959e9b45mr83909166b.4.1780327118484; Mon, 01 Jun 2026 08:18:38 -0700 (PDT) Received: from mail-ed1-f51.google.com (mail-ed1-f51.google.com. [209.85.208.51]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-becb0b9576dsm164716266b.46.2026.06.01.08.18.37 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 01 Jun 2026 08:18:37 -0700 (PDT) Received: by mail-ed1-f51.google.com with SMTP id 4fb4d7f45d1cf-68d232e119dso785277a12.0 for ; Mon, 01 Jun 2026 08:18:37 -0700 (PDT) X-Received: by 2002:a17:907:75c2:b0:bee:959e:9ac8 with SMTP id a640c23a62f3a-bee959e9b45mr83905866b.4.1780327117592; Mon, 01 Jun 2026 08:18:37 -0700 (PDT) List-Id: Security issues List-Archive: https://lists.freebsd.org/archives/freebsd-security List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-security@freebsd.org Sender: owner-freebsd-security@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 References: <20260531.142551.167441309236637198.ish@ish.org> In-Reply-To: <20260531.142551.167441309236637198.ish@ish.org> From: Tomek CEDRO Date: Mon, 1 Jun 2026 17:18:23 +0200 X-Gmail-Original-Message-ID: X-Gm-Features: AVHnY4KJz22AGd594SAhPA4fGoj0a96Ur4mVOLv5s0aJld3VwEke2PTFNKKfIA0 Message-ID: Subject: Re: Why xorg-server-21.1.22,1 is vulnerable To: Masachika ISHIZUKA Cc: freebsd-security@freebsd.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Spamd-Result: default: False [-3.28 / 15.00]; NEURAL_HAM_LONG(-1.00)[-1.000]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; NEURAL_HAM_SHORT(-0.98)[-0.984]; R_DKIM_ALLOW(-0.20)[cedro.info:s=google]; MIME_GOOD(-0.10)[text/plain]; RCVD_VIA_SMTP_AUTH(0.00)[]; ARC_NA(0.00)[]; R_SPF_NA(0.00)[no SPF record]; ASN(0.00)[asn:15169, ipnet:2a00:1450::/32, country:US]; MIME_TRACE(0.00)[0:+]; MISSING_XM_UA(0.00)[]; TO_DN_SOME(0.00)[]; RCPT_COUNT_TWO(0.00)[2]; RCVD_COUNT_THREE(0.00)[3]; MLMMJ_DEST(0.00)[freebsd-security@freebsd.org]; FROM_EQ_ENVFROM(0.00)[]; FROM_HAS_DN(0.00)[]; RCVD_IN_DNSWL_NONE(0.00)[2a00:1450:4864:20::533:from,209.85.208.51:received]; TO_MATCH_ENVRCPT_SOME(0.00)[]; RCVD_TLS_LAST(0.00)[]; PREVIOUSLY_DELIVERED(0.00)[freebsd-security@freebsd.org]; DMARC_NA(0.00)[cedro.info]; DKIM_TRACE(0.00)[cedro.info:+] X-Spamd-Bar: --- X-Rspamd-Queue-Id: 4gTd0611yQz3n0j On Sun, May 31, 2026 at 5:26=E2=80=AFAM Masachika ISHIZUKA wr= ote: > Hi. > # pkg audit -F > vulnxml file up-to-date > [snip] > xorg-server-21.1.22,1 is vulnerable: > xorg-server -- Multiple vulnerabilities > CVE: CVE-2026-34003 > CVE: CVE-2026-34002 > CVE: CVE-2026-34001 > CVE: CVE-2026-34000 > CVE: CVE-2026-33999 > WWW: https://vuxml.FreeBSD.org/freebsd/7b6463c6-3813-11f1-a284-589cfc10= a551.html > Is this true ? > -- > Masachika ISHIZUKA In any case XLibre is now in the ports / packages for some time, with active support / maintenance in the upstream (XLibre was forked from Xorg as it was deliberately killed by Wayland folks that took over Xorg Foundation), I work on it for several months already with no problem, great stability and 3D acceleration with nVidia GPU, both in Linuxlator and Wine11, so I can recommend :-) -- CeDeROM, SQ7MHZ, http://www.tomek.cedro.info From nobody Mon Jun 1 20:42:16 2026 X-Original-To: freebsd-security@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gTm9g3kVBz6fynd for ; Mon, 01 Jun 2026 20:42:31 +0000 (UTC) (envelope-from fernando.apesteguia@gmail.com) Received: from mail-ot1-f50.google.com (mail-ot1-f50.google.com [209.85.210.50]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "WR4" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gTm9g1jJLz3V3j for ; Mon, 01 Jun 2026 20:42:31 +0000 (UTC) (envelope-from fernando.apesteguia@gmail.com) Authentication-Results: mx1.freebsd.org; none Received: by mail-ot1-f50.google.com with SMTP id 46e09a7af769-7e62b6163c8so3026419a34.2 for ; Mon, 01 Jun 2026 13:42:31 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780346550; x=1780951350; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=sQPSKH5y5bDljaQhMvluGJBfQpi8dPMJ9zJ0bz8LQRg=; b=TWRRZiKiw1pYq2Aqyz6WIGGqkZBxXrl0bKQMxP+g0bFdLglv5c0Kt0YXYmGEwgiMXa SUCYG4XShtgZC6g8FRm6Jz7WA+Qr1X7FfnRah/cJdxhRE6DfZOJFd7z9QMBmfefKZJaL ufb9T5Zy/eKzErkPzTZvRd7t1XSMyG2GHPjYxXvZHuXpzBwuc+xNs681I1f/ZmOkCz8j oZFnZ/cgT7SlxnThLih76n/H5/LBk2TXPZdsr9wy7bw0hV8HAeVCmKK91x+1X+YZDneG E/YuzkUkLgtvDawq7n+3viZeJHpEbh2pVYOwnzOIUAZL8TdKZwpZXtzSRW947hf8H2IC ytwg== X-Forwarded-Encrypted: i=1; AFNElJ+Q1lVe884Gy9xJSItWwOtEAKE7qLaI2ISxHgjWx2J3zoH6Poo38W1dvsqaXIssRIDi9hLcOKv6PRik6TL8Veb8@freebsd.org X-Gm-Message-State: AOJu0Yxc0pVOc88n9ym+v4ZR0BlJiiC+ptQGupL4ISfSdAkyVCFP+G7a NsKjKFY2/aauihuInKQJsL7pCZ/D8RlBqZww3ACkgyzs9nRDetLOfTu2exBsUP7D X-Gm-Gg: Acq92OFN+IBJBR4GfRJXmalBLHzGV2p93fvVHFltGicMLL7t0C8DXjSMh35+onbdXVQ v6hFJJFTojh7F3jMjb0zVjMvvKL9F2vcB9lhld9RP/keYdJn5x/f9D3dTIE9AnCQNq3NqN22BSO Jjl4IJLAsW5g99OKu9kzhngOKTFtL4g0ngNAmDQAP4OsK1qCfDZK4c2/lh5wdtWW0gIMkJPwWmu 0PM7lVdRi5x5fPPHTFGSM2Hv4mdUuEyv8IFxUjoXI03uib8pCcoiP9NsuXHsgPIy8myathT6Xyg mZucQlEohuX6+yh94N0mypCBrJYqiViK4Ui2cDUrwT/zqmmxmC5wu7aI3zecvCEJZfdcchi7DGk 2mKhcXVbHcCgKhAOoWmH/lJl74F+SgyGg0pSPSatYx1Fk6nEBohEZJNThiI9G0UF+edqCUkMh1u 3E8nVl8nI9lrvhxRDs0iRUlQwSgYnFbpCkfq9U7GkWauja/kWQANbr4iSq/h3FEYsuAQB5inMI+ kpFQWyGliEngcJ9/zkfloHNJRj6tg== X-Received: by 2002:a05:6830:698e:b0:7dc:dd58:50c7 with SMTP id 46e09a7af769-7e6a1de8f9bmr8466948a34.18.1780346549718; Mon, 01 Jun 2026 13:42:29 -0700 (PDT) Received: from mail-oo1-f52.google.com (mail-oo1-f52.google.com. [209.85.161.52]) by smtp.gmail.com with ESMTPSA id 46e09a7af769-7e695a1d33dsm9425185a34.0.2026.06.01.13.42.29 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 01 Jun 2026 13:42:29 -0700 (PDT) Received: by mail-oo1-f52.google.com with SMTP id 006d021491bc7-69e2e3c773fso395569eaf.2 for ; Mon, 01 Jun 2026 13:42:29 -0700 (PDT) X-Forwarded-Encrypted: i=1; AFNElJ9bgZ0yBNDtw1I6bVAg2klbjBW7/Drc3bLPoSDH0eIfFpqCDMmaE7KXTkPHzazQa10/+xhkAyyg1QhQ8dzQG7Ji@freebsd.org X-Received: by 2002:a05:6820:1351:b0:69e:b8:ffe4 with SMTP id 006d021491bc7-69e1038265amr6771728eaf.32.1780346548906; Mon, 01 Jun 2026 13:42:28 -0700 (PDT) List-Id: Security issues List-Archive: https://lists.freebsd.org/archives/freebsd-security List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-security@freebsd.org Sender: owner-freebsd-security@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 References: <202606011426.651EQMeV018896@higson.cam.lispworks.com> In-Reply-To: <202606011426.651EQMeV018896@higson.cam.lispworks.com> From: =?UTF-8?Q?Fernando_Apestegu=C3=ADa?= Date: Mon, 1 Jun 2026 22:42:16 +0200 X-Gmail-Original-Message-ID: X-Gm-Features: AVHnY4JcK4gUqf7oJSLp2tu4AXxgOF73bWcf1aLSxW-d3rwdHCgZ6C6G2pd0F2s Message-ID: Subject: Re: nginx-1.30.2_2,3 wrongly vulnerable to CVE-2026-9256 ? To: Martin Simmons , Jochen Neumeister Cc: Arnaud de Prelle , freebsd-security@freebsd.org Content-Type: multipart/alternative; boundary="0000000000009ff0520653373b3c" X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[]; TAGGED_FROM(0.00)[]; ASN(0.00)[asn:15169, ipnet:209.85.128.0/17, country:US] X-Rspamd-Queue-Id: 4gTm9g1jJLz3V3j X-Spamd-Bar: ---- X-Rspamd-Pre-Result: action=no action; module=replies; Message is reply to one we originated --0000000000009ff0520653373b3c Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Including joneum@ who maintains the port. On Mon, Jun 1, 2026 at 2:26=E2=80=AFPM Martin Simmons wrote: > [fernape@ added] > > >>>>> On Sun, 31 May 2026 22:01:11 +0200, Arnaud de Prelle said: > > > > Hi, > > > > As per > > - https://www.freshports.org/www/nginx/ and > > - > > > https://vuxml.freebsd.org/freebsd/36a3131d-5600-11f1-b339-3497f65b111b.ht= ml > > CVE-2026-9256 should be fixed since nginx 1.30.2,3. > > The contents of this URL was stale -- the VuXML now says nginx < 1.31.1,3 > (since yesterday), which explains why pkg audit is detecting it. > > > I'm using the latest version of nginx: > > # pkg info nginx | grep Version > > Version : 1.30.2_2,3 > > > > But pkg audit -F reports this port as vulnerable to CVE-2026-9256: > > # pkg audit -F > > vulnxml file up-to-date > > nginx-1.30.2_2,3 is vulnerable: > > nginx -- heap buffer overflow in ngx_http_rewrite_module > > CVE: CVE-2026-9256 > > WWW: > > > https://vuxml.FreeBSD.org/freebsd/36a3131d-5600-11f1-b339-3497f65b111b.ht= ml > > > > Am I missing something ? > > The VuXML looks wrong to me now. > > nginx released both 1.30.2 and 1.31.1 to fix this CVE > (https://nginx.org/en/CHANGES-1.30 and https://nginx.org/en/CHANGES). > > __Martin > --0000000000009ff0520653373b3c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Including joneum@ who maintains the port.

On Mon, Jun 1, 2026 at 2:26=E2=80=AFPM Martin Simmons <martin@lispworks.com> wrote:
[fernape@ added]

>>>>> On Sun, 31 May 2026 22:01:11 +0200, Arnaud de Prelle s= aid:
>
> Hi,
>
> As per
> - https://www.freshports.org/www/nginx/ and
> -
> https://vuxml.freebs= d.org/freebsd/36a3131d-5600-11f1-b339-3497f65b111b.html
> CVE-2026-9256 should be fixed since nginx 1.30.2,3.

The contents of this URL was stale -- the VuXML now says nginx < 1.31.1,= 3
(since yesterday), which explains why pkg audit is detecting it.

> I'm using the latest version of nginx:
> # pkg info nginx | grep Version
> Version=C2=A0 =C2=A0 =C2=A0 =C2=A0 : 1.30.2_2,3
>
> But pkg audit -F reports this port as vulnerable to CVE-2026-9256:
> # pkg audit -F
> vulnxml file up-to-date
> nginx-1.30.2_2,3 is vulnerable:
>=C2=A0 =C2=A0 nginx -- heap buffer overflow in ngx_http_rewrite_module<= br> >=C2=A0 =C2=A0 CVE: CVE-2026-9256
>=C2=A0 =C2=A0 WWW:
> https://vuxml.FreeBS= D.org/freebsd/36a3131d-5600-11f1-b339-3497f65b111b.html
>
> Am I missing something ?

The VuXML looks wrong to me now.

nginx released both 1.30.2 and 1.31.1 to fix this CVE
(https://nginx.org/en/CHANGES-1.30 and https://nginx.org/en/= CHANGES).

__Martin
--0000000000009ff0520653373b3c-- From nobody Tue Jun 2 05:34:51 2026 X-Original-To: freebsd-security@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gV0764W3Fz6gx5g for ; Tue, 02 Jun 2026 05:41:06 +0000 (UTC) (envelope-from ish@ish.org) Received: from peach.ish.org (peach.ish.org [163.44.100.113]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "mail.ish.org", Issuer "R12" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gV0740nsDz3Xyf for ; Tue, 02 Jun 2026 05:41:03 +0000 (UTC) (envelope-from ish@ish.org) Authentication-Results: mx1.freebsd.org; dkim=pass header.d=ish.org header.s=54d26185-a057-8857-582c-09c040ed7013 header.b=Zaty5dV8; dmarc=pass (policy=reject) header.from=ish.org; spf=pass (mx1.freebsd.org: domain of ish@ish.org designates 163.44.100.113 as permitted sender) smtp.mailfrom=ish@ish.org Received: from mango.ish.org (mango.ish.org [IPv6:2400:4050:9d20:2c00:0:0:0:11]) (authenticated bits=0) by peach.ish.org (8.18.2/8.18.2) with ESMTPSA id 6525eoGp001211 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NO) for ; Tue, 2 Jun 2026 14:40:53 +0900 (JST) (envelope-from ish@ish.org) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=ish.org; s=54d26185-a057-8857-582c-09c040ed7013; t=1780378853; bh=BgC1ziN4etGm/jaJC/yCq6vy8SqTOcEQhXHWBm7+pIc=; h=Date:To:Subject:From:In-Reply-To:References; b=Zaty5dV8ucOh/XdTHnR/D23Y6fWufFEMN0YaguTABtraqH/JRZT05FaEYqV26UiF/ UmplaFY7DEVPYCuwywHIFHQdaYqmqjvsA7mo7NhZ3yLoylgby+DemJzLD4Ak4Evmmy vcLLxBabkZJO2wvCNMLJMcHFNOtzT9EiHVVJY1eg= Date: Tue, 02 Jun 2026 14:34:51 +0900 (JST) Message-Id: <20260602.143451.2150003014644123489.ish@ish.org> To: freebsd-security@freebsd.org Subject: Re: Why xorg-server-21.1.22,1 is vulnerable From: Masachika ISHIZUKA In-Reply-To: <202606011447.651ElC4B019060@higson.cam.lispworks.com> References: <20260531.142551.167441309236637198.ish@ish.org> <202606011447.651ElC4B019060@higson.cam.lispworks.com> X-Mailer: Mew version 6.11 on Emacs 30.2 List-Id: Security issues List-Archive: https://lists.freebsd.org/archives/freebsd-security List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-security@freebsd.org Sender: owner-freebsd-security@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.6.4 (peach.ish.org [IPv6:2400:8500:2002:3188:163:44:100:113]); Tue, 02 Jun 2026 14:40:53 +0900 (JST) X-Spamd-Result: default: False [-2.30 / 15.00]; MID_CONTAINS_FROM(1.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; NEURAL_HAM_LONG(-1.00)[-1.000]; NEURAL_HAM_SHORT(-1.00)[-0.999]; MV_CASE(0.50)[]; DMARC_POLICY_ALLOW(-0.50)[ish.org,reject]; ONCE_RECEIVED(0.20)[]; R_SPF_ALLOW(-0.20)[+mx]; R_DKIM_ALLOW(-0.20)[ish.org:s=54d26185-a057-8857-582c-09c040ed7013]; MIME_GOOD(-0.10)[text/plain]; RCVD_TLS_ALL(0.00)[]; RCPT_COUNT_ONE(0.00)[1]; ASN(0.00)[asn:58791, ipnet:163.44.100.0/24, country:JP]; MIME_TRACE(0.00)[0:+]; RCVD_COUNT_ONE(0.00)[1]; RCVD_VIA_SMTP_AUTH(0.00)[]; MLMMJ_DEST(0.00)[freebsd-security@freebsd.org]; PREVIOUSLY_DELIVERED(0.00)[freebsd-security@freebsd.org]; FROM_HAS_DN(0.00)[]; ARC_NA(0.00)[]; FROM_EQ_ENVFROM(0.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; TO_DN_NONE(0.00)[]; DKIM_TRACE(0.00)[ish.org:+] X-Spamd-Bar: -- X-Rspamd-Queue-Id: 4gV0740nsDz3Xyf >> # pkg audit -F >> vulnxml file up-to-date >> [snip] >> xorg-server-21.1.22,1 is vulnerable: >> xorg-server -- Multiple vulnerabilities >> CVE: CVE-2026-34003 >> CVE: CVE-2026-34002 >> CVE: CVE-2026-34001 >> CVE: CVE-2026-34000 >> CVE: CVE-2026-33999 >> WWW: https://vuxml.FreeBSD.org/freebsd/7b6463c6-3813-11f1-a284-589cfc10a551.html >> >> Is this true ? > > The VuxML for xorg-server looks wrong to me now. > > It says xorg-server < 21.1.22,2 but xorg-server is at epoch 1, not 2. Thank you. Vuxml has been updated and now displays correctly. # pkg audit -F [snip] xorg-server-21.1.22,1 is vulnerable: xorg-server -- Multiple vulnerabilities CVE: ZDI-CAN-30168 CVE: ZDI-CAN-30165 CVE: ZDI-CAN-30164 CVE: ZDI-CAN-30163 CVE: ZDI-CAN-30161 CVE: ZDI-CAN-30160 CVE: ZDI-CAN-30159 CVE: ZDI-CAN-30136 WWW: https://vuxml.FreeBSD.org/freebsd/592ced15-5e20-11f1-86a2-589cfc10a551.html -- Masachika ISHIZUKA From nobody Fri Jun 5 12:47:00 2026 X-Original-To: freebsd-security@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gX1RM2brZz6h1qk for ; Fri, 05 Jun 2026 12:47:11 +0000 (UTC) (envelope-from arnaud@pnzone.net) Received: from icecube.pnzone.net (icecube.pnzone.net [37.187.27.168]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4gX1RK6yQGz3FFH; Fri, 05 Jun 2026 12:47:09 +0000 (UTC) (envelope-from arnaud@pnzone.net) Authentication-Results: mx1.freebsd.org; dkim=pass header.d=pnzone.net header.s=dkimsel header.b=Vshhj6aW; dmarc=pass (policy=reject) header.from=pnzone.net; spf=pass (mx1.freebsd.org: domain of arnaud@pnzone.net designates 37.187.27.168 as permitted sender) smtp.mailfrom=arnaud@pnzone.net Received: from webmail.pnzone.net (localhost [IPv6:::1]) by icecube.pnzone.net (Postfix) with ESMTP id 2B558104646; Fri, 05 Jun 2026 14:47:00 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=pnzone.net; s=dkimsel; t=1780663620; bh=Wg5Ex2AntQCsr0H1QEFJQCjGvpfCy+kbEfrDHb8bPz0=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=Vshhj6aWZO2N7IQkG5Ib9fYpllj7h9jMi6XuRTgtTp6qPNp60GcBgPczaY5Futrfm qlcWHaEg5ZUm7+nnv0beXa/12z4QVRrLbpYYRYtcwALtLKDdTpmmWAvJ9o+REyLGPc hLl8Pbsyc2/lWfwBpGVjOeeUk7Q2/MAOGnGRXAgc= List-Id: Security issues List-Archive: https://lists.freebsd.org/archives/freebsd-security List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-security@freebsd.org Sender: owner-freebsd-security@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Date: Fri, 05 Jun 2026 14:47:00 +0200 From: Arnaud de Prelle To: =?UTF-8?Q?Fernando_Apestegu=C3=ADa?= Cc: Martin Simmons , Jochen Neumeister , freebsd-security@freebsd.org Subject: Re: nginx-1.30.2_2,3 wrongly vulnerable to CVE-2026-9256 ? In-Reply-To: References: <202606011426.651EQMeV018896@higson.cam.lispworks.com> Message-ID: X-Sender: arnaud@pnzone.net Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Virus-Scanned: clamav-milter 1.5.2 at icecube.pnzone.net X-Virus-Status: Clean X-Spamd-Result: default: False [-2.80 / 15.00]; NEURAL_HAM_LONG(-1.00)[-1.000]; SUBJECT_ENDS_QUESTION(1.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; NEURAL_HAM_SHORT(-1.00)[-0.999]; DMARC_POLICY_ALLOW(-0.50)[pnzone.net,reject]; ONCE_RECEIVED(0.20)[]; R_SPF_ALLOW(-0.20)[+ip4:37.187.27.168]; R_DKIM_ALLOW(-0.20)[pnzone.net:s=dkimsel]; MIME_GOOD(-0.10)[text/plain]; DKIM_TRACE(0.00)[pnzone.net:+]; RCPT_COUNT_THREE(0.00)[4]; FROM_HAS_DN(0.00)[]; ARC_NA(0.00)[]; RCVD_TLS_LAST(0.00)[]; MISSING_XM_UA(0.00)[]; ASN(0.00)[asn:16276, ipnet:37.187.0.0/16, country:FR]; MIME_TRACE(0.00)[0:+]; FROM_EQ_ENVFROM(0.00)[]; RCVD_COUNT_ONE(0.00)[1]; TO_MATCH_ENVRCPT_SOME(0.00)[]; MID_RHS_MATCH_FROM(0.00)[]; MLMMJ_DEST(0.00)[freebsd-security@freebsd.org]; TO_DN_SOME(0.00)[] X-Spamd-Bar: -- X-Rspamd-Queue-Id: 4gX1RK6yQGz3FFH Hi all, Thank you for your adaptations. Alert has now disappeared from pkg audit -F as the vuXML database now shows : 0.1.17,3 <= nginx < 1.30.2_2,3 1.31.0,3 <= nginx < 1.31.1,3 Kind regards, Arnaud. On 2026-06-01 22:42, Fernando Apesteguía wrote: > Including joneum@ who maintains the port. > > On Mon, Jun 1, 2026 at 2:26 PM Martin Simmons > wrote: > >> [fernape@ added] >> >> >>>>> On Sun, 31 May 2026 22:01:11 +0200, Arnaud de Prelle said: >> > >> > Hi, >> > >> > As per >> > - https://www.freshports.org/www/nginx/ and >> > - >> > >> https://vuxml.freebsd.org/freebsd/36a3131d-5600-11f1-b339-3497f65b111b.html >> > CVE-2026-9256 should be fixed since nginx 1.30.2,3. >> >> The contents of this URL was stale -- the VuXML now says nginx < >> 1.31.1,3 >> (since yesterday), which explains why pkg audit is detecting it. >> >> > I'm using the latest version of nginx: >> > # pkg info nginx | grep Version >> > Version : 1.30.2_2,3 >> > >> > But pkg audit -F reports this port as vulnerable to CVE-2026-9256: >> > # pkg audit -F >> > vulnxml file up-to-date >> > nginx-1.30.2_2,3 is vulnerable: >> > nginx -- heap buffer overflow in ngx_http_rewrite_module >> > CVE: CVE-2026-9256 >> > WWW: >> > >> https://vuxml.FreeBSD.org/freebsd/36a3131d-5600-11f1-b339-3497f65b111b.html >> > >> > Am I missing something ? >> >> The VuXML looks wrong to me now. >> >> nginx released both 1.30.2 and 1.31.1 to fix this CVE >> (https://nginx.org/en/CHANGES-1.30 and https://nginx.org/en/CHANGES). >> >> __Martin >> From nobody Fri Jun 5 13:35:18 2026 X-Original-To: freebsd-security@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gX2W91t2xz6h4lC for ; Fri, 05 Jun 2026 13:35:33 +0000 (UTC) (envelope-from fernando.apesteguia@gmail.com) Received: from mail-ot1-f45.google.com (mail-ot1-f45.google.com [209.85.210.45]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "WR4" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gX2W86Spwz3NTL for ; Fri, 05 Jun 2026 13:35:32 +0000 (UTC) (envelope-from fernando.apesteguia@gmail.com) Authentication-Results: mx1.freebsd.org; none Received: by mail-ot1-f45.google.com with SMTP id 46e09a7af769-7e6b5c374e5so2050845a34.0 for ; Fri, 05 Jun 2026 06:35:32 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780666531; x=1781271331; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=+WvDAKYD/jH/IZg7vXZC7KkUrI1uZv4yyOH9gSZlHZE=; b=anwpsUykcqpSAPlUfKnLCXPk6vb1aNHO/rF474buTD1nYoQybU83LbBHc5fKqEvTVs Lk65eUoxbrhTR06O7AUFecu1zUCerx1/6JbaDeU4IfzyoCe7gi4MIvY7Jl5RihtHa4Uk 2aEkejwnXvlaROTddE1AD4sxWB5mQy6bJCEzOkFFbEBUjNAPXLB7A+DeTbIwgFnJgYEY PbEQx2YmMKdWcc3wUDkbWd766jzE4o75+3DqqDyeacC2Tc3O4WiTHcFP81277hwOJTUA Ch0SkI2ZMV5lYSRWLcawY8XHzKaFneDBzPPi1H7OgNJ6otP5zgY/UiNYRaADcrz2MyoO BmyQ== X-Forwarded-Encrypted: i=1; AFNElJ8N+li5Q5tv/BVw8X4g8QHuIn9Bm/Keurc36FbclM1IMLsESIsdvEfDGKkArXIZpv+vOI6SATvy0HFCLwzHvKBv@freebsd.org X-Gm-Message-State: AOJu0YzO6JskHO+wr5LGTpDU1kMkqVIUjMsPAacVZq6CQZlnKsEgdRp5 UAXta08RUUha98TcC8hWpYbZLAu8OcyyDGHrJ6cxGigBOTH/PbknVf2aLZZQeoam X-Gm-Gg: Acq92OHzfyDxqF2JzHabr3jCUngRVQFZ1IezJ15gt0qimpRZmTIGbgSx5deHVF+BxfX 131d0RyRVjrfley6KP+REB2sy0UbDF7tesWs4aN9oYOvvR1MQXE5cRMt8+5LiRbY4gxFi3f9qwO 1+WmLXb1Wa1N18euIhUpVHe1tZtwNOHxib4BeD7uFbd5iXrBF7GOIyUrcT+8IDX+5mAAfUlazKl 4MACuRj5dbqQ8cYVljP3PGMOBpfMB4gu3660fciF8+JafElX73+Ci5JgSfw5eLKfGfB/HEpW6iE QktmvL7BDkRWboWj8HZTKNXhbFKJacrUV5Ou3P3CtZPxVqHnOsqU+ukxjZIoyBr6fj3oqkDd+rR iE8Zl6vH+s34wlWkfZsCF8R4IekhuzaCKT4tx+TMOarRC7pL+GX4a97HX9YX3Udg5KW9pK9nadU L2+hDhJXyJ1bKujS9up7ixaka1O3iUMWEH8Q7Okrzel/Iv5BiGq+IEw7AB8LyuWTNWnJEDMTXub krAff0QV+k5f17N8EE2sf5y0hFUTg== X-Received: by 2002:a05:6830:829b:b0:7dc:d7e5:8d43 with SMTP id 46e09a7af769-7e70f23c203mr1302778a34.2.1780666531381; Fri, 05 Jun 2026 06:35:31 -0700 (PDT) Received: from mail-ot1-f43.google.com (mail-ot1-f43.google.com. [209.85.210.43]) by smtp.gmail.com with ESMTPSA id 46e09a7af769-7e6e75b2017sm5629210a34.8.2026.06.05.06.35.30 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 05 Jun 2026 06:35:31 -0700 (PDT) Received: by mail-ot1-f43.google.com with SMTP id 46e09a7af769-7e6b5c374e5so2050823a34.0 for ; Fri, 05 Jun 2026 06:35:30 -0700 (PDT) X-Forwarded-Encrypted: i=1; AFNElJ86Lli2hopKdNW5iAe+rjRSdjcLc51MmOEm0vNz64EEnIwrsIkSjmQI5DdRewnMYYnpYup/1IFtofYHeTAvc9J1@freebsd.org X-Received: by 2002:a05:6820:2903:b0:696:8cb7:3167 with SMTP id 006d021491bc7-69e6d3866b0mr941848eaf.14.1780666530704; Fri, 05 Jun 2026 06:35:30 -0700 (PDT) List-Id: Security issues List-Archive: https://lists.freebsd.org/archives/freebsd-security List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-security@freebsd.org Sender: owner-freebsd-security@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 References: <202606011426.651EQMeV018896@higson.cam.lispworks.com> In-Reply-To: From: =?UTF-8?Q?Fernando_Apestegu=C3=ADa?= Date: Fri, 5 Jun 2026 15:35:18 +0200 X-Gmail-Original-Message-ID: X-Gm-Features: AVHnY4LzV1TqWi_5eGYQZb7LuCALUvL5xPTTR9CJDPjo5q4s5uhNG5i4xlVcXnc Message-ID: Subject: Re: nginx-1.30.2_2,3 wrongly vulnerable to CVE-2026-9256 ? To: Arnaud de Prelle Cc: Martin Simmons , Jochen Neumeister , freebsd-security@freebsd.org Content-Type: multipart/alternative; boundary="00000000000006b5f7065381bc37" X-Spamd-Result: default: False [-4.00 / 15.00]; REPLY(-4.00)[]; TAGGED_FROM(0.00)[]; ASN(0.00)[asn:15169, ipnet:209.85.128.0/17, country:US] X-Rspamd-Queue-Id: 4gX2W86Spwz3NTL X-Spamd-Bar: ---- X-Rspamd-Pre-Result: action=no action; module=replies; Message is reply to one we originated --00000000000006b5f7065381bc37 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable El vie, 5 jun 2026, 14:47, Arnaud de Prelle escribi=C3= =B3: > Hi all, > > Thank you for your adaptations. > > Alert has now disappeared from pkg audit -F as the vuXML database now > shows : > 0.1.17,3 <=3D nginx < 1.30.2_2,3 > 1.31.0,3 <=3D nginx < 1.31.1,3 > > Kind regards, > Arnaud. > Thank you all for reporting and sorry for the mistake. > On 2026-06-01 22:42, Fernando Apestegu=C3=ADa wrote: > > Including joneum@ who maintains the port. > > > > On Mon, Jun 1, 2026 at 2:26=E2=80=AFPM Martin Simmons > > wrote: > > > >> [fernape@ added] > >> > >> >>>>> On Sun, 31 May 2026 22:01:11 +0200, Arnaud de Prelle said: > >> > > >> > Hi, > >> > > >> > As per > >> > - https://www.freshports.org/www/nginx/ and > >> > - > >> > > >> > https://vuxml.freebsd.org/freebsd/36a3131d-5600-11f1-b339-3497f65b111b.ht= ml > >> > CVE-2026-9256 should be fixed since nginx 1.30.2,3. > >> > >> The contents of this URL was stale -- the VuXML now says nginx < > >> 1.31.1,3 > >> (since yesterday), which explains why pkg audit is detecting it. > >> > >> > I'm using the latest version of nginx: > >> > # pkg info nginx | grep Version > >> > Version : 1.30.2_2,3 > >> > > >> > But pkg audit -F reports this port as vulnerable to CVE-2026-9256: > >> > # pkg audit -F > >> > vulnxml file up-to-date > >> > nginx-1.30.2_2,3 is vulnerable: > >> > nginx -- heap buffer overflow in ngx_http_rewrite_module > >> > CVE: CVE-2026-9256 > >> > WWW: > >> > > >> > https://vuxml.FreeBSD.org/freebsd/36a3131d-5600-11f1-b339-3497f65b111b.ht= ml > >> > > >> > Am I missing something ? > >> > >> The VuXML looks wrong to me now. > >> > >> nginx released both 1.30.2 and 1.31.1 to fix this CVE > >> (https://nginx.org/en/CHANGES-1.30 and https://nginx.org/en/CHANGES). > >> > >> __Martin > >> > --00000000000006b5f7065381bc37 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


El vie, 5 jun 2026, 14:47, Arnau= d de Prelle <arnaud@pnzone.net&= gt; escribi=C3=B3:
Hi all,

Thank you for your adaptations.

Alert has now disappeared from pkg audit -F as the vuXML database now
shows :
0.1.17,3=C2=A0 =C2=A0 =C2=A0 =C2=A0 <=3D=C2=A0 =C2=A0 =C2=A0 nginx=C2=A0= =C2=A0<=C2=A0 =C2=A0 =C2=A0 =C2=A01.30.2_2,3
1.31.0,3=C2=A0 =C2=A0 =C2=A0 =C2=A0 <=3D=C2=A0 =C2=A0 =C2=A0 nginx=C2=A0= =C2=A0<=C2=A0 =C2=A0 =C2=A0 =C2=A01.31.1,3

Kind regards,
Arnaud.

Thank you all for reporting and sorry for the mistake.


On 2026-06-01 22:42, Fernando Apestegu=C3=ADa wrote:
> Including joneum@ who maintains the port.
>
> On Mon, Jun 1, 2026 at 2:26=E2=80=AFPM Martin Simmons <martin@lis= pworks.com>
> wrote:
>
>> [fernape@ added]
>>
>> >>>>> On Sun, 31 May 2026 22:01:11 +0200, Arnaud de= Prelle said:
>> >
>> > Hi,
>> >
>> > As per
>> > - https://www.freshports.org/www/nginx= / and
>> > -
>> >
>> https= ://vuxml.freebsd.org/freebsd/36a3131d-5600-11f1-b339-3497f65b111b.html<= br> >> > CVE-2026-9256 should be fixed since nginx 1.30.2,3.
>>
>> The contents of this URL was stale -- the VuXML now says nginx <= ;
>> 1.31.1,3
>> (since yesterday), which explains why pkg audit is detecting it. >>
>> > I'm using the latest version of nginx:
>> > # pkg info nginx | grep Version
>> > Version=C2=A0 =C2=A0 =C2=A0 =C2=A0 : 1.30.2_2,3
>> >
>> > But pkg audit -F reports this port as vulnerable to CVE-2026-= 9256:
>> > # pkg audit -F
>> > vulnxml file up-to-date
>> > nginx-1.30.2_2,3 is vulnerable:
>> >=C2=A0 =C2=A0 nginx -- heap buffer overflow in ngx_http_rewrit= e_module
>> >=C2=A0 =C2=A0 CVE: CVE-2026-9256
>> >=C2=A0 =C2=A0 WWW:
>> >
>> https= ://vuxml.FreeBSD.org/freebsd/36a3131d-5600-11f1-b339-3497f65b111b.html<= br> >> >
>> > Am I missing something ?
>>
>> The VuXML looks wrong to me now.
>>
>> nginx released both 1.30.2 and 1.31.1 to fix this CVE
>> (https://nginx.org/en/CHANGES-1.30 and https://nginx.org/en/CHANGES).
>>
>> __Martin
>>
--00000000000006b5f7065381bc37--