#2043·tengine

大佬们,什么时候升级一下Tengine 的 nginx 内核到 1.30.2 版本,修复 CVE-2026-42945 的 nginx 漏洞?

作者: dingzt创建于 2026年6月5日更新于 2026年8月1日

NGINX contains a remote code execution vulnerability (CVE-2026-42945). The vulnerability exists in the ngx_http_rewrite_module module of NGINX. When the rewrite directive is followed by the rewrite, if, or set directive in the configuration, and an unnamed PCRE (Perl-compatible regular expression) capture group with a question mark is used, the vulnerability is triggered. Unauthenticated attackers can exploit this vulnerability by sending a crafted malicious HTTP request. Successful exploitation will cause a NGINX worker process heap buffer overflow, resulting in a denial of service. If the target system has disabled address space layout randomization (ASLR), the attacker may also achieve remote code execution. This vulnerability only affects the data plane and does not expose the control plane.

内容来源: alibaba/tengine