[master] Release 2 - #13442

Merged

maskit merged 150 commits into

apache:masterfrom

maskit:sec-2026-2-master

Jul 28, 2026

Commits on Jul 28, 2026

Replace VLA with heap allocation in cachekey appendEncoded

cmcfarlen
authored and
maskit
committed
f910eed
Guard against size_t overflow in appendEncoded buffer sizing

cmcfarlen
authored and
maskit
committed
79d2d8d
Use ts::LocalBuffer instead of std::vector in appendEncoded

cmcfarlen
authored and
maskit
committed
48e967d
Fix SNI/hostname comparison to check full string length
maskit
committed
12f9ba5
Close connection if unneccesary H2 SETTINGS frame arrives
maskit
committed
6375409
Reject Transfer-Encoding in HTTP/2 and HTTP/3 headers
maskit
committed
eca51e9
Reject Transfer-Encoding where chunked is not the final coding
maskit
committed
24e04b7
Fix out-of-bounds write in MIME obs-fold handling
maskit
committed
f4561a9
Enforce per-field size limit in HPACK/QPACK string decoding
maskit
committed
4782ee1
regex_remap: Issue 46 - Overflow in url_len Leads to Stack Overflow

zwoop
authored and
maskit
committed
6b5d7ce
Also address issue #48

zwoop
authored and
maskit
committed
f994194
Reject oversized HPACK indexes

authored and
maskit
committed
4b971b5
Enforce 16-bit srv_offset invariant in HostDBInfo::assign

cmcfarlen
authored and
maskit
committed
1096563
Document valid range for round_robin_max_count

cmcfarlen
authored and
maskit
committed
c45594f
Replace VLAs with ts::LocalBuffer in HostDB SRV handling

cmcfarlen
authored and
maskit
committed
8875ab4
Fix OOB read in H2 get_received_frame_count

cmcfarlen
authored and
maskit
committed
2188276
Add bounds checks to DNS answer parsing before NS_GET macros

cmcfarlen
authored and
maskit
committed
d9bed82
cripts: Issue 31 - UB array write in remap instance initialization

zwoop
authored and
maskit
committed
1283b37
cripts: Issue 32 - Fix path traversal in File::Path::Rebase

zwoop
authored and
maskit
committed
6068623
Fix integer overflow in MIME header parsing

moonchen
authored and
maskit
committed
422b978
Fix inverted condition for nonstandard method matching in ACL filtering

authored and
maskit
committed
0e8272d
Bound status code parsing to prevent integer overflow

authored and
maskit
committed
e8d92a5
Avoid stack VLA in log filter wiping

bneradt
authored and
maskit
committed
f733942
Avoid stack VLA in proxy protocol parsing

bneradt
authored and
maskit
committed
416e5b1
Validate PROXY v1 port bounds

bneradt
authored and
maskit
committed
94255c1
Guard txn_box stack allocations

bneradt
authored and
maskit
committed
1960c44
Limit CONNECT body preclusion to successful responses

cmcfarlen
authored and
maskit
committed
554867f
libswoc: Validate IPv6 hextet bounds

bneradt
authored and
maskit
committed
e4bb476
Reject overflowing XPACK integers

bneradt
authored and
maskit
committed
292679e
Bound outstanding HTTP/2 SETTINGS

bneradt
authored and
maskit
committed
d4775d1
Fix inverted condition in SNI_IpAllow::TestClientSNIAction

authored and
maskit
committed
2f196aa
Fix max_settings_per_minute condition

bneradt
authored and
maskit
committed
7439e70
Update autest for SNI_IpAllow::TestClientSNIAction #188 changes

authored and
maskit
committed
33b22d5
http2: Add tests for CRLF rejection in H2 header values

zwoop
authored and
maskit
committed
7ac47c2
Fix format issue in http2_crlf_header_validation

bneradt
authored and
maskit
committed
8a63f28
rate_limit: Issue 106 - Fix queue bypass

zwoop
authored and
maskit
committed
508c1be
rate_limit: Issue 108 - Fix ip-rep UB writes

zwoop
authored and
maskit
committed
b3fa9f1
compress: stop gzip transform after deflate() error

bryancall
authored and
maskit
committed
d2b51c3
Fix leaks of POST failures

masaori335
authored and
maskit
committed
a25b841
Add nullptr check before calling SSL_shutdown

masaori335
authored and
maskit
committed
1675a79
Fix length check of MethodMod:check

masaori335
authored and
maskit
committed
8102a6b
iocore: tighten IOBuffer and AIO bounds checks

brbzull0
authored and
maskit
committed
00dbca8
stream_editor: allocate rules in contdata_t ctor

brbzull0
authored and
maskit
committed
c4f25db
tscpp: hold intercept try-lock guard via shared mutex

brbzull0
authored and
maskit
committed
2eefa5d
URL: reject parsed ports outside uint16 range

brbzull0
authored and
maskit
committed
276d050
access_control: cap stack buffer for cookie base64 decode

brbzull0
authored and
maskit
committed
70b577c
rate_limit: Fix active counter underflow

zwoop
authored and
maskit
committed
7c0dfb0
Constrain prefetch relative paths

bneradt
authored and
maskit
committed
71d40c1
Server Session: Make sure read_buffer is empty before pooling a server session

masaori335
authored and
maskit
committed
3414bd0
Keep OCSP map on init failure

bneradt
authored and
maskit
committed
6a4ecda
Return evacuation bucket by reference not by value

cmcfarlen
authored and
maskit
committed
d8418bc
Handle addressless PROXY headers in TLS

bneradt
authored and
maskit
committed
2ce51ba
Guard outbound server_name SNI policy

bneradt
authored and
maskit
committed
8a908a5
Verify H2 origin certs on session reuse

bneradt
authored and
maskit
committed
45b1b89
TLSSNISupport: own outbound_sni_policy bytes across config reload

authored and
maskit
committed
b791895
Avoid signed tolower for name bytes

bneradt
authored and
maskit
committed
3cf6f23
Reject oversized multiplexer chunks

bneradt
authored and
maskit
committed
af6a8ce
Keep loop detection on outbound-transparent ports

cmcfarlen
authored and
maskit
committed
19afc73
Set default value of proxy.config.http2.default_buffer_water_mark to 32KB

masaori335
authored and
maskit
committed
3ac822d
Avoid UB when URL part is absent in URLImpl getters

cmcfarlen
authored and
maskit
committed
888fb43
HTTPHdr: fix use-after-free in destroy() leaving dangling m_http

authored and
maskit
committed
e8a732f
ESI: cap HTTP request length to prevent size_t overflow

authored and
maskit
committed
a4b8f1b
Invoke Continuation operator bool, not pointer-to-bool

cmcfarlen
authored and
maskit
committed
efb5cd1
Prevent unbounded recursion in host-down Range fallback

cmcfarlen
authored and
maskit
committed
fae88bb
Add uds-perm/uds-user/uds-group port options
maskit
committed
244e7ed
Fix ChunkHandler Flow Control

authored and
maskit
committed
f75672e
Fix FetchSM header block copying

bneradt
authored and
maskit
committed
6a8c575
Gate H2 reads during async hooks

bneradt
authored and
maskit
committed
2e45ff0
background_fetch: fix inverted size operator and broken value wildcard

authored and
maskit
committed
ca783e5
Fix an integer overflow in HdrHeap

moonchen
authored and
maskit
committed
485f241
lua: Add checks on server request hdr

shukitchan
authored and
maskit
committed
58c5130
Regex: add RE_FULL_MATCH flag, fix SNI partial-match policy bypass

authored and
maskit
committed
92693e8
Combo handler: Reject empty Content-Type when allowlist is configured

authored and
maskit
committed
9da372d
Fix race in remap table refcount during reload

authored and
maskit
committed
709443e
ESI: bound for nested esi html comment

authored and
maskit
committed
ee78b0a
ja3_fingerprint: tighten encode_word_buffer bounds

masaori335
authored and
maskit
committed
6a0e83d
Use ParseRules::is_digit on raw network bytes in HTTP parser

cmcfarlen
authored and
maskit
committed
de6efd2
header_rewrite: Copy set-body-from response body with memcpy

cmcfarlen
authored and
maskit
committed
48fb554
Cap stale_response SIE buffering

bneradt
authored and
maskit
committed
e92923f
Guard parent mark-down on UNAVAILABLE_SERVER retry

cmcfarlen
authored and
maskit
committed
0a1342e
xdebug: Cap X-Remap header length to actual buffer content

cmcfarlen
authored and
maskit
committed
def5585
DNS: fix TCP length-prefix read under edge-triggered epoll

authored and
maskit
committed
a7e78ad
Add admin-guide reference for writing secure regex rules

authored and
maskit
committed
c47966a
combo_handler.test.py: Fix empty type test output

bneradt
authored and
maskit
committed
45c18fc
test_proxy: Fix macOS link duplicates after FetchSM test was added

cmcfarlen
authored and
maskit
committed
6916a91
Fixes HRW bridge issues, adds autests to Cripts

zwoop
authored and
maskit
committed
d8f7412
cripts: Fix undersized sockaddr in Geo IP lookup

zwoop
authored and
maskit
committed
fb3e2b7
cripts: fix use-after-free in TSRemapDoRemap

zwoop
authored and
maskit
committed
afc8633
cripts: Fix abort on duplicate query keys

zwoop
authored and
maskit
committed
904beee
header_rewrite: Fix cookie key over-read

zwoop
authored and
maskit
committed
387fcb9
doc: cover uri_signing cdniuc uri-regex in regex best practices

ezelkow1
authored and
maskit
committed
0ca59c0
Preserve dynamic-port flag across tunnel_route mapping ops
maskit
committed
92938c9
HttpTunnel: Guard get_producer(VIO*) against dead producers
maskit
committed
6cdadb2
ts_lua: clear rri pointer in http_ctx after remap returns

ezelkow1
authored and
maskit
committed
c183dc4
ts_lua: use sockaddr_storage for ts_lua_fetch client address

ezelkow1
authored and
maskit
committed
4c60f2c
header_rewrite: Guard SESSION/STATE access on null handle

zwoop
authored and
maskit
committed
20e47be
cripts: Fix global Client::URL MLoc leak

zwoop
authored and
maskit
committed
fc4eeea
cripts: Fix Bundle::Headers server-side header removal

zwoop
authored and
maskit
committed
7606346
slice: Check for Integer underflow in firstblockbytes

traeak
authored and
maskit
committed
4cb4f01
ParentSelection: increase size of mapWrapped array for compat with strategies

traeak
authored and
maskit
committed
a9556e0
lua: Invalidate cached main_ctx when slot is outside instance's range

authored and
maskit
committed
29caef3
DNS: Run HostEnt destructor on free to release SRV vector heap

authored and
maskit
committed
1aae279
HttpSM: Stop tracking the fire-and-forget cache-delete Action

cmcfarlen
authored and
maskit
committed
c2231aa
lua: Free transform context when client-hook VConn closes

cmcfarlen
authored and
maskit
committed
704a2b1
NextHopRoundRobin: update ring size for wrapping when switching rings

traeak
authored and
maskit
committed
5d5e7db
certifier: Reject unsafe SNI names

bneradt
authored and
maskit
committed
c780397
Drop H2 origin trailers for H1 clients

bneradt
authored and
maskit
committed
2648dd9
http2: Reject CONTINUATION accumulation that overflows header_blocks_length

bryancall
authored and
maskit
committed
17d6c19
Honor number_of_redirections for plugin-initiated redirects

bryancall
authored and
maskit
committed
ab84929
cache_range_requests: use std::string spill buffer for building override cachekey

traeak
authored and
maskit
committed
6f607cf
Reject header fields exceeding the uint16 field-length limit

bryancall
authored and
maskit
committed
5b65055
webp_transform: bound buffered body and ImageMagick decode

bryancall
authored and
maskit
committed
b4a40d1
header_rewrite: Fix IPv6 CIDR masking for non-aligned prefixes

cmcfarlen
authored and
maskit
committed
f1d8af5
Implement SSRF validation for ESI include URLs

authored and
maskit
committed
601b548
SSLNetVConnection: deregister async handshake eventfd on connection teardown

bryancall
authored and
maskit
committed
06a1eb4
Strip Connection-listed headers per RFC 9110 §7.6.1

alficles
authored and
maskit
committed
8faf93d
Test H2 control-character rejection

bneradt
authored and
maskit
committed
3b74fe4
http2: Defer HPACK dynamic-table updates until encoding succeeds
maskit
committed
8a0da3a
authproxy: Don't assert on auth response with no header fields
maskit
committed
bb30f67
mgmt/rpc: create JSONRPC unix socket with intended mode atomically

brbzull0
authored and
maskit
committed
b2d5f34
cache: Move openReadStartEarliest recursion counter off CacheVC to fix UAF

bryancall
authored and
maskit
committed
6cec6fc
Bound host header buffer

authored and
maskit
committed
b0a4e43
uri_signing: replace stack arrays with LocalBuffer

alficles
authored and
maskit
committed
3a93693
http: reject chunked extension quoted-string values containing CR or LF

bryancall
authored and
maskit
committed
4020aa9
ip_allow: add default CONNECT destination rules

bneradt
authored and
maskit
committed
67286ef
Guard against missing delimiter in url_sig C= parameter

alficles
authored and
maskit
committed
6451527
master: Strip external @ headers before plugin hooks

bneradt
authored and
maskit
committed
4ab63db
Fix: cancel stale TLS accept timeouts so session acceptors don't abort

moonchen
authored and
maskit
committed
1eb2e7b
regex_map: anchor host matching to the full hostname

bryancall
authored and
maskit
committed
a074ce5
Invalidate dns_info.addr when claiming resolved without DNS

cmcfarlen
authored and
maskit
committed
f474ebb
PendingAction: Don't let CAS failure overwrite the caller's action

cmcfarlen
authored and
maskit
committed
8441511
parent_selection: Cap retries to one per window via failedAt CAS

authored and
maskit
committed
df60315
compress: Wrap isspace so obs-text Content-Type bytes don't trigger UB

cmcfarlen
authored and
maskit
committed
ff6992b
Expand URI normalization test coverage for userinfo handling

alficles
authored and
maskit
committed
810355d
Guard remap against shutdown table teardown

bneradt
authored and
maskit
committed
0257fc3
Revert "Guard remap against shutdown table teardown"

bneradt
authored and
maskit
committed
258cf64
Guard remap against shutdown table teardown

bneradt
authored and
maskit
committed
5119d93
http: reject a bare LF chunked trailer terminator under strict parsing

bryancall
authored and
maskit
committed
043fb22
Combo handler: Refactor Cache-Control parsing and update gold test

authored and
maskit
committed
7d0b435
Fix null-deref in error_log_connection_failure for a DOWN host
maskit
committed
42d1991
Fix tls_engine_abort autest referencing removed async_engine plugin
maskit
committed
867f2b5
Fix header_rewrite_bundle cookie rules matching the wrong path
maskit
committed
7e22656
http: drain request body on internally generated cache responses

authored and
maskit
committed
337816b
Fix chunked passthrough flow-control deadlock (drop_chunked_trailers=0)

masaori335
authored and
maskit
committed
3dca68b
webp_transform: fix decode_limit test to send a matching signature
maskit
committed
5224ac1
Regex: preserve RE_ENDANCHORED semantics on PCRE2 < 10.30

cmcfarlen
authored and
maskit
committed
b275158
esi: drop tsutil from esicore link deps to avoid plugin ODR

cmcfarlen
authored and
maskit
committed
9118cc8
esi: add <sys/socket.h> for AF_INET/AF_INET6 in IncludeUrlValidator

cmcfarlen
authored and
maskit
committed
b395a08
esi: guard optarg null before setHostAllowRegex to satisfy clang analyzer

cmcfarlen
authored and
maskit
committed
c611f80
connect_destination_acl: accept curl exit 7 for a refused CONNECT
maskit
committed
e7051e1