Backport Release 2 security bundle (#13442) to 10.2.x - #13452

Merged

cmcfarlen merged 150 commits into

apache:10.2.xfrom

cmcfarlen:10.2.x-release2-sec

Jul 30, 2026

Commits on Jul 29, 2026

Replace VLA with heap allocation in cachekey appendEncoded
cmcfarlen
committed
5441adf
Guard against size_t overflow in appendEncoded buffer sizing
cmcfarlen
committed
faf0b45
Use ts::LocalBuffer instead of std::vector in appendEncoded
cmcfarlen
committed
aa8dea0
Fix SNI/hostname comparison to check full string length

maskit
authored and
cmcfarlen
committed
40eeb5f
Close connection if unneccesary H2 SETTINGS frame arrives

maskit
authored and
cmcfarlen
committed
09f15c3
Reject Transfer-Encoding in HTTP/2 and HTTP/3 headers

maskit
authored and
cmcfarlen
committed
2d72f26
Reject Transfer-Encoding where chunked is not the final coding

maskit
authored and
cmcfarlen
committed
490dd09
Fix out-of-bounds write in MIME obs-fold handling

maskit
authored and
cmcfarlen
committed
d639cb8
Enforce per-field size limit in HPACK/QPACK string decoding

maskit
authored and
cmcfarlen
committed
81b4fa0
regex_remap: Issue 46 - Overflow in url_len Leads to Stack Overflow

zwoop
authored and
cmcfarlen
committed
af4958f
Also address issue #48

zwoop
authored and
cmcfarlen
committed
5d86357
Reject oversized HPACK indexes

authored and
cmcfarlen
committed
222d33c
Enforce 16-bit srv_offset invariant in HostDBInfo::assign
cmcfarlen
committed
eb1a3e9
Document valid range for round_robin_max_count
cmcfarlen
committed
dcfcb1a
Replace VLAs with ts::LocalBuffer in HostDB SRV handling
cmcfarlen
committed
f0185e0
Fix OOB read in H2 get_received_frame_count
cmcfarlen
committed
68370d9
Add bounds checks to DNS answer parsing before NS_GET macros
cmcfarlen
committed
26ea550
cripts: Issue 31 - UB array write in remap instance initialization

zwoop
authored and
cmcfarlen
committed
c94a570
cripts: Issue 32 - Fix path traversal in File::Path::Rebase

zwoop
authored and
cmcfarlen
committed
47bcf56
Fix integer overflow in MIME header parsing

moonchen
authored and
cmcfarlen
committed
229f0b4
Fix inverted condition for nonstandard method matching in ACL filtering

authored and
cmcfarlen
committed
3622d3d
Bound status code parsing to prevent integer overflow

authored and
cmcfarlen
committed
0a9b3a3
Avoid stack VLA in log filter wiping

bneradt
authored and
cmcfarlen
committed
7f5d62b
Avoid stack VLA in proxy protocol parsing

bneradt
authored and
cmcfarlen
committed
ed3db26
Validate PROXY v1 port bounds

bneradt
authored and
cmcfarlen
committed
5e87e83
Guard txn_box stack allocations

bneradt
authored and
cmcfarlen
committed
87f5053
Limit CONNECT body preclusion to successful responses
cmcfarlen
committed
d6edf35
libswoc: Validate IPv6 hextet bounds

bneradt
authored and
cmcfarlen
committed
a14f75b
Reject overflowing XPACK integers

bneradt
authored and
cmcfarlen
committed
ffdad86
Bound outstanding HTTP/2 SETTINGS

bneradt
authored and
cmcfarlen
committed
77c507a
Fix inverted condition in SNI_IpAllow::TestClientSNIAction

authored and
cmcfarlen
committed
523df9a
Fix max_settings_per_minute condition

bneradt
authored and
cmcfarlen
committed
4eccff0
Update autest for SNI_IpAllow::TestClientSNIAction #188 changes

authored and
cmcfarlen
committed
18d6570
http2: Add tests for CRLF rejection in H2 header values

zwoop
authored and
cmcfarlen
committed
93657ab
Fix format issue in http2_crlf_header_validation

bneradt
authored and
cmcfarlen
committed
c17b724
rate_limit: Issue 106 - Fix queue bypass

zwoop
authored and
cmcfarlen
committed
807b037
rate_limit: Issue 108 - Fix ip-rep UB writes

zwoop
authored and
cmcfarlen
committed
932b5fa
compress: stop gzip transform after deflate() error

bryancall
authored and
cmcfarlen
committed
e39e178
Fix leaks of POST failures

masaori335
authored and
cmcfarlen
committed
752fea8
Add nullptr check before calling SSL_shutdown

masaori335
authored and
cmcfarlen
committed
fb45f2f
Fix length check of MethodMod:check

masaori335
authored and
cmcfarlen
committed
e6f8b84
iocore: tighten IOBuffer and AIO bounds checks

brbzull0
authored and
cmcfarlen
committed
c181b39
stream_editor: allocate rules in contdata_t ctor

brbzull0
authored and
cmcfarlen
committed
9a65757
tscpp: hold intercept try-lock guard via shared mutex

brbzull0
authored and
cmcfarlen
committed
2838fec
URL: reject parsed ports outside uint16 range

brbzull0
authored and
cmcfarlen
committed
39bb899
access_control: cap stack buffer for cookie base64 decode

brbzull0
authored and
cmcfarlen
committed
a75f04a
rate_limit: Fix active counter underflow

zwoop
authored and
cmcfarlen
committed
10e7d11
Constrain prefetch relative paths

bneradt
authored and
cmcfarlen
committed
2329726
Server Session: Make sure read_buffer is empty before pooling a server session

masaori335
authored and
cmcfarlen
committed
b542a27
Keep OCSP map on init failure

bneradt
authored and
cmcfarlen
committed
21b786a
Return evacuation bucket by reference not by value
cmcfarlen
committed
664666e
Handle addressless PROXY headers in TLS

bneradt
authored and
cmcfarlen
committed
94f2069
Guard outbound server_name SNI policy

bneradt
authored and
cmcfarlen
committed
b706c00
Verify H2 origin certs on session reuse

bneradt
authored and
cmcfarlen
committed
329d354
TLSSNISupport: own outbound_sni_policy bytes across config reload

authored and
cmcfarlen
committed
bd6a403
Avoid signed tolower for name bytes

bneradt
authored and
cmcfarlen
committed
7e85ad3
Reject oversized multiplexer chunks

bneradt
authored and
cmcfarlen
committed
61a0225
Keep loop detection on outbound-transparent ports
cmcfarlen
committed
8605e65
Set default value of proxy.config.http2.default_buffer_water_mark to 32KB

masaori335
authored and
cmcfarlen
committed
9d99f4f
Avoid UB when URL part is absent in URLImpl getters
cmcfarlen
committed
e6e7135
HTTPHdr: fix use-after-free in destroy() leaving dangling m_http

authored and
cmcfarlen
committed
b73cf9d
ESI: cap HTTP request length to prevent size_t overflow

authored and
cmcfarlen
committed
c80606f
Invoke Continuation operator bool, not pointer-to-bool
cmcfarlen
committed
b485b59
Prevent unbounded recursion in host-down Range fallback
cmcfarlen
committed
252466f
Add uds-perm/uds-user/uds-group port options

maskit
authored and
cmcfarlen
committed
9bf1fa5
Fix ChunkHandler Flow Control

authored and
cmcfarlen
committed
6cf8175
Fix FetchSM header block copying

bneradt
authored and
cmcfarlen
committed
de96468
Gate H2 reads during async hooks

bneradt
authored and
cmcfarlen
committed
7785b7a
background_fetch: fix inverted size operator and broken value wildcard

authored and
cmcfarlen
committed
4b7b907
Fix an integer overflow in HdrHeap

moonchen
authored and
cmcfarlen
committed
950c078
lua: Add checks on server request hdr

shukitchan
authored and
cmcfarlen
committed
e66d257
Regex: add RE_FULL_MATCH flag, fix SNI partial-match policy bypass

authored and
cmcfarlen
committed
96dc167
Combo handler: Reject empty Content-Type when allowlist is configured

authored and
cmcfarlen
committed
d2c64e7
ESI: bound for nested esi html comment

authored and
cmcfarlen
committed
95d9db9
ja3_fingerprint: tighten encode_word_buffer bounds

masaori335
authored and
cmcfarlen
committed
75412e0
Use ParseRules::is_digit on raw network bytes in HTTP parser
cmcfarlen
committed
db35e84
header_rewrite: Copy set-body-from response body with memcpy
cmcfarlen
committed
c6d02f5
Cap stale_response SIE buffering

bneradt
authored and
cmcfarlen
committed
948e9fe
Guard parent mark-down on UNAVAILABLE_SERVER retry
cmcfarlen
committed
159ce64
xdebug: Cap X-Remap header length to actual buffer content
cmcfarlen
committed
a6dbdb9
DNS: fix TCP length-prefix read under edge-triggered epoll

authored and
cmcfarlen
committed
90e0b06
Add admin-guide reference for writing secure regex rules

authored and
cmcfarlen
committed
6dcf044
combo_handler.test.py: Fix empty type test output

bneradt
authored and
cmcfarlen
committed
0d7b210
test_proxy: Fix macOS link duplicates after FetchSM test was added
cmcfarlen
committed
63d5c95
Fixes HRW bridge issues, adds autests to Cripts

zwoop
authored and
cmcfarlen
committed
c420e01
cripts: Fix undersized sockaddr in Geo IP lookup

zwoop
authored and
cmcfarlen
committed
4c72a98
cripts: fix use-after-free in TSRemapDoRemap

zwoop
authored and
cmcfarlen
committed
bb2ffba
cripts: Fix abort on duplicate query keys

zwoop
authored and
cmcfarlen
committed
a4a8319
header_rewrite: Fix cookie key over-read

zwoop
authored and
cmcfarlen
committed
e076e7d
doc: cover uri_signing cdniuc uri-regex in regex best practices

ezelkow1
authored and
cmcfarlen
committed
c248c81
Preserve dynamic-port flag across tunnel_route mapping ops

maskit
authored and
cmcfarlen
committed
c12aa91
HttpTunnel: Guard get_producer(VIO*) against dead producers

maskit
authored and
cmcfarlen
committed
25c665a
ts_lua: clear rri pointer in http_ctx after remap returns

ezelkow1
authored and
cmcfarlen
committed
c6ac6d6
ts_lua: use sockaddr_storage for ts_lua_fetch client address

ezelkow1
authored and
cmcfarlen
committed
b110f78
header_rewrite: Guard SESSION/STATE access on null handle

zwoop
authored and
cmcfarlen
committed
43f78d0
cripts: Fix global Client::URL MLoc leak

zwoop
authored and
cmcfarlen
committed
1256e74
cripts: Fix Bundle::Headers server-side header removal

zwoop
authored and
cmcfarlen
committed
b70fbca
slice: Check for Integer underflow in firstblockbytes

traeak
authored and
cmcfarlen
committed
ae09135
ParentSelection: increase size of mapWrapped array for compat with strategies

traeak
authored and
cmcfarlen
committed
ad40f28
lua: Invalidate cached main_ctx when slot is outside instance's range

cmcfarlen
and
claude
committed
2c28d2c
DNS: Run HostEnt destructor on free to release SRV vector heap

cmcfarlen
and
claude
committed
52e6b46
HttpSM: Stop tracking the fire-and-forget cache-delete Action
cmcfarlen
committed
c185e55
lua: Free transform context when client-hook VConn closes
cmcfarlen
committed
c1aebba
NextHopRoundRobin: update ring size for wrapping when switching rings

traeak
authored and
cmcfarlen
committed
00b1a11
certifier: Reject unsafe SNI names

bneradt
authored and
cmcfarlen
committed
41cd074
Drop H2 origin trailers for H1 clients

bneradt
authored and
cmcfarlen
committed
b7fdf99
http2: Reject CONTINUATION accumulation that overflows header_blocks_length

bryancall
authored and
cmcfarlen
committed
ed25aae
Honor number_of_redirections for plugin-initiated redirects

bryancall
authored and
cmcfarlen
committed
62497ae
cache_range_requests: use std::string spill buffer for building override cachekey

traeak
authored and
cmcfarlen
committed
f26b121
Reject header fields exceeding the uint16 field-length limit

bryancall
authored and
cmcfarlen
committed
1b98b1f
webp_transform: bound buffered body and ImageMagick decode

bryancall
authored and
cmcfarlen
committed
74ccaa2
header_rewrite: Fix IPv6 CIDR masking for non-aligned prefixes
cmcfarlen
committed
3c44efd
Implement SSRF validation for ESI include URLs

authored and
cmcfarlen
committed
89d543a
SSLNetVConnection: deregister async handshake eventfd on connection teardown

bryancall
authored and
cmcfarlen
committed
aac5c3b
Strip Connection-listed headers per RFC 9110 §7.6.1

alficles
authored and
cmcfarlen
committed
a69e886
Test H2 control-character rejection

bneradt
authored and
cmcfarlen
committed
ceacc9b
http2: Defer HPACK dynamic-table updates until encoding succeeds

maskit
authored and
cmcfarlen
committed
5d215fc
authproxy: Don't assert on auth response with no header fields

maskit
authored and
cmcfarlen
committed
a1d35f9
mgmt/rpc: create JSONRPC unix socket with intended mode atomically

brbzull0
authored and
cmcfarlen
committed
9500f6b
cache: Move openReadStartEarliest recursion counter off CacheVC to fix UAF

bryancall
authored and
cmcfarlen
committed
230ae9f
Bound host header buffer

authored and
cmcfarlen
committed
e27b7ef
uri_signing: replace stack arrays with LocalBuffer

alficles
authored and
cmcfarlen
committed
b9f36ca
http: reject chunked extension quoted-string values containing CR or LF

bryancall
authored and
cmcfarlen
committed
946e241
ip_allow: add default CONNECT destination rules

bneradt
authored and
cmcfarlen
committed
d57b23d
Guard against missing delimiter in url_sig C= parameter

alficles
authored and
cmcfarlen
committed
be5a335
master: Strip external @ headers before plugin hooks

bneradt
authored and
cmcfarlen
committed
51c5b0f
Fix: cancel stale TLS accept timeouts so session acceptors don't abort

moonchen
authored and
cmcfarlen
committed
85f90eb
regex_map: anchor host matching to the full hostname

bryancall
authored and
cmcfarlen
committed
67ded93
Invalidate dns_info.addr when claiming resolved without DNS
cmcfarlen
committed
be70ba8
PendingAction: Don't let CAS failure overwrite the caller's action
cmcfarlen
committed
f322409
parent_selection: Cap retries to one per window via failedAt CAS

cmcfarlen
and
claude
committed
f684c07
compress: Wrap isspace so obs-text Content-Type bytes don't trigger UB
cmcfarlen
committed
37985fb
Expand URI normalization test coverage for userinfo handling

alficles
authored and
cmcfarlen
committed
076024a
Guard remap against shutdown table teardown

bneradt
authored and
cmcfarlen
committed
2303f89
Revert "Guard remap against shutdown table teardown"

bneradt
authored and
cmcfarlen
committed
27a42ae
Guard remap against shutdown table teardown

bneradt
authored and
cmcfarlen
committed
9127101
http: reject a bare LF chunked trailer terminator under strict parsing

bryancall
authored and
cmcfarlen
committed
ae5e6da
Combo handler: Refactor Cache-Control parsing and update gold test

authored and
cmcfarlen
committed
25cfec9
Fix null-deref in error_log_connection_failure for a DOWN host

maskit
authored and
cmcfarlen
committed
40ef716
Fix tls_engine_abort autest referencing removed async_engine plugin

maskit
authored and
cmcfarlen
committed
d5adeb3
Fix header_rewrite_bundle cookie rules matching the wrong path

maskit
authored and
cmcfarlen
committed
91b7e49
http: drain request body on internally generated cache responses

authored and
cmcfarlen
committed
3563e4c
Fix chunked passthrough flow-control deadlock (drop_chunked_trailers=0)

masaori335
authored and
cmcfarlen
committed
3e05a64
webp_transform: fix decode_limit test to send a matching signature

maskit
authored and
cmcfarlen
committed
2bed754
Regex: preserve RE_ENDANCHORED semantics on PCRE2 < 10.30
cmcfarlen
committed
338f3ab
esi: drop tsutil from esicore link deps to avoid plugin ODR
cmcfarlen
committed
4c0fd80
esi: add <sys/socket.h> for AF_INET/AF_INET6 in IncludeUrlValidator
cmcfarlen
committed
90700df
esi: guard optarg null before setHostAllowRegex to satisfy clang analyzer
cmcfarlen
committed
6b04195
connect_destination_acl: accept curl exit 7 for a refused CONNECT

maskit
authored and
cmcfarlen
committed
7a898ed

Commits on Jul 30, 2026

Fix race in remap table refcount during reload

authored and
cmcfarlen
committed
f1cbde3