Skip to content

v1.4.2

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 18 Jul 14:07
v1.4.2
This tag was signed with the committer’s verified signature.
dunglas Kévin Dunglas
SSH Key Fingerprint: OwXgYlDZNYIA9AUb5TcfUYN1aIahP9snMQEPiwqnFtw
Verified
Learn about vigilant mode.
fe7bcdf
This commit was signed with the committer’s verified signature.
dunglas Kévin Dunglas
SSH Key Fingerprint: OwXgYlDZNYIA9AUb5TcfUYN1aIahP9snMQEPiwqnFtw
Verified
Learn about vigilant mode.

Security release fixing three vulnerabilities in request-directive handling, all reported by Alexandre Daubois (Les-Tilleuls.coop). Users on 1.4.1 and earlier should upgrade.

🔒 Security Fixes

  • High (GHSA-qwqr-3x94-53xc): Fix quadratic (O(N²)) response rebuild on wildcard Preload/Fields match against large arrays, which enabled a low-bandwidth algorithmic-complexity denial of service. Rebuild is now a single O(N) pass. by @dunglas
  • Medium (GHSA-7825-cqgv-jjqr): Bound JSON-pointer recursion depth, preventing ~100× memory amplification from directives with many /-delimited segments. partsToTree is now iterative. by @dunglas
  • Low (GHSA-gqmm-v8j2-px6g): Close a TOCTOU data race on the shared push counter that let concurrent HTTP/2 pushes marginally exceed maxPushes. Counter check now holds the mutex. by @dunglas

Full Changelog: v1.4.1...v1.4.2

Contributors

dunglas
Assets 23
Loading