Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Ubuntu nginx 1.24.0-2ubuntu7.10 crashes workers with ngx_http_modsecurity_module enabled; 1.24.0-2ubuntu7.9 works

Aperta
  • Qualcosa non va?
#3,572 3 commenti 2 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
55/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Tranquilla
Stack tecnologico
nginx, ubuntu
Ambito
backend, security

Direzione di ricerca

Inizia con la configurazione minima di nginx e i comandi per riprodurre il problema nell'issue, usando nginx 1.24.0-2ubuntu7.10 con il modulo ModSecurity caricato e SecRuleEngine abilitato. Confronta il comportamento e i log con il binario estratto 1.24.0-2ubuntu7.9, includendo il worker crash segnalato e la invalid malloc request. Il lavoro è completato quando il pacchetto corrente serve correttamente la richiesta di test senza un worker crash.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

3.x

Hi everyone, i was running my webpage production vm on ubuntu using nginx and modsecurity >> this morning 6:00 am ish it caused the page to go down. Stopped working, i realised that its due to the latest update on nginx caused Modsecurity not to work anymore. I've summarised the information below with codex. Just wanted to give you as much info as i can so that maybe you can fix or update so that modsecurity works just fine with nginx latest version. By the way the staging environment i have which is running on a mac mini m4, is perfectly fine. It also uses nginx, and modsecurity, but somehow the issue did not impact it. Everything else is identical, the code running django, and database etc are identical. Issue seems to be on ubuntu autoupdated nginx package vs the modesecurity.

Summary

After an unattended Ubuntu upgrade from nginx 1.24.0-2ubuntu7.9 to 1.24.0-2ubuntu7.10, Nginx workers began crashing on any ModSecurity-enabled request.

This happens even with a minimal inline ModSecurity config containing only:

modsecurity on;
modsecurity_rules 'SecRuleEngine On';

Environment
OS:

Ubuntu 24.04 noble
amd64
Installed packages:

nginx                         1.24.0-2ubuntu7.10
nginx-common                  1.24.0-2ubuntu7.10
libnginx-mod-http-modsecurity 1.0.3-1build3
libmodsecurity3t64            3.0.12-1.1build2
modsecurity-crs               3.3.5-2
The failing upgrade was installed by unattended-upgrades:

2026-06-09 06:13:29
Upgrade: nginx:amd64 1.24.0-2ubuntu7.9 -> 1.24.0-2ubuntu7.10
Upgrade: nginx-common:amd64 1.24.0-2ubuntu7.9 -> 1.24.0-2ubuntu7.10
Impact
Production Nginx returned empty replies / Cloudflare 502s for normal dynamic requests. Nginx workers repeatedly crashed with signal 11.

Example error:

malloc(96973185644385) failed (12: Cannot allocate memory)
worker process exited on signal 11 (core dumped)
Minimal Reproduction
Use this minimal config:

load_module /usr/lib/nginx/modules/ngx_http_modsecurity_module.so;

worker_processes 1;
pid /tmp/nginx-current-modsec-test.pid;

events {
  worker_connections 64;
}

http {
  error_log /tmp/nginx-modsec-error.log info;

  server {
    listen 127.0.0.1:18100;
    server_name localhost;

    modsecurity on;
    modsecurity_rules 'SecRuleEngine On';

    location / {
      default_type text/plain;
      return 200 "current engine ok\n";
    }
  }
}
Start current Nginx:

/usr/sbin/nginx -p /tmp/nginx-current-prefix -c /tmp/current.conf
curl -sS -D - http://127.0.0.1:18100/
Actual result:

curl: (52) Empty reply from server
Nginx error log:

malloc(108978184456033) failed (12: Cannot allocate memory)
worker process exited on signal 11 (core dumped)
Control Test
Download and extract previous Nginx:

apt-get download nginx=1.24.0-2ubuntu7.9 nginx-common=1.24.0-2ubuntu7.9
dpkg-deb -x nginx_1.24.0-2ubuntu7.9_amd64.deb /tmp/nginx-old
Run the same config with the old binary:

/tmp/nginx-old/usr/sbin/nginx -p /tmp/nginx-old-prefix -c /tmp/old.conf
curl -sS -D - http://127.0.0.1:18101/
Expected/actual result with old binary:

HTTP/1.1 200 OK
old engine ok
Workaround
Pin/replace the service runtime to use the extracted nginx 1.24.0-2ubuntu7.9 binary. With the previous Nginx binary, the same ModSecurity module and rules work again.

Expected Behavior
nginx 1.24.0-2ubuntu7.10 should not crash workers when ngx_http_modsecurity_module is loaded and SecRuleEngine On is enabled.

Actual Behavior
Nginx worker crashes with huge invalid-looking malloc request and signal 11.

Notes
This appears to be a regression or ABI/runtime incompatibility between:

nginx 1.24.0-2ubuntu7.10
libnginx-mod-http-modsecurity 1.0.3-1build3
libmodsecurity3t64 3.0.12-1.1build2
The issue is reproducible without OWASP CRS, so CRS rules are unlikely to be the root cause.
Lingua principale
C++
Stelle
9.8k
Fork
1.8k
Merge medio
2h 46m
PR unite (30g)
1

Preparare l'ambiente

Non abbiamo ancora controllato i file di configurazione di questo progetto. Parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di owasp-modsecurity/ModSecurity

Tutte le issue di owasp-modsecurity/ModSecurity

Issue simili

Altre issue su C++

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.