Critical remote vulnerability in Nginx CVE-2026-9256

/en/linux/how-to/ nginxdebianCVE
23/May/2026
authorRentaro
Rentaro

Let’s rebuild Nginx with CVE-2026-9256 patch according to the Debian-way.

Debian Nginx CVE-2026-9256 1600x900 CVE-2026-9256.png
Debian Nginx CVE-2026-9256

A critical vulnerability in nginx allows remote code execution with the privileges of the nginx worker process by sending a specially crafted HTTP request.
But that’s not the point.
The problem is that Debian maintainers are in no hurry to release a new patch package.

1
2
3
4
5

apt --no-install-recommends \
    --no-install-suggests install \
    build-essential \
    fakeroot \
    devscripts

nano /etc/apt/sources.list

1
2
3
4

# trixie sources
deb-src https://deb.debian.org/debian/ trixie main contrib non-free non-free-firmware
deb-src http://security.debian.org/debian-security/ trixie-security main contrib non-free non-free-firmware
deb-src https://deb.debian.org/debian/ trixie-updates main contrib non-free non-free-firmware

1
2
3
4
5
6
7
8
9

apt update
cd /usr/src
mkdir -p debian-nginx && cd debian-nginx
apt-get source nginx
apt build-dep nginx
cd nginx-1.26.3
wget https://github.com/nginx/nginx/commit/3f135ae2eb60ce376196c898a6c7cb4d774f7068.patch \
     -O debian/patches/CVE-2026-9256.patch
printf '\n%s\n' "CVE-2026-9256.patch" >> debian/patches/series

dch -n

1
2
3
4
5
6

nginx (1.26.3-3+deb13u5.7) UNRELEASED; urgency=high

  * CVE-2026-9256 patch.
  *

 -- sysop <sysop@prod>  Sun, 23 May 2026 17:45:58 +0200

debuild -b -uc -us

1
2
3
4
5
6
7
8
9

 dpkg-buildpackage -us -uc -ui -b
dpkg-buildpackage: info: source package nginx
dpkg-buildpackage: info: source version 1.26.3-3+deb13u5.7
dpkg-buildpackage: info: source distribution UNRELEASED
dpkg-buildpackage: info: source changed by sysop <sysop@prod>
 dpkg-source --before-build .
dpkg-buildpackage: info: host architecture amd64
dpkg-source: info: using patch list from debian/patches/series
dpkg-source: info: applying CVE-2026-9256.patch

cd ../

1
2
3
4
5
6
7
8
9
10
11
12

dpkg -i \
    libnginx-mod-http-geoip_1.26.3-3+deb13u5.7_amd64.deb \
    libnginx-mod-mail_1.26.3-3+deb13u5.7_amd64.deb \
    libnginx-mod-http-image-filter_1.26.3-3+deb13u5.7_amd64.deb \
    libnginx-mod-stream_1.26.3-3+deb13u5.7_amd64.deb \
    libnginx-mod-http-perl_1.26.3-3+deb13u5.7_amd64.deb \
    libnginx-mod-stream-geoip_1.26.3-3+deb13u5.7_amd64.deb \
    libnginx-mod-http-xslt-filter_1.26.3-3+deb13u5.7_amd64.deb \
    nginx_1.26.3-3+deb13u5.7_amd64.deb \
    nginx-core_1.26.3-3+deb13u5.7_all.deb \
    nginx-extras_1.26.3-3+deb13u5.7_amd64.deb \
    nginx-common_1.26.3-3+deb13u5.7_all.deb
Original post on SecOps.it Blog • Critical remote vulnerability in Nginx CVE-2026-9256