CVE-2025-26803
The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP m...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Bitnami
passenger-nginx-module
[{"type":"SEMVER","events":[{"introduced":"6.0.21"},{"fixed":"6.0.26"}]}]
Bitnami
passenger-apache-module
[{"type":"SEMVER","events":[{"introduced":"6.0.21"},{"fixed":"6.0.26"}]}]
Bitnami
passenger
[{"type":"SEMVER","events":[{"introduced":"6.0.21"},{"fixed":"6.0.26"}]}]
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2025-26803 passenger 修正版: 6.0.26+ds-1
- Ubuntu UBUNTU-CVE-2025-26803 passenger
参照URL
- advisory blog.phusion.nl
- patch github.com
- patch github.com
- patch github.com
- web phusionpassenger.com
- web nvd.nist.gov