From 5cb1e207b1dd0ae8f061cb92170c3f0dd3f782b2 Mon Sep 17 00:00:00 2001 From: Vadim Zhestikov Date: Wed, 28 Oct 2026 08:55:50 -0700 Subject: [PATCH] OCSP: disabled handling of headers without a colon Header names not followed by a colon and a value in an OCSP responder reply were accepted as headers with an empty value, similarly to ngx_http_parse_header_line(). With this change, such headers are rejected with the "OCSP responder sent invalid response" error, and the response is not used. The problem appeared in 74ad4494a (1.3.7). --- src/event/ngx_event_openssl_stapling.c | 15 --------------- 1 file changed, 15 deletions(-) diff --git a/src/event/ngx_event_openssl_stapling.c b/src/event/ngx_event_openssl_stapling.c index 86d8b2c55..4f91c9193 100644 --- a/src/event/ngx_event_openssl_stapling.c +++ b/src/event/ngx_event_openssl_stapling.c @@ -2237,21 +2237,6 @@ ngx_ssl_ocsp_parse_header_line(ngx_ssl_ocsp_ctx_t *ctx) break; } - if (ch == CR) { - ctx->header_name_end = p; - ctx->header_start = p; - ctx->header_end = p; - state = sw_almost_done; - break; - } - - if (ch == LF) { - ctx->header_name_end = p; - ctx->header_start = p; - ctx->header_end = p; - goto done; - } - return NGX_ERROR; /* space* before header value */ -- 2.47.3