Call for testing - nginx fix for "no buffer space in script copy" errors
AlmaLinux has released updated nginx packages to fix a regression that caused intermittent HTTP 500 errors after a recent security update.
The recent nginx security update for CVE-2026-42533 introduced a regression affecting AlmaLinux users. On certain configurations, the web server randomly returns HTTP 500 errors logged as 'no buffer space in script copy'. AlmaLinux has identified the root cause and developed fixed packages that maintain the security patch while eliminating the issue.
Users began reporting the errors after updating their systems. The failures are intermittent, with the same URL sometimes succeeding and sometimes failing. In one reported case, between a third and half of requests to a specific location failed, significantly impacting website performance.
Technical cause
The issue stems from how the CVE-2026-42533 fix was implemented. The security patch addresses a buffer overrun in nginx's script engine by adding bounds checking. However, the backported version used a global variable to store buffer end information, which conflicts when scripts are nested.
When a configuration uses volatile map variables within set or rewrite directives, the nested scripts overwrite the global buffer end. When control returns to the outer script, it compares against the wrong buffer boundaries, causing the random failures. Configurations without volatile markers work correctly.
The solution
AlmaLinux's fix modifies functions that run scripts to save and restore the global buffer end value. This preserves the security protections while allowing nested scripts to function properly. The solution maintains the ABI compatibility, ensuring third-party dynamic modules continue working without modification.
The CVE-2026-42533 protection stays fully in place. Every bounds check added by the security fix is still there and still checks against the right buffer.
Testing procedure
The fixed packages are now available in the AlmaLinux testing repository. Users can install them by first adding the testing repository with 'sudo dnf install -y almalinux-release-testing', then updating nginx with 'sudo dnf upgrade 'nginx*' --enablerepo=almalinux-testing'.
After updating, users should verify the patched version with 'rpm -q nginx', restart nginx, and monitor error logs for the specific alert. AlmaLinux encourages all users, especially those who experienced the issue, to test the packages and report results through their Mattermost channel, bug tracker, or email.
The issue has also been reported to Red Hat as RHEL-300689 for potential inclusion in CentOS Stream and RHEL. AlmaLinux recommends disabling the testing repository after updates unless testing in a non-production environment.
Related
