Skip to content

ferron

v2.8.0 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo Reverse Proxies & Load Balancers
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

http http-server rust server web web-server
+1 more
webserver

Affected surfaces

auth breaking_upgrade

ReleasePort's take

Moderate signal
editorial:auto 1mo

Version 2.8.0 properly escapes file paths in directory listings and adds several new features (custom SIGTERM handling, KDL config placeholders, Google Cloud DNS ACME provider, Spaceship DNS provider, shell‑style argument parsing for TLS post‑obtain commands) while breaking CONNECT requests with pathname URIs.

Why it matters: The release patches a time‑based user enumeration flaw in HTTP Basic Auth (severity 90), fixes directory‑listing escaping bugs (severity 40), and rejects CONNECT requests containing pathnames, which may affect existing integrations.

Summary

AI summary

File paths in directory listings are now properly escaped.

Changes in this release

Security Critical

Fixes time‑based user enumeration vulnerability in HTTP Basic Authentication.

Fixes time‑based user enumeration vulnerability in HTTP Basic Authentication.

Source: llm_adapter@2026-06-12

Confidence: high

 —
Security High

Rejects PROXY v2 headers longer than 512 bytes to prevent memory DoS.

Rejects PROXY v2 headers longer than 512 bytes to prevent memory DoS.

Source: granite4.1:30b@2026-06-12-audit

Confidence: high

 —
Security Medium

Verifies OCSP responses when TLS stapling is enabled.

Verifies OCSP responses when TLS stapling is enabled.

Source: granite4.1:30b@2026-06-12-audit

Confidence: high

 —
Breaking High

Breaks CONNECT requests with pathname URIs; they are now rejected.

Breaks CONNECT requests with pathname URIs; they are now rejected.

Source: llm_adapter@2026-06-12

Confidence: high

 —
Feature Low

Adds custom SIGTERM signal handling for graceful shutdown.

Adds custom SIGTERM signal handling for graceful shutdown.

Source: llm_adapter@2026-06-12

Confidence: high

 —
Feature Low

Adds environment variable placeholders in KDL-format configurations.

Adds environment variable placeholders in KDL-format configurations.

Source: llm_adapter@2026-06-12

Confidence: high

 —
Feature Low

Adds Google Cloud DNS provider for DNS-01 ACME challenges.

Adds Google Cloud DNS provider for DNS-01 ACME challenges.

Source: llm_adapter@2026-06-12

Confidence: high

 —
Feature Low

Adds Spaceship DNS provider for DNS-01 ACME challenges.

Adds Spaceship DNS provider for DNS-01 ACME challenges.

Source: llm_adapter@2026-06-12

Confidence: high

 —
Feature Low

Adds shell-style argument parsing in `auto_tls_post_obtain_command`.

Adds shell-style argument parsing in `auto_tls_post_obtain_command`.

Source: llm_adapter@2026-06-12

Confidence: high

 —
Performance Medium

Improves HTTP compression to use server‑preferred content encoding (zstd, br, gzip, deflate, identity).

Improves HTTP compression to use server‑preferred content encoding (zstd, br, gzip, deflate, identity).

Source: llm_adapter@2026-06-12

Confidence: high

 —
Bugfix Medium

Fixes 403 Forbidden responses when URL sanitizer is disabled; now returns 404 Not Found.

Fixes 403 Forbidden responses when URL sanitizer is disabled; now returns 404 Not Found.

Source: llm_adapter@2026-06-12

Confidence: high

 —
Bugfix Medium

Fixes improper escaping of file paths in directory listings.

Fixes improper escaping of file paths in directory listings.

Source: llm_adapter@2026-06-12

Confidence: high

 —
Bugfix Medium

Corrects `location` blocks to match path segments only at URL start.

Corrects `location` blocks to match path segments only at URL start.

Source: granite4.1:30b@2026-06-12-audit

Confidence: high

 —
Bugfix Low

Corrects swapped So You Start endpoint names for OVH DNS provider.

Corrects swapped So You Start endpoint names for OVH DNS provider.

Source: granite4.1:30b@2026-06-12-audit

Confidence: high

 —
Refactor Low

Improves RFC 7230 compliance by stripping hop‑by‑hop headers in reverse proxy.

Improves RFC 7230 compliance by stripping hop‑by‑hop headers in reverse proxy.

Source: granite4.1:30b@2026-06-12-audit

Confidence: high

 —
Refactor Low

Improves shebang handling for CGI on non-Unix systems.

Improves shebang handling for CGI on non-Unix systems.

Source: granite4.1:30b@2026-06-12-audit

Confidence: high

 —
Full changelog

Added

  • Custom SIGTERM signal handling for graceful shutdown.
  • Environment variable placeholders in KDL-format configurations
  • Google Cloud DNS provider for DNS-01 ACME challenges.
  • Spaceship DNS provider for DNS-01 ACME challenges.
  • Support for shell-style argument parsing in auto_tls_post_obtain_command.

Changed

  • CONNECT requests with pathname URIs are now rejected.
  • HTTP compression now uses server-preferred content encoding (zstd, br, gzip, deflate, identity) when available (GitHub issue).
  • Improved RFC 7230 compliance for reverse proxy (by stripping hop-by-hop headers).
  • Improved shebang handling for CGI on non-Unix systems.
  • OCSP responses are now verified when stapling is enabled.

Fixed

  • 403 Forbidden responses were returned when URL sanitizer was disabled, even when it should have returned 404 Not Found.
  • File paths in directory listings weren't properly escaped.
  • HTTP Basic Authentication was vulnerable to time-based user enumeration.
  • location blocks matched path segments anywhere in the URL, not just at the start (GitHub issue).
  • PROXY v2 headers with lengths greater than 512 bytes were allowed, possibly leading to memory DoS.
  • So You Start endpoint names for OVH DNS provider were swapped.

Security Fixes

  • HTTP Basic Authentication fixed to prevent time-based user enumeration
  • PROXY v2 headers now limited to 512 bytes to avoid memory DoS
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track ferron

Get notified when new releases ship.

Sign up free

About ferron

A fast, memory-safe web server written in Rust.

All releases →

Related context

Beta — feedback welcome: [email protected]