This release includes 2 security fixes for security teams reviewing exposed deployments.
Topics
+1 more
Affected surfaces
ReleasePort's take
Moderate signalVersion 2.8.0 properly escapes file paths in directory listings and adds several new features (custom SIGTERM handling, KDL config placeholders, Google Cloud DNS ACME provider, Spaceship DNS provider, shell‑style argument parsing for TLS post‑obtain commands) while breaking CONNECT requests with pathname URIs.
Why it matters: The release patches a time‑based user enumeration flaw in HTTP Basic Auth (severity 90), fixes directory‑listing escaping bugs (severity 40), and rejects CONNECT requests containing pathnames, which may affect existing integrations.
Summary
AI summaryFile paths in directory listings are now properly escaped.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Fixes time‑based user enumeration vulnerability in HTTP Basic Authentication. Fixes time‑based user enumeration vulnerability in HTTP Basic Authentication. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Security | High |
Rejects PROXY v2 headers longer than 512 bytes to prevent memory DoS. Rejects PROXY v2 headers longer than 512 bytes to prevent memory DoS. Source: granite4.1:30b@2026-06-12-audit Confidence: high |
— |
| Security | Medium |
Verifies OCSP responses when TLS stapling is enabled. Verifies OCSP responses when TLS stapling is enabled. Source: granite4.1:30b@2026-06-12-audit Confidence: high |
— |
| Breaking | High |
Breaks CONNECT requests with pathname URIs; they are now rejected. Breaks CONNECT requests with pathname URIs; they are now rejected. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Adds custom SIGTERM signal handling for graceful shutdown. Adds custom SIGTERM signal handling for graceful shutdown. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Adds environment variable placeholders in KDL-format configurations. Adds environment variable placeholders in KDL-format configurations. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Adds Google Cloud DNS provider for DNS-01 ACME challenges. Adds Google Cloud DNS provider for DNS-01 ACME challenges. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Adds Spaceship DNS provider for DNS-01 ACME challenges. Adds Spaceship DNS provider for DNS-01 ACME challenges. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Feature | Low |
Adds shell-style argument parsing in `auto_tls_post_obtain_command`. Adds shell-style argument parsing in `auto_tls_post_obtain_command`. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Performance | Medium |
Improves HTTP compression to use server‑preferred content encoding (zstd, br, gzip, deflate, identity). Improves HTTP compression to use server‑preferred content encoding (zstd, br, gzip, deflate, identity). Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Bugfix | Medium |
Fixes 403 Forbidden responses when URL sanitizer is disabled; now returns 404 Not Found. Fixes 403 Forbidden responses when URL sanitizer is disabled; now returns 404 Not Found. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Bugfix | Medium |
Fixes improper escaping of file paths in directory listings. Fixes improper escaping of file paths in directory listings. Source: llm_adapter@2026-06-12 Confidence: high |
— |
| Bugfix | Medium |
Corrects `location` blocks to match path segments only at URL start. Corrects `location` blocks to match path segments only at URL start. Source: granite4.1:30b@2026-06-12-audit Confidence: high |
— |
| Bugfix | Low |
Corrects swapped So You Start endpoint names for OVH DNS provider. Corrects swapped So You Start endpoint names for OVH DNS provider. Source: granite4.1:30b@2026-06-12-audit Confidence: high |
— |
| Refactor | Low |
Improves RFC 7230 compliance by stripping hop‑by‑hop headers in reverse proxy. Improves RFC 7230 compliance by stripping hop‑by‑hop headers in reverse proxy. Source: granite4.1:30b@2026-06-12-audit Confidence: high |
— |
| Refactor | Low |
Improves shebang handling for CGI on non-Unix systems. Improves shebang handling for CGI on non-Unix systems. Source: granite4.1:30b@2026-06-12-audit Confidence: high |
— |
Full changelog
Added
- Custom SIGTERM signal handling for graceful shutdown.
- Environment variable placeholders in KDL-format configurations
- Google Cloud DNS provider for DNS-01 ACME challenges.
- Spaceship DNS provider for DNS-01 ACME challenges.
- Support for shell-style argument parsing in
auto_tls_post_obtain_command.
Changed
- CONNECT requests with pathname URIs are now rejected.
- HTTP compression now uses server-preferred content encoding (zstd, br, gzip, deflate, identity) when available (GitHub issue).
- Improved RFC 7230 compliance for reverse proxy (by stripping hop-by-hop headers).
- Improved shebang handling for CGI on non-Unix systems.
- OCSP responses are now verified when stapling is enabled.
Fixed
- 403 Forbidden responses were returned when URL sanitizer was disabled, even when it should have returned 404 Not Found.
- File paths in directory listings weren't properly escaped.
- HTTP Basic Authentication was vulnerable to time-based user enumeration.
locationblocks matched path segments anywhere in the URL, not just at the start (GitHub issue).- PROXY v2 headers with lengths greater than 512 bytes were allowed, possibly leading to memory DoS.
- So You Start endpoint names for OVH DNS provider were swapped.
Security Fixes
- HTTP Basic Authentication fixed to prevent time-based user enumeration
- PROXY v2 headers now limited to 512 bytes to avoid memory DoS
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]