ModSecurity stops working with Nginx 1.24.0-2ubuntu7.10 - malloc error

[StefanGlaesser]

Hello,

after installing the latest update of nginx from ubuntu, the compiled mod_security-module (3.0.14) doesn't work anymore. I tried to reinstall mod_security like before with both versions 3.0.14 and 3.0.15 but still getting malloc-errors like this:

[emerg] 639082#639082: *113 malloc(95167102455060) failed (12: Cannot allocate memory)

Here is a link, whats changed in nginx: https://www.ubuntuupdates.org/package/core/noble/main/updates/nginx

Help is adviced.

Best regards,
Stefan

[Sheshagiri]

we are in the similar boat as well. following is our configuration.

libmodsecurity3 version 3.0.15
ModSecurity-nginx v1.0.4
nginx/1.28.3

[StefanGlaesser]

There is already an confirmed bug in the ubuntu-repository of nginx:
https://bugs.launchpad.net/ubuntu/+source/nginx/+bug/2155992

Best regards,
Stefan

[airween]

@StefanGlaesser, @Sheshagiri,

thanks for sharing the symptoms. Which operation system you have?

On ModSecurity's Slack channel I received a few similar reports - all of them caused on Ubuntu 24.04.

The issue itself is interesting, because there were no changes recently in library or the connector, but as I know Debian/Ubuntu maintainers have added so many fixes.

Last weekend I upgraded all of our servers, and there were no any issue - but we use only Debian.

Based on a Slack report I was able to reproduce the malloc(...) failed (12: Cannot allocate memory) issue, but after I rebuilt the package everything was fine - the server still works (it's a dev VM on my desktop).

I'm afraid this is an Nginx related issue, so actually I don't want to involve ourselves :).

[StefanGlaesser]

@airween

We're also running Ubuntu 24.04.

Hope, that they will release a fixed version of nginx very soon. :)

br,
Stefan

[Sheshagiri]

@airween we are running azurelinux which is derived from Fedora.

[airween]

(https://github.com/airween) we are running azurelinux which is derived from Fedora.

what is your symptoms exactly? Which component was updated recently?

[Sheshagiri]

We upgraded nginx from 1.25.4 to 1.28.3 and modsecurity from 3.0.14 to 3.0.15, with these changes we started noticing the requests failing with malloc error.

[airween]

We upgraded nginx from 1.25.4 to 1.28.3 and modsecurity from 3.0.14 to 3.0.15, with these changes we started noticing the requests failing with malloc error.

Thanks - let me check the issue with 1.28.X.

[ArtyWatts]

We are using nginx 1.24.0 on Ubuntu 24.04, ModSecurity-nginx v1.0.4, initially used libmodsecurity3 version 3.0.14, where the issue presented itself. An upgrade to libmodsecurity3 version 3.0.15 did not fix the issue

fyi

[korikori]

FTR Ubuntu have reversed the breaking changes (outlined in the same bug report linked above). modsec confirmed works with the most recent Ubuntu nginx packages.

[Sheshagiri]

For us the issue is resolved in nginx 1.28.1 where we disalbed http2 via nginx configuration to address the http2 bomb vulnerability. We are following up with azurelinux about the error mentioned above on 1.28.3.