Repository navigation
Document PHP upload limits, one request per FPM worker - #163
Merged
Merged
Conversation
Set post_max_size to 32M and upload_max_filesize to 30M in the Nextcloud php-fpm pool, as mitigation for CVE-2026-109618 and CVE-2026-109619. The values are php_admin_value, so .user.ini cannot raise them. Normal file uploads use WebDAV PUT and are not affected. Document the limits and how to change them in README. NethServer/dev#8256 Assisted-by: Claude Code:claude-sonnet-5-5
Member
Nextcloud already runs with the PHP defaults post_max_size = 8M and upload_max_filesize = 2M, which satisfy the PHP mitigation for CVE-2026-109618 and CVE-2026-109619: the packaged .user.ini sets no upload limits. Restore the original pool file and only document in the README that post_max_size must not be raised over 32M. Refs NethServer/dev#8256 Assisted-by: Claude Code:claude-opus-5-5
gsanchietti
changed the title
Member
GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) describes an RCE chain where state left by one request is consumed by the next request handled by the same PHP-FPM worker. Set pm.max_requests = 1 so every worker serves one request and is then replaced. The cost of spawning a worker per request is accepted: opcache shared memory lives in the FPM master and survives worker recycling. Refs NethServer/dev#8256 Assisted-by: Claude Code:claude-sonnet-5-5
gsanchietti
changed the title
Member
26 of 28 tasks
gsanchietti
marked this pull request as ready for review
October 22, 2026 08:29
Member
Author
|
Tested |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PHP published an advisory about two remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (https://www.php.net/archive/2026.php#2026-10-21-5). One of the official mitigations is to keep
post_max_sizeat 32MB or lower when an application needs uploads. NethServer/dev#8256Nextcloud already meets it: the packaged
.user.inisets no upload limits, so the pool runs with the PHP defaultspost_max_size = 8Mandupload_max_filesize = 2M(checked on a test server). Normal file uploads use WebDAVPUTand are not limited by these values. No setting changes, so this PR only documents in the README thatpost_max_sizemust not be raised over 32MB.Session upload progress for Nextcloud is turned off by the php80 runtime package (NethServer/nethserver-remi-php80-php-fpm#2).
One request per PHP-FPM worker
GHSA-6wmf-4rv5-p3rp (GHSA-6wmf-4rv5-p3rp) describes an RCE chain through stale global state: state left by one request is consumed by the next request handled by the same worker. The advisory suggests limiting each worker to one request when performance is not the main concern, so the Nextcloud pool now sets
pm.max_requests = 1.Performance trade-off: every request is served by a fresh worker.
pm = dynamickeeps spare workers ready, and opcache and APCu (memcache.local) shared memory live in the FPM master, so they survive worker recycling.000-nextcloud.confis%config(noreplace): on servers where it was edited, the update writes000-nextcloud.conf.rpmnewand the setting must be added by hand. The README says so.The
nethserver-nextcloud-updateevent already restartsphp80-php-fpm.README.rst: new "PHP upload limits" and "PHP-FPM workers" sections000-nextcloud.conf:pm.max_requests = 1How to test
grep max_requests /etc/opt/remi/php80/php-fpm.d/000-nextcloud.confshowspm.max_requests = 1ps -o pid,cmd -C php-fpmor a temporarygetmypid()page)Assisted-by: Claude Code:claude-opus-5-5, Claude Code:claude-sonnet-5-5