Nginx failing on Almalinux 9 after latest updates

Support
1

Hi folks,

I’ve got three servers running Almalinux, all with nginx on.

I updated all three yesterday and nginx is now failing in the same way on all of them.

See, for example: https://music.key13.uk

Accessing the sites in a browser produces odd behaviour - the browser just… stops loading the page with no error. I have some sites where nginx is a reverse proxy and I can see that the request is making it through to the backend, but something seems to be going wrong with the response.

If I curl any of the sites I get this:

curl: (92) HTTP/2 stream 1 was not closed cleanly before end of the underlying stream

Using curl -vvvv I get this additional information:

OpenSSL SSL_write: error:80000020:system library::Broken pipe, errno 32

and

curl: (56) OpenSSL SSL_read: Connection reset by peer, errno 104

I tried rolling back with sudo dnf history undo but it looks like this was a minor version update and so some of the previous rpm files are no longer available - this fails with:

Error: The following problems occurred while running a transaction:
Cannot find rpm nevra “epel-release-9-10.el9.noarch”.

As I have quite a few sites that are no down, and no obvious route to fixing them, I’d appreciate any help or advice anyone has here!

2

Hi

Could you try disabling HTTP/2 temporarily on one affected site?

For example, change:

listen 443 ssl http2;

to:

listen 443 ssl;

then run:

nginx -t && systemctl reload nginx

If the site starts working after disabling HTTP/2, this likely points to an nginx/OpenSSL HTTP/2/TLS issue after the recent updates.

thanks

3

Just replying with the solution here, as I solved it via the chatroom at the time. This was traced to an EPEL nginx module “headers-more”, and a security fix to nginx that caused this module to fail when loaded.

The solution at the time was to either remove this module or rollback the nginx version to the previous one, accepting the security risk.

It’s been sorted in later releases and is no longer an issue.