- CVE-2026-42946: fix buffer over-read and excessive memory allocation in ngx_http_scgi_module and ngx_http_uwsgi_module when an upstream server returns an unrecognized status line; reset r->state before falling back to header parsing so the header parser no longer resumes from a status-line state and reads through an uninitialized r->header_name_start, and reuse r->header_name_start to backtrack the buffer position for status lines split across reads