Changelog¶
The Installer¶
Improved stability¶
The installer now waits for each service to stop completely before reinstalling it and removes any leftover processes. Manually uninstalling Erlang and RabbitMQ before an upgrade is no longer necessary. A rare crash that could abort an upgrade has been fixed.
Lime Web Front (nginx)¶
WinSW replaces NSSM¶
The webfront service is now managed by WinSW like all other services. NSSM is no longer included in the installation.
Logging¶
The error log is rotated automatically. A daily access log has been enabled, with old files cleaned up on a schedule.
Stability¶
The nginx configuration is validated before the service is installed. The default proxy buffer sizes have been increased so that requests with large SSO response headers no longer fail with HTTP 502.
Lime Web Server¶
Merged logs for troubleshooting¶
The logs from all web server instances can now be merged into one chronological file by
double-clicking merge-webserver-logs in the web server log folder.
Elasticsearch¶
Memory limit verified on install¶
An upgrade could previously leave the configured memory limit unapplied, causing Elasticsearch to use about half of the server's RAM. The limit is now applied and verified on every install and upgrade.
Python 3.11.15¶
Lime CRM ships with its own build of Python 3.11.15, unchanged from 2026.1. See the installation guide for more information.
Included services and frameworks¶
Below is a list as originally shipped with 2026.2:
- Elastic Search - 8.19.19
- EmailEngine - 2.67.1 (opt-out)
- Erlang OTP - 26.2.5.21
- LDC - 12.9.3462
- Microsoft ODBC Driver 18 for SQL Server (MSODBCSQL18) - 18.6.1.1
- Microsoft OLE DB Driver 19 for SQL Server - 19.4.1
- Microsoft Visual C++ 2015 x64 Redistributable (VC Redist) - 14.51.36247
- Microsoft Visual C++ 2015 x86 Redistributable (VC Redist) - 14.51.36247
- Nginx for Windows - 1.31.1.4 SnowDrop
- RabbitMQ Server - 3.13.7
- Redis - 8.10.0
- WinSW - 2.12.0
Security fixes (CVEs) in updated components¶
All fixes since the 2026.1 main release are listed. Fixes marked with * were already delivered in 2026.1 Patch 1.
Elastic Search (8.19.13 → 8.19.19)¶
| CVE | Fixed In | Severity | Description |
|---|---|---|---|
| CVE-2026-56148 | 8.19.17 | Medium (6.5) | DoS via crafted query causing uncontrolled recursion |
| CVE-2026-56149 | 8.19.17 | Medium (4.9) | DoS via crafted machine learning request causing memory exhaustion |
| CVE-2026-63140 | 8.19.19 | Medium (6.5) | DoS via crafted search request triggering a reachable assertion that terminates the node |
| CVE-2026-63144 | 8.19.19 | Medium (6.5) | DoS via crafted search request causing uncontrolled recursion that terminates the node |
| CVE-2026-63263 | 8.19.19 | Medium (6.5) | DoS via crafted ES|QL query causing exponential CPU consumption |
Nginx (1.29.3.1 → 1.31.1.4)¶
| CVE | Fixed In | Severity | Description |
|---|---|---|---|
| CVE-2025-23419* | 1.29.4 | Medium (4.3) | TLSv1.3 SNI session reuse across virtual servers can bypass client SSL certificate verification |
| CVE-2026-1642* | 1.29.5 | Medium (5.9) | Plaintext data injection into the response from an SSL backend (upstream injection) |
| CVE-2026-27654* | 1.29.7 | Medium | Buffer overflow in ngx_http_dav_module on COPY/MOVE with the alias directive |
| CVE-2026-27784* | 1.29.7 | Medium | Buffer overflow / crash in ngx_http_mp4_module on 32-bit platforms |
| CVE-2026-32647* | 1.29.7 | Medium | Buffer overflow / crash in ngx_http_mp4_module on a crafted MP4 file |
| CVE-2026-27651* | 1.29.7 | Low | NULL pointer dereference (segfault) with CRAM-MD5 / APOP authentication |
| CVE-2026-28753* | 1.29.7 | Medium | PTR DNS record injection into auth_http and XCLIENT commands |
| CVE-2026-28755* | 1.29.7 | Medium | Stream SSL handshake succeeds despite OCSP client-certificate rejection (bypass) |
| CVE-2026-42926* | 1.31.0 | Medium (5.8) | HTTP/2 backend request/data injection via proxy_set_body in ngx_http_proxy_module |
| CVE-2026-42945* | 1.31.0 | High (8.1) | Heap buffer overflow in ngx_http_rewrite_module ("NGINX Rift"), potential RCE — exploited in the wild |
| CVE-2026-42946* | 1.31.0 | High | Heap buffer overread in SCGI/uWSGI modules causing oversized allocation / worker crash |
| CVE-2026-42934* | 1.31.0 | Medium | Heap buffer overread in ngx_http_charset_module (UTF-8 off-by-one across proxy buffers) |
| CVE-2026-40460* | 1.31.0 | Medium (6.5) | QUIC / HTTP/3 connection-migration address spoofing |
| CVE-2026-40701* | 1.31.0 | Medium | Use-after-free in resolver / ssl_ocsp DNS response processing |
| CVE-2026-9256* | 1.31.1 | High (8.1) | Heap buffer overflow in ngx_http_rewrite_module ("nginx-poolslip"), potential RCE — exploited in the wild |
| CVE-2026-42055 | 1.31.1.3 | Medium | Heap overflow when proxying crafted requests to HTTP/2 backends (backport of the upstream 1.31.2 fix) |
| CVE-2026-48142 | 1.31.1.3 | Low | Buffer overread in charset_map (backport of the upstream 1.31.2 fix) |
| CVE-2026-42533 | 1.31.1.4 | High (8.1) | Heap buffer overflow in the map directive with regex captures (backport of the upstream 1.31.3 fix) |
| CVE-2026-60005 | 1.31.1.4 | High (8.2) | Uninitialized memory with unnamed regex captures in ngx_http_slice_module, memory disclosure or worker crash (backport of the upstream 1.31.3 fix) |
| CVE-2026-56434 | 1.31.1.4 | Medium (6.5) | Use-after-free in ngx_http_ssi_filter_module via a crafted backend response (backport of the upstream 1.31.3 fix) |
The 1.31.1.2 build also updates the bundled OpenSSL to 3.5.7.
Erlang OTP (26.2.5.18 → 26.2.5.21)¶
| CVE | Fixed In | Severity | Description |
|---|---|---|---|
| CVE-2026-28808* | 26.2.5.19 | High (8.3) | inets/httpd: script_alias CGI mappings bypass directory-based access controls (auth bypass) |
| CVE-2026-28810* | 26.2.5.19 | Medium (6.3) | Built-in DNS resolver uses predictable transaction IDs with no source-port randomization, enabling cache poisoning |
| CVE-2026-32147* | 26.2.5.20 | Medium (5.3) | SFTP daemon stores raw user paths in file handles, allowing attribute modification outside the chroot |
| CVE-2026-42789* | 26.2.5.21 | High (7.0) | public_key: path-validation flaw accepts a non-CA certificate as an intermediate issuer (chain forgery) |
| CVE-2026-42790* | 26.2.5.21 | High (7.6) | public_key: legacy CommonName fallback can bypass domain validation in TLS hostname verification |
Redis (8.2.2 → 8.10.0)¶
| CVE | Fixed In | Severity | Description |
|---|---|---|---|
| CVE-2025-62507* | 8.2.3 | High (7.7) | Stack buffer overflow in XACKDEL with many stream IDs, potential RCE |
| CVE-2026-23479* | 8.2.6 | High (7.7) | Use-after-free in the unblock-client flow, potential RCE |
| CVE-2026-25243* | 8.2.6 | High (7.7) | Invalid memory access in RESTORE via a crafted serialized payload, potential RCE |
| CVE-2026-25588* | 8.2.6 | High (7.7) | Invalid memory access in RESTORE for the RedisTimeSeries module, potential RCE |
| CVE-2026-25589* | 8.2.6 | High (7.7) | Invalid memory access in RESTORE for the RedisBloom module, potential RCE |
| CVE-2026-23631* | 8.2.6 | Medium (6.1) | Lua use-after-free via the master-replica synchronization mechanism, potential RCE |
| None assigned | 8.8.1 | High | Out-of-bounds writes via crafted RESTORE payloads for the RedisBloom and TDigest structures, potential RCE (July 2026 upstream security release) |
EmailEngine (2.58.1 → 2.67.1)¶
No CVEs were assigned to EmailEngine in this range, which was already delivered in 2026.1 Patch 1. The releases included security hardening (bounce-parsing ReDoS protection, OAuth and passkey/authentication hardening, an open-redirect fix) and an update to Handlebars 4.7.9 that resolves a prototype-pollution vulnerability in that dependency.