CVE-2026-27654

CVE-2026-27654 NGINX ngxhttpdavmodule 堆缓冲区溢出，通过 sizet 下溢（远程DoS / 潜在RCE） 描述 src/http/modules/ngxhttpdavmodule.c 中的 ngxhttpdavcopymovehandler 通过从 Destination 头的 URI 路径组件中减去位置前缀长度来计算目标 URI 的长度。两个值都是 sizet（无符号 64 位）。当目标路径短于位置前缀时，减法会环绕到 0，从而产生巨大的 memcpy 长度，溢出 7 字节的堆分配并导致工作进程崩溃。 向使用 alias 映射的 DAV...

USN-8210-1 nginx vulnerabilities

It was discovered that the nginx ngxmailauthhttpmodule module incorrectly handled certain requests. An attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service. CVE-2026-27651 It was discovered that the nginx ngxhttpdavmodule module incorrectly handled...

BIT-NGINX-2026-27654 NGINX ngx_http_dav_module vulnerability

NGINX Open Source and NGINX Plus have a vulnerability in the ngxhttpdavmodule module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names...

CVE-2026-27654

NGINX Open Source and NGINX Plus have a vulnerability in the ngxhttpdavmodule module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names...

K000160336: Out-of-band Security Notification (March 24, 2026)

Security Advisory Description On March 24, 2026, F5 announced the following security issues. This document is intended to serve as an overview of these vulnerabilities to help determine the impact to your F5 devices. You can find the details of each issue in the associated articles. High CVEs...

K000160382: NGINX ngx_http_dav_module vulnerability CVE-2026-27654

Security Advisory Description NGINX Open Source and NGINX Plus have a vulnerability in the ngxhttpdavmodule module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of...