CentOS Linux 6 [TuxCare] Security Update: httpd / httpd-devel / httpd-manual / httpd-tools / mod_ssl (CENTOS6:CLSA-2026:1781253209)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1781253209 advisory. - Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query string to...

CentOS Linux 7 [TuxCare] Security Update: httpd / httpd-devel / httpd-manual / httpd-tools / mod_ldap / etc (CENTOS7:CLSA-2026:1767970357)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1767970357 advisory. - Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query string to...

Rocky Linux 9 [CIQ] Security Update: httpd / httpd-core / httpd-core-debuginfo / httpd-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_23919)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202523919 advisory. httpd: Apache HTTP Server: CGI environment variable override CVE-2025-65082 httpd: Apache HTTP Server: moduserdir+suexec bypass via AllowOverride FileInfo...

Rocky Linux 10.1 [CIQ] Security Update: httpd / httpd-core / httpd-core-debuginfo / httpd-debuginfo / etc Multiple Vulnerabilities (crlsa-2025_23932)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202523932 advisory. httpd: Apache HTTP Server: CGI environment variable override CVE-2025-65082 httpd: Apache HTTP Server: moduserdir+suexec bypass via AllowOverride...

CentOS Linux 8 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc (CENTOS-STREAM8:CLSA-2026:1767800942)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1767800942 advisory. - Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query...

CentOS Linux 8.4 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc (CENTOS8.4:CLSA-2026:1767613214)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1767613214 advisory. - Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query strin...

AlmaLinux 9.6 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc (ALMALINUX9.6:CLSA-2025:1767027096)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1767027096 advisory. - Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query strin...

Rocky Linux 9.6 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc (ALMALINUX9.6:CLSA-2025:1767027096)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1767027096 advisory. - Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query...

AlmaLinux 9.2 [TuxCare] Security Update: httpd / httpd-core / httpd-devel / httpd-filesystem / httpd-manual / etc (ALMALINUX9.2:CLSA-2025:1767004508)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1767004508 advisory. - Apache HTTP Server 2.4.65 and earlier with Server Side Includes SSI enabled and modcgid but not modcgi passes the shell-escaped query strin...

...[ More ]

Payara Server contains a vulnerability in its Server-Side Includes SSI implementation that allows arbitrary operating system command execution via the exec directive. The issue occurs because user-controlled SSI directives are passed directly to Runtime.exec without validation, sanitization, or...

Amazon Linux 2 : nginx, --advisory ALAS2NGINX1-2026-015 (ALASNGINX1-2026-015)

The version of nginx installed on the remote host is prior to 1.30.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NGINX1-2026-015 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string...

Oracle Linux 8 : httpd:2.4 (ELSA-2026-42828)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42828 advisory. - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server modproxyajp: Arbitrary code execution via heap-based buffer overflow CVE-2026-28780 -...

USN-8563-2: nginx regression

USN-8563-1 fixed vulnerabilities in nginx. One of the fixes introduced ABI changes that could cause issues with external modules. This update reverts the fix for CVE-2026-42533 pending further investigation. We apologize for the inconvenience. Original advisory details: It was discovered that ngi...

USN-8563-1: nginx vulnerabilities

It was discovered that nginx incorrectly handled certain map directives using regex matching and capture variables. A remote attacker could use this issue to cause nginx to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2026-42533 It was discovered that nginx had...

USN-8563-1 nginx vulnerabilities

It was discovered that nginx incorrectly handled certain map directives using regex matching and capture variables. A remote attacker could use this issue to cause nginx to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2026-42533 It was discovered that nginx had...

NGINX ngx_http_ssi_module vulnerability

...

Angie -- multiple vulnerabilities

The Angie Software Team reports: When evaluating a string expression in which unnamed capture variables $1, $2, etc. preceded a map directive variable whose value is determined by a regular expression, or when using a non-cacheable volatile map directive variable whose key contained a capture...

CVE-2026-56434

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist when the Server-Side Includes SSI, proxypass, and proxybuffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle MITM abili...

Linux Distros Unpatched Vulnerability : CVE-2026-56434

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist when the Server-Side Includes SSI, proxypass,...

CVE-2026-56434

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist when the Server-Side Includes SSI, proxypass, and proxybuffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle MITM abili...