NGINX_2026_CVE_Bundle_CTI_Report

🛡️ NGINX 2026 Multi-CVE CTI Investigation CVE-2026-28755 • CVE-2026-42926 • CVE-2026-9256 • CVE-2026-42055 • CVE-2026-42533 Created by Pratik Chhetri Report Date: 2026-07-28 📌 Executive Snapshot CVE| Component| Primary Issue| Fixed Open Source Versions| Priority ---|---|---|---|--- CVE-2026-28755|...

CentOS Linux 8.5 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc (CENTOS8.5:CLSA-2026:1794513625)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1794513625 advisory. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O AIO is enabled in certain...

CentOS Linux 8.4 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc (CENTOS8.4:CLSA-2026:1794513529)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1794513529 advisory. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpcoremodule module. When asynchronous file I/O AIO is enabled in certain...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: nginx (UTSA-2026-150427)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150427 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: nginx (UTSA-2026-150439)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150439 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return...

Unity Linux 20.1060a / 20.1070a Security Update: nginx (UTSA-2026-150423)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150423 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: nginx (UTSA-2026-150434)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150434 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return...

Unity Linux 20.1060a / 20.1070a Security Update: nginx (UTSA-2026-150435)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-150435 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return...

nginx 0.8.11 < 1.30.4 / 1.31.x < 1.31.3 Use-After-Free Memory Corruption

According to its Server response header, the installed version of nginx is 0.8.11 prior to 1.30.4 or 1.31.x prior to 1.31.3. It is, therefore, affected by the following issue : - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist whe...

Exploit for CVE-2026-116366

CVE-2026-116366 — ClickHouse Server Unauthenticated RCE Brotl...

OESA-2026-4546 nginx security update

NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server. Security Fixes: A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return...

OESA-2026-4544 nginx security update

NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server. Security Fixes: A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return...

OESA-2026-4545 nginx security update

NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server. Security Fixes: A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return...

OESA-2026-4543 nginx security update

NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server. Security Fixes: A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return...

CentOS Linux 7 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / nginx-mod-devel / etc (CENTOS7:CLSA-2026:1793021177)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1793021177 advisory. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpslicemodule module. When the slice directive and unnamed regex captures are...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: nginx (UTSA-2026-146979)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146979 advisory. A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return...

CVE-2026-103391

An Out-of-bounds Write vulnerability in the SSR TCP proxy/optimization path in Juniper Networks Session Smart Router allows an attacker to corrupt forwarded packet data and potentially cause a data-plane crash via a transit TCP packet with a crafted TCP option length...

CVE-2026-103391 Session Smart Router: An attacker-controlled TCP option causes an out-of-bounds write when using the TCP proxy feature

An Out-of-bounds Write vulnerability in the SSR TCP proxy/optimization path in Juniper Networks Session Smart Router allows an attacker to corrupt forwarded packet data and potentially cause a data-plane crash via a transit TCP packet with a crafted TCP option length...

CVE-2026-103391

A vulnerability exists in the SSR TCP proxy/optimization path of the Juniper Networks Session Smart Router . An attacker can trigger an Out-of-bounds Write (CWE-787) by sending a transit TCP packet with a crafted TCP option length . This flaw allows for the corruption of forwarded packet data and...

EUVD-2026-112226

An Out-of-bounds Write vulnerability in the SSR TCP proxy/optimization path in Juniper Networks Session Smart Router allows an attacker to corrupt forwarded packet data and potentially cause a data-plane crash via a transit TCP packet with a crafted TCP option length...