nginx:1.26 security update

1.26.3-9.4.0.1 - Require oracle-indexhtml 2:1.26.3-14 - Fixes CVE-2026-42533 2:1.26.3-13 - Fixes CVE-2026-56434 and CVE-2026-60005 2:1.26.3-12 - Resolves: RHEL-191774 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI causing crashes 2:1.26.3-11 - nginx:1.26/nginx: HTTP/2: Remote Denial of Servic...

PT-2026-92035

NGINX Plus and NGINX Open Source have a vulnerability in the ngx http v3 module module. When using HTTP/3 with OpenSSL versions = OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner...

CVE-2026-90439: Heap-based Buffer Overflow

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with OpenSSL versions = OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner th...

AlmaLinux 8 : nginx:1.24 (ALSA-2026:67315)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67315 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the AlmaLinux...

nginx -- buffer overflow when using ngx_http_v3_module

The nginx development team reports: Buffer overflow when using ngxhttpv3module CVE-2026-90439. Severity: medium. A heap memory buffer overflow might occur in a worker process under certain configurations when using HTTP/3 with OpenSSL 3.5.0 and earlier...

AlmaLinux 9 : nginx:1.24 (ALSA-2026:67308)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67308 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the AlmaLinux...

nginx:1.24 security update

1.24.0-7.5.0.1 - Reference oracle-indexhtml within Requires Orabug: 33802044 - Remove Red Hat references Orabug: 29498217 1:1.24.0-7.5 - Resolves: RHEL-212508 - nginx:1.24/nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 1:1.24.0-7.4 - Resolves: RHEL-219310 - nginx:...

nginx security update

1.26.3-6.0.1.el102.7 - Reference oracle-indexhtml within Requires Orabug: 33802044 2:1.26.3-6.7 - Resolves: RHEL-212454 - nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 2:1.26.3-6.6 - Resolves: RHEL-219313 - nginx: NGINX: Heap buffer over-read allows memory...

RockyLinux 10 : nginx (RLSA-2026:67314)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67314 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the RockyLin...

Oracle Linux 9 : ELSA-2026-67283-0: / nginx:1.26 (ELSA-2026-672830)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-672830 advisory. - Fixes CVE-2026-42533 - Fixes CVE-2026-56434 and CVE-2026-60005 - nginx: code execution and denial of service CVE-2026-9256 - Resolves: RHEL-176218 -...

Oracle Linux 10 : ELSA-2026-67314-0: / nginx (ELSA-2026-673140)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-673140 advisory. - Resolves: RHEL-212454 - nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 - Resolves: RHEL-219313 - nginx: NGINX: Heap buffer...

AlmaLinux 10 : nginx (ALSA-2026:67314)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67314 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the AlmaLinux...

nginx:1.24 security update

An update is available for nginx, module.nginx. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list nginx is a web and proxy server supporting HTTP and other...

nginx:1.26 security update

An update is available for nginx, module.nginx. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list nginx is a web and proxy server supporting HTTP and other...

RLSA-2026:67283 Moderate: nginx:1.26 security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 For more details about the security issues, including the impac...

RLSA-2026:67308 Moderate: nginx:1.24 security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 For more details about the security issues, including the impac...

RLSA-2026:67315 Moderate: nginx:1.24 security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fixes: nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 For more details about the security issues, including the impac...

nginx:1.24 security update

An update is available for nginx, module.nginx. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list nginx is a web and proxy server supporting HTTP and other...

nginx: NGINX: Arbitrary code execution via crafted HTTP requests

A flaw was found in NGINX. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests when the map directive uses regular expression regex matching and references regex capture variables before referencing the map output variable. This can lead to a heap...

Moderate: Red Hat Security Advisory: nginx:1.24 security update

An update for the nginx:1.24 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...