8505 matches found
nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module
A vulnerability in the NGINX ngxhttpslicemodule allows remote, unauthenticated attackers to access uninitialized memory via crafted requests. If configured with unnamed regex captures or background cache updates, this flaw can result in limited memory disclosure or a denial-of-service crash...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nginx: nginx-1.30.4-2.hum1 aarch64, x8664 nginx-all-modules-1.30.4-2.hum1 noarch nginx-core-1.30.4-2.hum1 aarch64, x8664 nginx-filesystem-1.30.4-2.hum1 noarch nginx-mod-devel-1.30.4-2.hum1 aarch6...
nginx: NGINX: Arbitrary code execution via crafted HTTP requests
A flaw was found in NGINX. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests when the map directive uses regular expression regex matching and references regex capture variables before referencing the map output variable. This can lead to a heap...
Security update for nginx (important)
openSUSE security update: security update for nginx ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21439-1 Rating: important References: bsc1265228 bsc1267525 bsc1268492 bsc1268495 Cross-References: CVE-2026-40460 CVE-2026-42055 CVE-2026-48142 CVSS...
8x8: @jitsi/docker-jitsi-meet: `/colibri-relay-ws/` unsafe nginx regex (OCTO relay configuration)
An unsafe nginx regex pattern was discovered in the /colibri-relay-ws/ location of the @jitsi/docker-jitsi-meet project. The regex a-zA-Z0-9-\.+ accepted arbitrary domain names and IP addresses for proxypass directives, allowing unauthenticated requests to be proxied to attacker-specified...
blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser
Summary Five independent HTTP/1.1 conformance laxities in blaze's hand-written Java parser http/src/main/java/org/http4s/blaze/http/parser/ cause request-boundary disagreement with a stricter intermediary. All are reachable from a default BlazeServerBuilder with no non-default configuration. Impa...
SUSE-SU-2026:22951-1 Security update for nginx
This update for nginx fixes the following issues - CVE-2026-40460: bypass of authorization and bypass of rate limiting when NGINX is configured to use the HTTP/3 QUIC module bsc1265228. - CVE-2026-42055: heap-based buffer overflow in the ngxhttpproxyv2module and ngxhttpgrpcmodule modules...
SUSE-SU-2026:22943-1 Security update for nginx
This update for nginx fixes the following issues - CVE-2026-40460: bypass of authorization and bypass of rate limiting when NGINX is configured to use the HTTP/3 QUIC module bsc1265228. - CVE-2026-42055: heap-based buffer overflow in the ngxhttpproxyv2module and ngxhttpgrpcmodule modules...
OPENSUSE-SU-2026:21439-1 Security update for nginx
This update for nginx fixes the following issues - CVE-2026-40460: bypass of authorization and bypass of rate limiting when NGINX is configured to use the HTTP/3 QUIC module bsc1265228. - CVE-2026-42055: heap-based buffer overflow in the ngxhttpproxyv2module and ngxhttpgrpcmodule modules...
Vulnerability of the ngx_http_ssi_module module in NGINX Plus and NGINX Open Source servers, allowing attackers to modify memory contents of the worker process or cause service failures.
The vulnerability of the ngxhttpssimodule module in NGINX Plus and NGINX Open Source HTTP servers relates to the possibility of using memory after it is freed. Exploiting this vulnerability allows a remote attacker to modify the memory contents of the working process or cause service failures...
Vulnerability of the ngx_http_slice_module in NGINX Plus and NGINX Open Source servers, allowing attackers to expose protected information or cause service failures.
The vulnerability of the ngxhttpslicemodule in NGINX Plus and NGINX Open Source is related to the use of an uninitialized resource. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information or cause service failures...
nginx: Fix of CVE-2026-42533
CVE-2026-42533: fix heap buffer overflow in the map directive with regex matching script engine buffer overrun protection...
[SECURITY] Fedora 44 Update: nginx-mod-vts-0.2.4-13.fc44
Nginx virtual host traffic status module...
[SECURITY] Fedora 44 Update: nginx-mod-modsecurity-1.0.4-16.fc44
The ModSecurity-nginx connector is the connection point between nginx and libmodsecurity ModSecurity v3. Said another way, this project provides a communication channel between nginx and libmodsecurity. This connector is required to use LibModSecurity with nginx. The ModSecurity-nginx connector...
[SECURITY] Fedora 44 Update: nginx-mod-naxsi-1.6-21.fc44
naxsi is an nginx module that provides score based Web Application Firewall WAF abilities in a highly granular fashion...
[SECURITY] Fedora 44 Update: nginx-mod-brotli-1.0.0~rc-13.fc44
NGINX module for Brotli compression...
[SECURITY] Fedora 44 Update: nginx-mod-fancyindex-0.6.0-8.fc44
The Fancy Index module makes possible the generation of file listings, like the built-in autoindex module does, but adding a touch of style. This is possible because the module allows a certain degree of customization of the generated content: Custom headers. Either local or stored remotely. Cust...
[SECURITY] Fedora 44 Update: nginx-mod-headers-more-0.40-3.fc44
This module allows adding, setting, or clearing specified input/output header s. This is an enhanced version of the standard headers module because it provides more utilities like resetting or clearing "builtin headers" like Content-Type, Content-Length, and Server...