PT-2026-100256

Security vulnerability affects the nginx package. This issue is resolved in later releases. See references for vulnerability details...

OPENSUSE-SU-2026:11807-1 nginx-1.31.6-1.1 on GA media

These are all security issues fixed in the nginx-1.31.6-1.1 package on the GA media of openSUSE Tumbleweed...

MiracleLinux 9 : nginx-1.20.1-28.el9_8.6.ML.1 (AXSA:2026-1857:08)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1857:08 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the...

MiracleLinux 9 : nginx:1.26 (AXSA:2026-1869:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1869:01 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the...

nginx: NGINX ngx_http_v3_module: Denial of Service via TLS handshake heap buffer overflow

A flaw was found in NGINX ngxhttpv3module. A limited heap buffer overflow can occur during a Transport Layer Security TLS handshake when using HTTP/3 with certain OpenSSL versions. This vulnerability may allow remote attackers to cause a denial-of-service DoS on the NGINX system. Additionally, it...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nginx: nginx-1.30.5-4.hum1 aarch64, x8664 nginx-all-modules-1.30.5-4.hum1 noarch nginx-core-1.30.5-4.hum1 aarch64, x8664 nginx-filesystem-1.30.5-4.hum1 noarch nginx-mod-devel-1.30.5-4.hum1 aarch6...

[SECURITY] [DSA 6496-2] nginx regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-6496-2 [email protected] https://www.debian.org/security/ Aron Xu September 16, 2026 https://www.debian.org/security/faq -...

Oracle Linux 8 : ELSA-2026-67315-0: / nginx:1.24 (ELSA-2026-673150)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-673150 advisory. - Resolves: RHEL-212457 - nginx:1.24/nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 - Resolves: RHEL-217957 - nginx:1.24/ngin...

Oracle Linux 9 : ELSA-2026-67308-0: / nginx:1.24 (ELSA-2026-673080)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-673080 advisory. - Resolves: RHEL-212508 - nginx:1.24/nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 - Resolves: RHEL-219310 - nginx: NGINX:...

Linux Distros Unpatched Vulnerability : CVE-2026-90439

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with OpenSSL versions = OpenSSL 3.5.0 under certain...

FreeBSD : nginx -- buffer overflow when using ngx_http_v3_module (7dc8fd4b-b1a7-11f1-a655-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 7dc8fd4b-b1a7-11f1-a655-3497f65b111b advisory. The nginx development team reports: Buffer overflow when using ngxhttpv3module CVE-2026-90439. Severity...

MiracleLinux 9 : nginx:1.24 nginx-1.24.0-7.module+el9+1196+3855d771.5.ML.1 (AXSA:2026-1851:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1851:01 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the...

MiracleLinux 8 : nginx:1.24 nginx-1.24.0-3.module+el8+2045+adfc96b2.5.ML.1 (AXSA:2026-1852:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1852:01 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the...

AlmaLinux 9 : nginx:1.26 (ALSA-2026:67283)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67283 advisory. nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 Tenable has extracted the preceding description block directly from the AlmaLinux...

SUSE CVE-2026-90439

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with OpenSSL versions = OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner th...

CVE-2026-55149 Vouch Proxy: Unbounded Multipart Cookie Allocation DoS

Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the authrequest module. Prior to 0.48.0, Cookie in pkg/cookie/cookie.go parses the total part count from an attacker-controlled multipart cookie name and passes the value to makestring, numParts without checking that the value is...

DEBIAN-CVE-2026-90439

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with OpenSSL versions = OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner th...

CVE-2026-90439

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with OpenSSL versions = OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner th...

CVE-2026-90439

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with OpenSSL versions = OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner th...

CVE-2026-90439

NGINX Plus and Open Source are affected by a heap buffer overflow (CWE-122) in the ngx_http_v3_module when handling HTTP/3 with OpenSSL 3.5.0 or earlier under certain configurations. The overflow occurs during TLS handshake processing in a worker process and is non-deterministic , meaning it is n...