CVE-2026-27654-PoC

CVE-2026-27654 – nginx ngxhttpdavmodule DAV Alias Path Handling PoC This repository provides a proof‑of‑concept exploit for CVE‑2026‑27654 , a heap‑overflow vulnerability in the ngxhttpdavmodule of nginx. The bug arises from a size‑t underflow when handling MOVE/COPY requests with specially craft...

CentOS Linux 6 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / nginx-mod-http-geoip / etc Multiple Vulnerabilities (CENTOS6:CLSA-2026:1790586276)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1790586276 advisory. - When the ngxmailauthhttpmodule module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes t...

CLSA-2026-1790593993 Fix of 5 CVEs

SECURITY UPDATE: NULL pointer dereference in ngxmailauthhttpmodule when a CRAM-MD5 or APOP authentication attempt is retried - debian/patches/CVE-2026-27651.patch: clear s-passwd with ngxstrnull in ngxmailauthhttpcreaterequest, so the stale length no longer survives into the next auth attempt and...

CentOS Linux 8.5 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1777884034)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1777884034 advisory. - When the ngxmailauthhttpmodule module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker process...

Rocky Linux 9 [CIQ] Security Update: nginx / nginx-all-modules / nginx-core / nginx-core-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_7002)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20267002 advisory. nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files CVE-2026-32647 NGINX: NGINX: Denial of Service or file modification via...

Rocky Linux 8 [CIQ] Security Update: nginx / nginx-all-modules / nginx-debuginfo / nginx-debugsource / etc Multiple Vulnerabilities (crlsa-2026_6907)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20266907 advisory. nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files CVE-2026-32647 NGINX: NGINX: Denial of Service or file modification via...

Rocky Linux 10.1 [CIQ] Security Update: nginx / nginx-all-modules / nginx-core / nginx-core-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_6906)

The Rocky Linux 10.1 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20266906 advisory. nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files CVE-2026-32647 NGINX: NGINX: Denial of Service or file modification vi...

Rocky Linux 9 [CIQ] Security Update: nginx / nginx-all-modules / nginx-core / nginx-core-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_7343)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20267343 advisory. nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files CVE-2026-32647 NGINX: NGINX: Denial of Service or file modification via...

Rocky Linux 9 [CIQ] Security Update: nginx / nginx-all-modules / nginx-core / nginx-core-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_6923)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20266923 advisory. nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files CVE-2026-32647 NGINX: NGINX: Denial of Service or file modification via...

AlmaLinux 9.2 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc (ALMALINUX9.2:CLSA-2026:1776766448)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1776766448 advisory. - NGINX Open Source and NGINX Plus have a vulnerability in the ngxhttpdavmodule module that might allow an attacker to trigger a buffer...

CentOS Linux 7 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / nginx-mod-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1790172301)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1790172301 advisory. - When the ngxmailauthhttpmodule module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes t...

AlmaLinux 9.6 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1776446328)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776446328 advisory. - When the ngxmailauthhttpmodule module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker process...

Rocky Linux 9.6 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-core / nginx-filesystem / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1776446328)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776446328 advisory. - When the ngxmailauthhttpmodule module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker...

CentOS Linux 8 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1777883924)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1777883924 advisory. - The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams...

CentOS Linux 8.4 [TuxCare] Security Update: nginx / nginx-all-modules / nginx-filesystem / etc (CENTOS8.4:CLSA-2026:1777396606)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1777396606 advisory. - NGINX Open Source and NGINX Plus have a vulnerability in the ngxhttpdavmodule module that might allow an attacker to trigger a buffer...

CLSA-2026-1790172301 nginx: Fix of 3 CVEs

CVE-2026-27651: fix null pointer dereference in ngxmailauthhttpmodule when clearing the password in auth http requests with CRAM-MD5/APOP - CVE-2026-27654: fix heap buffer overflow in ngxhttpdavmodule when a COPY/MOVE destination URI is shorter than the location alias - CVE-2026-27654: also...

CLSA-2026-1790180493 nginx: Fix of 3 CVEs

CVE-2026-27651: fix null pointer dereference in ngxmailauthhttpmodule when clearing the password in auth http requests with CRAM-MD5/APOP - CVE-2026-27654: fix heap buffer overflow in ngxhttpdavmodule when a COPY/MOVE destination URI is shorter than the location alias - CVE-2026-27654: also...

nginx:1.24 security update

1.24.0-3.5.0.1 - Remove Red Hat references Orabug: 29498217 1:1.24.0-3.5 - Resolves: RHEL-212457 - nginx:1.24/nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533 1:1.24.0-3.4 - Resolves: RHEL-217957 - nginx:1.24/nginx: NGINX: Memory disclosure and denial of service in...

nginx security update

1.20.1-28.0.1.el98.6 - Reference oracle-indexhtml within Requires Orabug: 33802044 - Remove Red Hat references Orabug: 29498217 - Update upstream references Orabug: 36579090 2:1.20.1-28.6 - Resolves: RHEL-212458 - nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533...

nginx:1.24 security update

1.24.0-7.0.1.4 - Reference oracle-indexhtml within Requires Orabug: 33802044 - Remove Red Hat references Orabug: 29498217 1:1.24.0-7.4 - Resolves: RHEL-219310 - nginx: NGINX: Heap buffer over-read allows memory modification or denial of service CVE-2026-56434 - Resolves: RHEL-217962 - nginx: NGIN...