[CLSA-2026:1792164102] nginx: Fix of CVE-2026-15176
Type:
security
Severity:
Critical
Release date:
2026-10-16 15:21:53 UTC
Description:
- CVE-2026-15176: reject "alias" URI to path mapping in ngx_http_map_uri_to_path() after a rewrite changed the URI and before a new location is selected, and invalidate the location after a standalone "break" following a rewrite, preventing a heap buffer overflow
CVEs fixed:
Updated packages:
  • nginx-1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17.i686.rpm
    sha:a38ffc7ff3c4d19ec07c3b4ffa02b4c9a17abac2c254d24c258bdea75a0ea2ca
  • nginx-1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17.x86_64.rpm
    sha:7b82adc70d7dad1f4692dd56c6c2175c09165f9b7fa50db0b70c5e8226376ef2
  • nginx-all-modules-1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17.noarch.rpm
    sha:542dba341c168d6b908cca06f419d6f725bfb59b2a4f7b5b6f7f351c4a82db90
  • nginx-filesystem-1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17.noarch.rpm
    sha:44fad5e1a2f7ef88d2f3d78dcfa79779d5012fc6a3215a8a3f6d2c1ef6d2619c
  • nginx-mod-http-image-filter-1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17.i686.rpm
    sha:a711258a0e66a7a0b9e4a9520b53ca3eb03e0aad3805b89024eefd1f37d01837
  • nginx-mod-http-image-filter-1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17.x86_64.rpm
    sha:6aa9c61b11c7bef532589b3e83c0f946353af97a9511db2de99160a546865887
  • nginx-mod-http-perl-1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17.i686.rpm
    sha:9aaca650eff7eebba2ec4e0203661f34bfbe3e0f2eabedc3ea8a03457659caad
  • nginx-mod-http-perl-1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17.x86_64.rpm
    sha:66663ab2adde7f88ec2498a23b8f7010a61436738bf5d891f2c101eb09049390
  • nginx-mod-http-xslt-filter-1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17.i686.rpm
    sha:90c4f19f618b33e459048501fdbf108bad06215bf5b8909bf751865e59989bb4
  • nginx-mod-http-xslt-filter-1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17.x86_64.rpm
    sha:8c0e72403c8bbe2c37699e90dc7c0343444c2db96b512c847f89e95d917b5671
  • nginx-mod-mail-1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17.i686.rpm
    sha:a1011c224b10477307cd4aa32bc5ad7ca0e6aebb978f1f695bbb2f2991c6038e
  • nginx-mod-mail-1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17.x86_64.rpm
    sha:e414867089df4fdb332ca08b4164878666a7254cd8fd0afcd83f50f905355541
  • nginx-mod-stream-1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17.i686.rpm
    sha:60cd2432d4e525076cc2474c58d43c01185d8897b01aa6c5ad32de23d252f1e7
  • nginx-mod-stream-1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17.x86_64.rpm
    sha:794c55fb64eaa2745fb2cdf7b1da842e893a8039c1fd1ac022a87070c62bfb9c
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.