{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2025-53859: buffer over-read in mail plain/login/cram-md5 auth handlers\n- CVE-2026-28753: auth_http/XCLIENT injection via a resolved client host name\n- CVE-2026-40701: use-after-free in ngx_ssl_ocsp_resolve_handler()\n- CVE-2026-42934: buffer over-read in recode_from_utf8() on split sequences\n- CVE-2026-42946: buffer over-read in scgi/uwsgi status line fallback parsing\n- CVE-2026-48142: buffer over-read in recode_from_utf8() on invalid sequences", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791474754", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791474754" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/tuxcare9.8esu/advisories/2026/clsa-2026_1791474754.json" } ], "tracking": { "current_release_date": "2026-10-08T15:54:29Z", "generator": { "date": "2026-10-08T15:54:29Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1791474754", "initial_release_date": "2026-10-08T15:54:29Z", "revision_history": [ { "date": "2026-10-08T15:54:29Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "nginx: Fix of 6 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "AlmaLinux 9.8", "product": { "name": "AlmaLinux 9.8", "product_id": "AlmaLinux-9.8", "product_identification_helper": { "cpe": "cpe:2.3:o:almalinux:almalinux:9.8:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "AlmaLinux" } ], "category": "vendor", "name": "AlmaLinux OS Foundation" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "Rocky Linux 9.8", "product": { "name": "Rocky Linux 9.8", "product_id": "Rocky Linux-9.8", "product_identification_helper": { "cpe": "cpe:2.3:o:resf:rocky_linux:9.8:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Rocky Linux" } ], "category": "vendor", "name": "Rocky Linux" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "product": { "name": "nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "product_id": "nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nginx-mod-http-image-filter@1.20.1-28.el9_8.6.alma.1.tuxcare.els1?arch=i686&epoch=2" } } }, { "category": "product_version", "name": "nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "product": { "name": "nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "product_id": "nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nginx-core@1.20.1-28.el9_8.6.alma.1.tuxcare.els1?arch=i686&epoch=2" } } }, { "category": "product_version", "name": "nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "product": { "name": "nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "product_id": "nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nginx@1.20.1-28.el9_8.6.alma.1.tuxcare.els1?arch=i686&epoch=2" } } }, { "category": "product_version", "name": "nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "product": { "name": "nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "product_id": "nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nginx-mod-http-xslt-filter@1.20.1-28.el9_8.6.alma.1.tuxcare.els1?arch=i686&epoch=2" } } }, { "category": "product_version", "name": "nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "product": { "name": "nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "product_id": "nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nginx-mod-http-perl@1.20.1-28.el9_8.6.alma.1.tuxcare.els1?arch=i686&epoch=2" } } }, { "category": "product_version", "name": "nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "product": { "name": "nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "product_id": "nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nginx-mod-stream@1.20.1-28.el9_8.6.alma.1.tuxcare.els1?arch=i686&epoch=2" } } }, { "category": "product_version", "name": "nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "product": { "name": "nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "product_id": "nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nginx-mod-mail@1.20.1-28.el9_8.6.alma.1.tuxcare.els1?arch=i686&epoch=2" } } }, { "category": "product_version", "name": "nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "product": { "name": "nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "product_id": "nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nginx-mod-devel@1.20.1-28.el9_8.6.alma.1.tuxcare.els1?arch=i686&epoch=2" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "product": { "name": "nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "product_id": "nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nginx-mod-http-image-filter@1.20.1-28.el9_8.6.alma.1.tuxcare.els1?arch=aarch64&epoch=2" } } }, { "category": "product_version", "name": "nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "product": { "name": "nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "product_id": "nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nginx-core@1.20.1-28.el9_8.6.alma.1.tuxcare.els1?arch=aarch64&epoch=2" } } }, { "category": "product_version", "name": "nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "product": { "name": "nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "product_id": "nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nginx@1.20.1-28.el9_8.6.alma.1.tuxcare.els1?arch=aarch64&epoch=2" } } }, { "category": "product_version", "name": "nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "product": { "name": "nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "product_id": "nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nginx-mod-http-xslt-filter@1.20.1-28.el9_8.6.alma.1.tuxcare.els1?arch=aarch64&epoch=2" } } }, { "category": "product_version", "name": "nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "product": { "name": "nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "product_id": "nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nginx-mod-http-perl@1.20.1-28.el9_8.6.alma.1.tuxcare.els1?arch=aarch64&epoch=2" } } }, { "category": "product_version", "name": "nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "product": { "name": "nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "product_id": "nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nginx-mod-stream@1.20.1-28.el9_8.6.alma.1.tuxcare.els1?arch=aarch64&epoch=2" } } }, { "category": "product_version", "name": "nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "product": { "name": "nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "product_id": "nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nginx-mod-mail@1.20.1-28.el9_8.6.alma.1.tuxcare.els1?arch=aarch64&epoch=2" } } }, { "category": "product_version", "name": "nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "product": { "name": "nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "product_id": "nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nginx-mod-devel@1.20.1-28.el9_8.6.alma.1.tuxcare.els1?arch=aarch64&epoch=2" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "product": { "name": "nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "product_id": "nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nginx-mod-http-image-filter@1.20.1-28.el9_8.6.alma.1.tuxcare.els1?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "product": { "name": "nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "product_id": "nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nginx-core@1.20.1-28.el9_8.6.alma.1.tuxcare.els1?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "product": { "name": "nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "product_id": "nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nginx@1.20.1-28.el9_8.6.alma.1.tuxcare.els1?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "product": { "name": "nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "product_id": "nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nginx-mod-http-xslt-filter@1.20.1-28.el9_8.6.alma.1.tuxcare.els1?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "product": { "name": "nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "product_id": "nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nginx-mod-http-perl@1.20.1-28.el9_8.6.alma.1.tuxcare.els1?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "product": { "name": "nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "product_id": "nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nginx-mod-stream@1.20.1-28.el9_8.6.alma.1.tuxcare.els1?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "product": { "name": "nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "product_id": "nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nginx-mod-mail@1.20.1-28.el9_8.6.alma.1.tuxcare.els1?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "product": { "name": "nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "product_id": "nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nginx-mod-devel@1.20.1-28.el9_8.6.alma.1.tuxcare.els1?arch=x86_64&epoch=2" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "product": { "name": "nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "product_id": "nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nginx-all-modules@1.20.1-28.el9_8.6.alma.1.tuxcare.els1?arch=noarch&epoch=2" } } }, { "category": "product_version", "name": "nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "product": { "name": "nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "product_id": "nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/nginx-filesystem@1.20.1-28.el9_8.6.alma.1.tuxcare.els1?arch=noarch&epoch=2" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686" }, "product_reference": "nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64" }, "product_reference": "nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" }, "product_reference": "nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686" }, "product_reference": "nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" }, "product_reference": "nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64" }, "product_reference": "nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64" }, "product_reference": "nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" }, "product_reference": "nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686" }, "product_reference": "nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686" }, "product_reference": "nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64" }, "product_reference": "nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" }, "product_reference": "nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" }, "product_reference": "nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64" }, "product_reference": "nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686" }, "product_reference": "nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686" }, "product_reference": "nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" }, "product_reference": "nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64" }, "product_reference": "nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64" }, "product_reference": "nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" }, "product_reference": "nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686" }, "product_reference": "nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" }, "product_reference": "nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64" }, "product_reference": "nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686 as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686" }, "product_reference": "nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch" }, "product_reference": "nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch as a component of AlmaLinux 9.8", "product_id": "AlmaLinux-9.8:nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch" }, "product_reference": "nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "relates_to_product_reference": "AlmaLinux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686" }, "product_reference": "nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64" }, "product_reference": "nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" }, "product_reference": "nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686" }, "product_reference": "nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" }, "product_reference": "nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64" }, "product_reference": "nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64" }, "product_reference": "nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" }, "product_reference": "nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686" }, "product_reference": "nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686" }, "product_reference": "nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64" }, "product_reference": "nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" }, "product_reference": "nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" }, "product_reference": "nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64" }, "product_reference": "nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686" }, "product_reference": "nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686" }, "product_reference": "nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" }, "product_reference": "nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64" }, "product_reference": "nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64" }, "product_reference": "nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" }, "product_reference": "nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686" }, "product_reference": "nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" }, "product_reference": "nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64" }, "product_reference": "nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686 as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686" }, "product_reference": "nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch" }, "product_reference": "nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "relates_to_product_reference": "Rocky Linux-9.8" }, { "category": "default_component_of", "full_product_name": { "name": "nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch as a component of Rocky Linux 9.8", "product_id": "Rocky Linux-9.8:nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch" }, "product_reference": "nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "relates_to_product_reference": "Rocky Linux-9.8" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-48142", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with both source_charset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-48142" }, { "category": "external", "summary": "https://my.f5.com/manage/s/article/K000161585", "url": "https://my.f5.com/manage/s/article/K000161585" } ], "release_date": "2026-06-17T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-08T15:52:36.479354Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791474754", "product_ids": [ "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791474754" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-40701", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to \"on\" or \"optional,\" and the ssl_ocsp directive is set to \"on\" or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can send requests along with conditions beyond its control that may cause a heap-use-after-free error in the NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker process restarting.\n\n\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-40701" }, { "category": "external", "summary": "https://my.f5.com/manage/s/article/K000161021", "url": "https://my.f5.com/manage/s/article/K000161021" } ], "release_date": "2026-05-13T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-08T15:52:36.479354Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791474754", "product_ids": [ "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791474754" } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-42946", "cwe": { "id": "CWE-789", "name": "Memory Allocation with Excessive Size Value" }, "notes": [ { "category": "description", "text": "A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-42946" }, { "category": "external", "summary": "https://my.f5.com/manage/s/article/K000161027", "url": "https://my.f5.com/manage/s/article/K000161027" } ], "release_date": "2026-05-13T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-08T15:52:36.479354Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791474754", "product_ids": [ "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791474754" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-53859", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method \"none,\" and (3) the authentication server returns the \"Auth-Wait\" response header.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-53859" }, { "category": "external", "summary": "https://my.f5.com/manage/s/article/K000152786", "url": "https://my.f5.com/manage/s/article/K000152786" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2025/08/13/5", "url": "http://www.openwall.com/lists/oss-security/2025/08/13/5" } ], "release_date": "2025-08-13T15:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-08T15:52:36.479354Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791474754", "product_ids": [ "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791474754" } ], "threats": [ { "category": "impact", "details": "Low" } ] }, { "cve": "CVE-2026-28753", "cwe": { "id": "CWE-93", "name": "Improper Neutralization of CRLF Sequences ('CRLF Injection')" }, "notes": [ { "category": "description", "text": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-28753" }, { "category": "external", "summary": "https://my.f5.com/manage/s/article/K000160367", "url": "https://my.f5.com/manage/s/article/K000160367" } ], "release_date": "2026-03-24T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-08T15:52:36.479354Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791474754", "product_ids": [ "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791474754" } ], "threats": [ { "category": "impact", "details": "Low" } ] }, { "cve": "CVE-2026-42934", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering (\"off\") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.\n\n\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-42934" }, { "category": "external", "summary": "https://my.f5.com/manage/s/article/K000161028", "url": "https://my.f5.com/manage/s/article/K000161028" } ], "release_date": "2026-05-13T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-08T15:52:36.479354Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1791474754", "product_ids": [ "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "AlmaLinux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-all-modules-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-core-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-filesystem-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.noarch", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-devel-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-image-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-http-xslt-filter-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-mail-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.aarch64", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.i686", "Rocky Linux-9.8:nginx-mod-stream-2:1.20.1-28.el9_8.6.alma.1.tuxcare.els1.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1791474754" } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }