Summary
nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.
Security Fix(es):
* nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files (CVE-2026-32647)
* NGINX: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module (CVE-2026-27654)
* NGINX: NGINX: Denial of Service due to memory corruption via crafted MP4 file (CVE-2026-27784)
* NGINX: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled (CVE-2026-27651)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | nginx | 2:1.20.1-24.el9_7.2.alma.1 |
| AlmaLinux · 9 | nginx-all-modules | 2:1.20.1-24.el9_7.2.alma.1 |
| AlmaLinux · 9 | nginx-core | 2:1.20.1-24.el9_7.2.alma.1 |
| AlmaLinux · 9 | nginx-filesystem | 2:1.20.1-24.el9_7.2.alma.1 |
| AlmaLinux · 9 | nginx-mod-devel | 2:1.20.1-24.el9_7.2.alma.1 |
| AlmaLinux · 9 | nginx-mod-http-image-filter | 2:1.20.1-24.el9_7.2.alma.1 |
| AlmaLinux · 9 | nginx-mod-http-perl | 2:1.20.1-24.el9_7.2.alma.1 |
| AlmaLinux · 9 | nginx-mod-http-xslt-filter | 2:1.20.1-24.el9_7.2.alma.1 |
| AlmaLinux · 9 | nginx-mod-mail | 2:1.20.1-24.el9_7.2.alma.1 |
| AlmaLinux · 9 | nginx-mod-stream | 2:1.20.1-24.el9_7.2.alma.1 |
Vulnerabilities 4
-
High 8.2
NGINX ngx_http_dav_module vulnerability
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modifica…
-
High 7.8
NGINX ngx_http_mp4_module vulnerability
The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NGINX worker memory resulting in its termination, using a specially crafted MP4 file. The issue only…
-
High 7.8
NGINX ngx_http_mp4_module vulnerability
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a spec…
-
High 7.5
NGINX ngx_mail_auth_http_module vulnerability
When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server …
References
-
report
https://access.redhat.com/security/cve/CVE-2026-27651
-
report
https://access.redhat.com/security/cve/CVE-2026-27654
-
report
https://access.redhat.com/security/cve/CVE-2026-27784
-
report
https://access.redhat.com/security/cve/CVE-2026-32647
-
report
https://bugzilla.redhat.com/2449598
-
report
https://bugzilla.redhat.com/2450776
-
report
https://bugzilla.redhat.com/2450785
-
report
https://bugzilla.redhat.com/2450791
-
advisory
https://errata.almalinux.org/9/ALSA-2026-7002.html