Skip to content
OpenAdvisories
High RHSA-2026:20351 4 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published May 26, 2026 · Updated Oct 17, 2026

Ecosystem: Red Hat

Fixed packages 12

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 nginx 0:1.30.2-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nginx-all-modules 0:1.30.2-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nginx-core 0:1.30.2-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nginx-filesystem 0:1.30.2-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nginx-mod-devel 0:1.30.2-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nginx-mod-http-geoip 0:1.30.2-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nginx-mod-http-image-filter 0:1.30.2-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nginx-mod-http-perl 0:1.30.2-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nginx-mod-http-xslt-filter 0:1.30.2-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nginx-mod-mail 0:1.30.2-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nginx-mod-stream 0:1.30.2-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 nginx-mod-stream-geoip 0:1.30.2-1.hum1

Vulnerabilities 4

  • High 8.1
    CVE-2026-42530 Public exploit

    NGINX Open-Source ngx_http_v3_module vulnerability

    NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session…

    F5 NGINX Open Source nginx-mainline Network devices Wolfi
  • High 8.1
    CVE-2026-9256 Public exploit EPSS 11%

    NGINX ngx_http_rewrite_module vulnerability

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/…

    F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.5
    CVE-2026-40460

    NGINX ngx_quic_module vulnerability

    When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note: Software versions which have reached End of Tec…

    F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 5.8
    CVE-2026-42926 Public exploit

    NGINX ngx_http_proxy_v2_module vulnerability

    When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer.  Note: Software versions which have reached …

    F5 NGINX Open Source nginx nginx-mainline Network devices Debian Wolfi

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-40460
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-42926
  • report
    https://access.redhat.com/security/cve/CVE-2026-9256
  • report
    https://access.redhat.com/security/cve/CVE-2026-42530
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20351.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2480746
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-9256
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-9256
  • article
    https://my.f5.com/manage/s/article/K000161377
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477113
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-40460
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-40460
  • article
    https://my.f5.com/manage/s/article/K000161068
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2489872
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42530
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42530
  • article
    https://my.f5.com/manage/s/article/K000161616
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477068
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-42926
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-42926
  • article
    https://my.f5.com/manage/s/article/K000161131