Medium RHSA-2026:4235 1 CVE

Red Hat Security Advisory: nginx:1.26 security update

Published Mar 11, 2026 · Updated Jul 9, 2026

Ecosystem: Red Hat

Fixed packages 18

Release	Package	Fixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream	nginx	2:1.26.3-2.module+el9.7.0+24008+f3da7534
Red Hat · RHEL 9 enterprise_linux:9::appstream	nginx-all-modules	2:1.26.3-2.module+el9.7.0+24008+f3da7534
Red Hat · RHEL 9 enterprise_linux:9::appstream	nginx-core	2:1.26.3-2.module+el9.7.0+24008+f3da7534
Red Hat · RHEL 9 enterprise_linux:9::appstream	nginx-core-debuginfo	2:1.26.3-2.module+el9.7.0+24008+f3da7534
Red Hat · RHEL 9 enterprise_linux:9::appstream	nginx-debuginfo	2:1.26.3-2.module+el9.7.0+24008+f3da7534
Red Hat · RHEL 9 enterprise_linux:9::appstream	nginx-debugsource	2:1.26.3-2.module+el9.7.0+24008+f3da7534
Red Hat · RHEL 9 enterprise_linux:9::appstream	nginx-filesystem	2:1.26.3-2.module+el9.7.0+24008+f3da7534
Red Hat · RHEL 9 enterprise_linux:9::appstream	nginx-mod-devel	2:1.26.3-2.module+el9.7.0+24008+f3da7534
Red Hat · RHEL 9 enterprise_linux:9::appstream	nginx-mod-http-image-filter	2:1.26.3-2.module+el9.7.0+24008+f3da7534
Red Hat · RHEL 9 enterprise_linux:9::appstream	nginx-mod-http-image-filter-debuginfo	2:1.26.3-2.module+el9.7.0+24008+f3da7534
Red Hat · RHEL 9 enterprise_linux:9::appstream	nginx-mod-http-perl	2:1.26.3-2.module+el9.7.0+24008+f3da7534
Red Hat · RHEL 9 enterprise_linux:9::appstream	nginx-mod-http-perl-debuginfo	2:1.26.3-2.module+el9.7.0+24008+f3da7534
Red Hat · RHEL 9 enterprise_linux:9::appstream	nginx-mod-http-xslt-filter	2:1.26.3-2.module+el9.7.0+24008+f3da7534
Red Hat · RHEL 9 enterprise_linux:9::appstream	nginx-mod-http-xslt-filter-debuginfo	2:1.26.3-2.module+el9.7.0+24008+f3da7534
Red Hat · RHEL 9 enterprise_linux:9::appstream	nginx-mod-mail	2:1.26.3-2.module+el9.7.0+24008+f3da7534
Red Hat · RHEL 9 enterprise_linux:9::appstream	nginx-mod-mail-debuginfo	2:1.26.3-2.module+el9.7.0+24008+f3da7534
Red Hat · RHEL 9 enterprise_linux:9::appstream	nginx-mod-stream	2:1.26.3-2.module+el9.7.0+24008+f3da7534
Red Hat · RHEL 9 enterprise_linux:9::appstream	nginx-mod-stream-debuginfo	2:1.26.3-2.module+el9.7.0+24008+f3da7534

Vulnerabilities 1

Medium 5.9

CVE-2026-1642

NGINX vulnerability

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's contro…

F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi

Feb 4, 2026

References

article
https://access.redhat.com/security/updates/classification/#moderate
report
https://bugzilla.redhat.com/show_bug.cgi?id=2436738
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_4235.json
report
https://access.redhat.com/security/cve/CVE-2026-1642
advisory
https://www.cve.org/CVERecord?id=CVE-2026-1642
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-1642
article
https://my.f5.com/manage/s/article/K000159824