Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 12

Vulnerabilities 8

• High 8.2
  CVE-2026-27654 Public exploit EPSS 26%

  NGINX ngx_http_dav_module vulnerability

  NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modifica…

  F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 24, 2026
• High 7.8
  CVE-2026-27784

  NGINX ngx_http_mp4_module vulnerability

  The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NGINX worker memory resulting in its termination, using a specially crafted MP4 file. The issue only…

  F5 NGINX Open Source nginx nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 24, 2026
• High 7.8
  CVE-2026-32647

  NGINX ngx_http_mp4_module vulnerability

  NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a spec…

  F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 24, 2026
• High 7.5
  CVE-2026-27651

  NGINX ngx_mail_auth_http_module vulnerability

  When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server …

  F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 24, 2026
• Medium 5.9
  CVE-2026-1642

  NGINX vulnerability

  A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's contro…

  F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  Feb 4, 2026
• Medium 5.4
  CVE-2026-28755 Public exploit

  NGINX ngx_stream_ssl_module vulnerability

  NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocsp on directives, allowing the TLS handshake to succeed even…

  F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 24, 2026
• Low 3.7
  CVE-2025-53859

  NGINX ngx_mail_smtp_module vulnerability

  NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to th…

  F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  Aug 13, 2025
• Low 3.7
  CVE-2026-28753

  NGINX ngx_mail_proxy_module vulnerability

  NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, le…

  F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 24, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2025-53859
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-27654
• report
  https://access.redhat.com/security/cve/CVE-2026-27784
• report
  https://access.redhat.com/security/cve/CVE-2026-28755
• report
  https://access.redhat.com/security/cve/CVE-2026-28753
• report
  https://access.redhat.com/security/cve/CVE-2026-27651
• report
  https://access.redhat.com/security/cve/CVE-2026-32647
• report
  https://access.redhat.com/security/cve/CVE-2026-1642
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8346.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2388238
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-53859
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-53859
• article
  https://my.f5.com/manage/s/article/K000152786
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2436738
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-1642
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-1642
• article
  https://my.f5.com/manage/s/article/K000159824
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2450791
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-27651
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-27651
• article
  https://my.f5.com/manage/s/article/K000160383
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2450776
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-27654
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-27654
• article
  https://my.f5.com/manage/s/article/K000160382
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2450785
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-27784
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-27784
• article
  https://my.f5.com/manage/s/article/K000160364
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2450780
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-28753
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-28753
• article
  https://my.f5.com/manage/s/article/K000160367
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2450779
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-28755
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-28755
• article
  https://my.f5.com/manage/s/article/K000160368