RLSA-2026:98529 — Important: nginx security update

Summary

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

* NGINX: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module (CVE-2026-27654)

* NGINX: NGINX: Denial of Service due to memory corruption via crafted MP4 file (CVE-2026-27784)

* NGINX: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled (CVE-2026-27651)

* nginx: nginx: heap-based buffer overflow in ngx_http_core_module via alias with rewrite referencing $request_filename (CVE-2026-15176)

* nginx: NGINX ngx_http_core_module vulnerability (CVE-2026-97205)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 66

Release	Package	Fixed in
Rocky Linux · 9	nginx	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-all-modules	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-core	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-core	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-core	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-core	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-core-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-core-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-core-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-core-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-debugsource	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-debugsource	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-debugsource	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-debugsource	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-filesystem	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-devel	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-devel	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-devel	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-devel	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-http-image-filter	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-http-image-filter	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-http-image-filter	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-http-image-filter	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-http-image-filter-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-http-image-filter-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-http-image-filter-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-http-image-filter-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-http-perl	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-http-perl	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-http-perl	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-http-perl	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-http-perl-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-http-perl-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-http-perl-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-http-perl-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-http-xslt-filter	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-http-xslt-filter	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-http-xslt-filter	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-http-xslt-filter	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-http-xslt-filter-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-http-xslt-filter-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-http-xslt-filter-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-http-xslt-filter-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-mail	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-mail	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-mail	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-mail	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-mail-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-mail-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-mail-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-mail-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-stream	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-stream	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-stream	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-stream	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-stream-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-stream-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-stream-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1
Rocky Linux · 9	nginx-mod-stream-debuginfo	2:1.20.1-32.el9_9.1.rocky.0.1

Vulnerabilities 5

High 8.2

CVE-2026-27654 Public exploit EPSS 26%

NGINX ngx_http_dav_module vulnerability

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modifica…

F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi

Mar 24, 2026
High 8.1

CVE-2026-15176 Public exploit

NGINX ngx_http_core_module vulnerability

A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achi…

F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi

Oct 14, 2026
High 8.1

CVE-2026-97205 Public exploit

NGINX ngx_http_core_module vulnerability

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a U…

F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi

Oct 14, 2026
High 7.8

CVE-2026-27784

NGINX ngx_http_mp4_module vulnerability

The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NGINX worker memory resulting in its termination, using a specially crafted MP4 file. The issue only…

F5 NGINX Open Source nginx nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi

Mar 24, 2026
High 7.5

CVE-2026-27651

NGINX ngx_mail_auth_http_module vulnerability

When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server …

F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi

Mar 24, 2026

References

report
https://bugzilla.redhat.com/show_bug.cgi?id=2450776
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450785
report
https://bugzilla.redhat.com/show_bug.cgi?id=2450791
report
https://bugzilla.redhat.com/show_bug.cgi?id=2552352
report
https://bugzilla.redhat.com/show_bug.cgi?id=2552359
advisory
https://access.redhat.com/errata/RHSA-2026:98529

Important: nginx security update

Summary

Fixed packages 66

Vulnerabilities 5

NGINX ngx_http_dav_module vulnerability

NGINX ngx_http_core_module vulnerability

NGINX ngx_http_core_module vulnerability

NGINX ngx_http_mp4_module vulnerability

NGINX ngx_mail_auth_http_module vulnerability

References