NGINX und NGINX Plus: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 6

• High 8.2
  CVE-2026-27654 Public exploit EPSS 26%

  NGINX ngx_http_dav_module vulnerability

  NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modifica…

  F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 24, 2026
• High 7.8
  CVE-2026-27784

  NGINX ngx_http_mp4_module vulnerability

  The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NGINX worker memory resulting in its termination, using a specially crafted MP4 file. The issue only…

  F5 NGINX Open Source nginx nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 24, 2026
• High 7.8
  CVE-2026-32647

  NGINX ngx_http_mp4_module vulnerability

  NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a spec…

  F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 24, 2026
• High 7.5
  CVE-2026-27651

  NGINX ngx_mail_auth_http_module vulnerability

  When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server …

  F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 24, 2026
• Medium 5.4
  CVE-2026-28755 Public exploit

  NGINX ngx_stream_ssl_module vulnerability

  NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocsp on directives, allowing the TLS handshake to succeed even…

  F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 24, 2026
• Low 3.7
  CVE-2026-28753

  NGINX ngx_mail_proxy_module vulnerability

  NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, le…

  F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 24, 2026

Revision history

1. 2026-11-11 #40

   Neue Updates von Red Hat aufgenommen

2. 2026-09-16 #39

   Neue Updates von Oracle Linux aufgenommen

3. 2026-09-15 #38

   Neue Updates von Oracle Linux aufgenommen

4. 2026-09-13 #37

   Neue Updates von Oracle Linux aufgenommen

5. 2026-09-09 #36

   Neue Updates von Oracle Linux aufgenommen

6. 2026-09-02 #35

   Neue Updates von Oracle Linux aufgenommen

7. 2026-08-26 #34

   Neue Updates von Oracle Linux aufgenommen

8. 2026-08-25 #33

   Neue Updates von Oracle Linux aufgenommen

9. 2026-08-24 #32

   Neue Updates von Oracle Linux aufgenommen

10. 2026-08-16 #31

    Neue Updates von Gentoo aufgenommen

11. 2026-07-23 #30

    Neue Updates von Oracle Linux aufgenommen

12. 2026-07-22 #29

    Neue Updates von Oracle Linux aufgenommen

13. 2026-07-21 #28

    Neue Updates von Oracle Linux aufgenommen

14. 2026-07-13 #27

    Neue Updates von Oracle Linux aufgenommen

15. 2026-07-09 #26

    Neue Updates von Oracle Linux aufgenommen

16. 2026-06-30 #25

    Neue Updates von Oracle Linux aufgenommen

17. 2026-06-29 #24

    Neue Updates von Oracle Linux aufgenommen

18. 2026-06-25 #23

    Neue Updates von Oracle Linux aufgenommen

19. 2026-06-24 #22

    Neue Updates von Oracle Linux aufgenommen

20. 2026-06-23 #21

    Neue Updates von Oracle Linux aufgenommen

21. 2026-06-11 #20

    Neue Updates von SUSE aufgenommen

22. 2026-06-04 #19

    Neue Updates von Ubuntu aufgenommen

23. 2026-05-31 #18

    PoC für CVE-2026-27654 aufgenommen

24. 2026-05-27 #17

    Neue Updates von SUSE und openSUSE aufgenommen

25. 2026-05-25 #16

    Neue Updates von openSUSE und SUSE aufgenommen

References

• EU Vulnerability Database vom 2026-03-24
  https://euvd.enisa.europa.eu/enisa/EUVD-2026-14880
• EU Vulnerability Database vom 2026-03-24
  https://euvd.enisa.europa.eu/enisa/EUVD-2026-14881
• EU Vulnerability Database vom 2026-03-24
  https://euvd.enisa.europa.eu/enisa/EUVD-2026-14883
• EU Vulnerability Database vom 2026-03-24
  https://euvd.enisa.europa.eu/enisa/EUVD-2026-14885
• EU Vulnerability Database vom 2026-03-24
  https://euvd.enisa.europa.eu/enisa/EUVD-2026-14887
• EU Vulnerability Database vom 2026-03-24
  https://euvd.enisa.europa.eu/enisa/EUVD-2026-14897
• F5 Security Advisory vom 2026-03-24
  https://my.f5.com/manage/s/article/K000160383
• F5 Security Advisory vom 2026-03-24
  https://my.f5.com/manage/s/article/K000160382
• F5 Security Advisory vom 2026-03-24
  https://my.f5.com/manage/s/article/K000160364
• F5 Security Advisory vom 2026-03-24
  https://my.f5.com/manage/s/article/K000160367
• F5 Security Advisory vom 2026-03-24
  https://my.f5.com/manage/s/article/K000160368
• F5 Security Advisory vom 2026-03-24
  https://my.f5.com/manage/s/article/K000160366
• Fedora Security Advisory FEDORA-2026-4DE4D247A0 vom 2026-03-25
  https://bodhi.fedoraproject.org/updates/FEDORA-2026-4de4d247a0
• openSUSE Security Update OPENSUSE-SU-2026:10423-1 vom 2026-03-28
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XQVD3WMISNZQSD5MXTECPJHIO3LBJKQ7/
• Oracle Linux Security Advisory ELSA-2026-6906 vom 2026-04-08
  https://linux.oracle.com/errata/ELSA-2026-6906.html
• Red Hat Security Advisory RHSA-2026:6907 vom 2026-04-08
  https://access.redhat.com/errata/RHSA-2026:6907
• Red Hat Security Advisory RHSA-2026:6906 vom 2026-04-08
  https://access.redhat.com/errata/RHSA-2026:6906
• Rocky Linux Security Advisory RLSA-2026:6923 vom 2026-04-08
  https://errata.build.resf.org/RLSA-2026:6923
• Red Hat Security Advisory RHSA-2026:6923 vom 2026-04-08
  https://access.redhat.com/errata/RHSA-2026:6923
• Red Hat Security Advisory RHSA-2026:7002 vom 2026-04-08
  https://access.redhat.com/errata/RHSA-2026:7002
• Oracle Linux Security Advisory ELSA-2026-6923 vom 2026-04-08
  https://linux.oracle.com/errata/ELSA-2026-6923.html
• Rocky Linux Security Advisory RLSA-2026:6907 vom 2026-04-09
  https://errata.build.resf.org/RLSA-2026:6907
• Red Hat Security Advisory RHSA-2026:7343 vom 2026-04-09
  https://access.redhat.com/errata/RHSA-2026:7343
• Oracle Linux Security Advisory ELSA-2026-7002 vom 2026-04-09
  https://linux.oracle.com/errata/ELSA-2026-7002.html
• Oracle Linux Security Advisory ELSA-2026-6907 vom 2026-04-09
  https://linux.oracle.com/errata/ELSA-2026-6907.html
• Rocky Linux Security Advisory RLSA-2026:6906 vom 2026-04-09
  https://errata.build.resf.org/RLSA-2026:6906
• Rocky Linux Security Advisory RLSA-2026:7343 vom 2026-04-10
  https://errata.build.resf.org/RLSA-2026:7343
• Oracle Linux Security Advisory ELSA-2026-7343 vom 2026-04-13
  https://linux.oracle.com/errata/ELSA-2026-7343.html
• Amazon Linux Security Advisory ALAS2NGINX1-2026-011 vom 2026-04-14
  https://alas.aws.amazon.com/AL2/ALAS2NGINX1-2026-011.html
• Red Hat Security Advisory RHSA-2026:10065 vom 2026-04-23
  https://access.redhat.com/errata/RHSA-2026:10065
• Red Hat Security Advisory RHSA-2026:13634 vom 2026-05-05
  https://access.redhat.com/errata/RHSA-2026:13634
• Red Hat Security Advisory RHSA-2026:13839 vom 2026-05-05
  https://access.redhat.com/errata/RHSA-2026:13839
• Red Hat Security Advisory RHSA-2026:13680 vom 2026-05-05
  https://access.redhat.com/errata/RHSA-2026:13680
• Red Hat Security Advisory RHSA-2026:14836 vom 2026-05-07
  https://access.redhat.com/errata/RHSA-2026:14836
• Red Hat Security Advisory RHSA-2026:15943 vom 2026-05-11
  https://access.redhat.com/errata/RHSA-2026:15943
• Red Hat Security Advisory RHSA-2026:15942 vom 2026-05-11
  https://access.redhat.com/errata/RHSA-2026:15942
• SUSE Security Update SUSE-SU-2026:1761-1 vom 2026-05-08
  https://lists.suse.com/pipermail/sle-security-updates/2026-May/025945.html
• Red Hat Security Advisory RHSA-2026:15945 vom 2026-05-11
  https://access.redhat.com/errata/RHSA-2026:15945
• Red Hat Security Advisory RHSA-2026:15966 vom 2026-05-11
  https://access.redhat.com/errata/RHSA-2026:15966
• SUSE Security Update SUSE-SU-2026:1953-1 vom 2026-05-18
  https://lists.suse.com/pipermail/sle-security-updates/2026-May/026102.html
• Debian Security Advisory DLA-4589 vom 2026-05-18
  https://lists.debian.org/debian-lts-announce/2026/05/msg00033.html
• Oracle Linux Security Advisory ELSA-2026-18041 vom 2026-05-19
  https://linux.oracle.com/errata/ELSA-2026-18041.html
• Oracle Linux Security Advisory ELSA-2026-18063 vom 2026-05-19
  https://linux.oracle.com/errata/ELSA-2026-18063.html
• Oracle Linux Security Advisory ELSA-2026-18029 vom 2026-05-20
  https://linux.oracle.com/errata/ELSA-2026-18029.html
• openSUSE Security Update OPENSUSE-SU-2026:20784-1 vom 2026-05-25
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UTZK32Z3NNKJXD4J52BE6RDVWMBNFBIT/
• SUSE Security Update SUSE-SU-2026:2050-1 vom 2026-05-25
  https://lists.suse.com/pipermail/sle-security-updates/2026-May/026275.html
• SUSE Security Update SUSE-SU-2026:21823-1 vom 2026-05-27
  https://lists.suse.com/pipermail/sle-security-updates/2026-May/026325.html
• SUSE Security Update SUSE-SU-2026:21832-1 vom 2026-05-27
  https://lists.suse.com/pipermail/sle-security-updates/2026-May/026319.html
• openSUSE Security Update OPENSUSE-SU-2026:20796-1 vom 2026-05-27
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WKSJMWD6JX2UGTFO6R5SU56Z5VNHLFBU/
• PoC CVE-2026-27654 vom 2026-05-31
  https://github.com/JohannesLks/CVE-2026-27654
• Ubuntu Security Notice USN-8375-1 vom 2026-06-03
  https://ubuntu.com/security/notices/USN-8375-1
• SUSE Security Update SUSE-SU-2026:2370-1 vom 2026-06-11
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026712.html
• Oracle Linux Security Advisory ELSA-2026-19374 vom 2026-06-24
  https://linux.oracle.com/errata/ELSA-2026-19374.html
• Oracle Linux Security Advisory ELSA-2026-28921 vom 2026-06-24
  https://linux.oracle.com/errata/ELSA-2026-28921.html
• Oracle Linux Security Advisory ELSA-2026-19371 vom 2026-06-24
  https://linux.oracle.com/errata/ELSA-2026-19371.html
• Oracle Linux Security Advisory ELSA-2026-29151 vom 2026-06-26
  https://linux.oracle.com/errata/ELSA-2026-29151.html
• Oracle Linux Security Advisory ELSA-2026-28212 vom 2026-06-30
  https://linux.oracle.com/errata/ELSA-2026-28212.html
• Oracle Linux Security Advisory ELSA-2026-28973 vom 2026-07-01
  https://linux.oracle.com/errata/ELSA-2026-28973.html
• Oracle Linux Security Advisory ELSA-2026-36639 vom 2026-07-09
  https://linux.oracle.com/errata/ELSA-2026-36639.html
• Oracle Linux Security Advisory ELSA-2026-36618 vom 2026-07-09
  https://linux.oracle.com/errata/ELSA-2026-36618.html
• Oracle Linux Security Advisory ELSA-2026-36331 vom 2026-07-14
  https://linux.oracle.com/errata/ELSA-2026-36331.html
• Oracle Linux Security Advisory ELSA-2026-19159 vom 2026-07-22
  https://linux.oracle.com/errata/ELSA-2026-19159.html
• Oracle Linux Security Advisory ELSA-2026-36364 vom 2026-07-22
  https://oss.oracle.com/pipermail/el-errata/2026-July/021224.html
• Oracle Linux Security Advisory ELSA-2026-29874 vom 2026-07-23
  https://linux.oracle.com/errata/ELSA-2026-29874.html
• Gentoo Linux Security Advisory GLSA-202608-16 vom 2026-08-17
  https://security.gentoo.org/glsa/202608-16
• Oracle Linux Security Advisory ELSA-2026-59220 vom 2026-08-25
  https://linux.oracle.com/errata/ELSA-2026-59220.html
• Oracle Linux Security Advisory ELSA-2026-59216 vom 2026-08-26
  https://linux.oracle.com/errata/ELSA-2026-59216.html
• Oracle Linux Security Advisory ELSA-2026-59496 vom 2026-08-26
  https://linux.oracle.com/errata/ELSA-2026-59496.html
• Oracle Linux Security Advisory ELSA-2026-59490 vom 2026-09-02
  https://linux.oracle.com/errata/ELSA-2026-59490.html
• Oracle Linux Security Advisory ELSA-2026-59362 vom 2026-09-09
  http://linux.oracle.com/errata/ELSA-2026-59362.html
• Oracle Linux Security Advisory ELSA-2026-66542 vom 2026-09-11
  https://linux.oracle.com/errata/ELSA-2026-66542-0.html
• Oracle Linux Security Advisory ELSA-2026-67314 vom 2026-09-15
  https://linux.oracle.com/errata/ELSA-2026-67314-0.html
• Oracle Linux Security Advisory ELSA-2026-67308 vom 2026-09-16
  https://linux.oracle.com/errata/ELSA-2026-67308-0.html
• Oracle Linux Security Advisory ELSA-2026-67283 vom 2026-09-15
  https://linux.oracle.com/errata/ELSA-2026-67283-0.html
• Oracle Linux Security Advisory ELSA-2026-67315 vom 2026-09-16
  https://linux.oracle.com/errata/ELSA-2026-67315-0.html
• Red Hat Security Advisory RHSA-2026:98529 vom 2026-11-11
  https://access.redhat.com/errata/RHSA-2026:98529