ELSA-2026-59220

ELSA-2026-59220 - nginx security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-08-25

Description

[1.26.3-6.0.1.el10_2.6]
- Reference oracle-indexhtml within Requires [Orabug: 33802044]

[2:1.26.3-6.6]
- Resolves: RHEL-219313 - nginx: NGINX: Heap buffer over-read allows memory
modification or denial of service (CVE-2026-56434)
- Resolves: RHEL-217956 - nginx: NGINX: Memory disclosure and denial of service
in ngx_http_slice_module (CVE-2026-60005)

[2:1.26.3-6.5]
- Resolves: RHEL-191778 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI
causing crashes
- Resolves: RHEL-188402 - nginx: NGINX: Arbitrary code execution or.
Denial of Service via heap-based buffer overflow with crafted HTTP/2
headers (CVE-2026-42055)

[2:1.26.3-6.4]
- Resolves: RHEL-178669 - nginx: code execution and denial of
service (CVE-2026-9256)
- Resolves: RHEL-182544 - nginx: HTTP/2: Remote Denial of Service via
compression bomb and Slowloris-style attack

[2:1.26.3-6.3]
- Resolves: RHEL-176231 - nginx: NGINX: Arbitrary Code Execution
Vulnerability (CVE-2026-42945)

[2:1.26.3-6.2]
- rebuild for the right candidate tag

[2:1.26.3-6.1]
- RHEL-159547 CVE-2026-27654 nginx: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module
- RHEL-159526 CVE-2026-27784 nginx: NGINX: Denial of Service due to memory corruption via crafted MP4 file
- RHEL-159434 CVE-2026-27651 nginx: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled
- RHEL-157875 CVE-2026-32647 nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files

Related CVEs

CVE-2026-56434

CVE-2026-60005

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	nginx-1.26.3-6.0.1.el10_2.6.src.rpm	c9889e73031732ad7048d0f13500da87e983de78582cb8d442a9aae669803ca0	-	ol10_aarch64_appstream
	nginx-1.26.3-6.0.1.el10_2.6.src.rpm	c9889e73031732ad7048d0f13500da87e983de78582cb8d442a9aae669803ca0	-	ol10_aarch64_codeready_builder
	nginx-1.26.3-6.0.1.el10_2.6.aarch64.rpm	f69cb01736f2d965aa5f0cb2bd5d607a1fabf2ebcf4115f7480f47fa82345dcc	-	ol10_aarch64_appstream
	nginx-all-modules-1.26.3-6.0.1.el10_2.6.noarch.rpm	5e08309b4a30b07d45dc95a57a00603fc0105505e4f19631e27fa4b84e4fb7fc	-	ol10_aarch64_appstream
	nginx-core-1.26.3-6.0.1.el10_2.6.aarch64.rpm	0b03d5975da1828e5dfe016c6b571ba725a33de968c5a731cb17095c05e08846	-	ol10_aarch64_appstream
	nginx-filesystem-1.26.3-6.0.1.el10_2.6.noarch.rpm	dd23faa5f09dec1abb54f87400a13c6467e9444b861833e11c372ba089749485	-	ol10_aarch64_appstream
	nginx-mod-devel-1.26.3-6.0.1.el10_2.6.aarch64.rpm	1ada31da52450e0fed7a9131b1dc4535fd750dbef06425e99c1776d6642b03d9	-	ol10_aarch64_codeready_builder
	nginx-mod-http-image-filter-1.26.3-6.0.1.el10_2.6.aarch64.rpm	c957fd40dc1efd475952f2383ce08a1ba04f27b0678711d7b46fb248f2f28982	-	ol10_aarch64_appstream
	nginx-mod-http-perl-1.26.3-6.0.1.el10_2.6.aarch64.rpm	3c13d6f960ac6a36b23a137be54e8830653a6e065e10a5632eb430be5cca4b05	-	ol10_aarch64_appstream
	nginx-mod-http-xslt-filter-1.26.3-6.0.1.el10_2.6.aarch64.rpm	1ca6773d9ca8d776f87632d31af9465bc969b233cbd86a3263a8820c4a00baa0	-	ol10_aarch64_appstream
	nginx-mod-mail-1.26.3-6.0.1.el10_2.6.aarch64.rpm	92c69916f12e3da10791045bf21bae66694513adb97af25ab162fb905c8de05f	-	ol10_aarch64_appstream
	nginx-mod-stream-1.26.3-6.0.1.el10_2.6.aarch64.rpm	2ca7c02b9c6d05cac7b18c7bb1da969b1fed73c6159e66df13c0e19fe054d9c3	-	ol10_aarch64_appstream
Oracle Linux 10 (x86_64)	nginx-1.26.3-6.0.1.el10_2.6.src.rpm	c9889e73031732ad7048d0f13500da87e983de78582cb8d442a9aae669803ca0	-	ol10_x86_64_appstream
	nginx-1.26.3-6.0.1.el10_2.6.src.rpm	c9889e73031732ad7048d0f13500da87e983de78582cb8d442a9aae669803ca0	-	ol10_x86_64_codeready_builder
	nginx-1.26.3-6.0.1.el10_2.6.x86_64.rpm	c2125b0604c2e95d71674fe87a920ebeba692feceaa2cf1b96efdac052a80afb	-	ol10_x86_64_appstream
	nginx-all-modules-1.26.3-6.0.1.el10_2.6.noarch.rpm	5e08309b4a30b07d45dc95a57a00603fc0105505e4f19631e27fa4b84e4fb7fc	-	ol10_x86_64_appstream
	nginx-core-1.26.3-6.0.1.el10_2.6.x86_64.rpm	3548faf524c63e347f39b6fbaee5325fb0b63c3ab59eb0e49b7b40bbc3271cc5	-	ol10_x86_64_appstream
	nginx-filesystem-1.26.3-6.0.1.el10_2.6.noarch.rpm	dd23faa5f09dec1abb54f87400a13c6467e9444b861833e11c372ba089749485	-	ol10_x86_64_appstream
	nginx-mod-devel-1.26.3-6.0.1.el10_2.6.x86_64.rpm	2c5127567257f34087ca0e7c48b0529b9e01551e42110973f0bc2020702a0ae8	-	ol10_x86_64_codeready_builder
	nginx-mod-http-image-filter-1.26.3-6.0.1.el10_2.6.x86_64.rpm	bbc9b353640e55553c90ae70933fa37b804e2dc3375b61a9e90b7ca473bbc6ea	-	ol10_x86_64_appstream
	nginx-mod-http-perl-1.26.3-6.0.1.el10_2.6.x86_64.rpm	5d6b510e4f9e7d2a8ae152d4cebb9dd9971472117fe246c92144adf3753102ad	-	ol10_x86_64_appstream
	nginx-mod-http-xslt-filter-1.26.3-6.0.1.el10_2.6.x86_64.rpm	9de7c4e7ae9965c675cc5fdfbaf5cf258cf33a8bce3eedbe530beb4a7394d306	-	ol10_x86_64_appstream
	nginx-mod-mail-1.26.3-6.0.1.el10_2.6.x86_64.rpm	c8f7c656ac0e5c21a60db15d94fe373f2b32caf86d10d79842b7c6a7ec894e3d	-	ol10_x86_64_appstream
	nginx-mod-stream-1.26.3-6.0.1.el10_2.6.x86_64.rpm	8f8b1444debbbfda6153a3279d52c5053efbcba4c0624dd690d1b4b5c97a4587	-	ol10_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team