ELSA-2026-59496

ELSA-2026-59496 - nginx:1.26 security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-08-25

Description

[1.26.3-9.0.1.3]
- Require oracle-indexhtml

[2:1.26.3-13]
- Fixes CVE-2026-56434 and CVE-2026-60005

[2:1.26.3-12]
- Resolves: RHEL-191774 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI
causing crashes

[2:1.26.3-11]
- nginx:1.26/nginx: HTTP/2: Remote Denial of Service via compression bomb
and Slowloris-style attack

[2:1.26.3-10]
- nginx: code execution and denial of service (CVE-2026-9256)

[2:1.26.3-9]
- Resolves: RHEL-176218 - nginx:1.26/nginx: NGINX: Arbitrary Code Execution
Vulnerability (CVE-2026-42945)

[2:1.26.3-8]
- CVE-2026-32647 nginx:1.26/nginx: NGINX: Denial of Service or Code
Execution via specially crafted MP4 files

[2:1.26.3-7]
- CVE-2026-27651 nginx:1.26/nginx: NGINX: Denial of Service via undisclosed
requests when ngx_mail_auth_http_module is enabled

[2:1.26.3-6]
- CVE-2026-27784 nginx:1.26/nginx: NGINX: Denial of Service due to memory
corruption via crafted MP4 file

[2:1.26.3-5]
- CVE-2026-27654 nginx:1.26/nginx: NGINX: Denial of Service or file
modification via buffer overflow in ngx_http_dav_module

Related CVEs

CVE-2026-56434

CVE-2026-60005

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 9 (aarch64)	nginx-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.src.rpm	f0580136c6ac7362b601c41ce5c051e376a1ccd47ac855f5c4ae9812e95a4784	-	ol9_aarch64_appstream
	nginx-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.aarch64.rpm	13510d6c6376018d8503cf83183aa1c0eaeeaad83d225c9fdf78bf49a43ad195	-	ol9_aarch64_appstream
	nginx-all-modules-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.noarch.rpm	ada09187e7007ffe6511e9e3446aea4ab0747686bb3230ff90d5ec4bb1695209	-	ol9_aarch64_appstream
	nginx-core-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.aarch64.rpm	ff5df0958febf18d2e4616fe638a1bbc67aeef9e73cde43a13e5aabf04a89180	-	ol9_aarch64_appstream
	nginx-filesystem-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.noarch.rpm	79ac351c55987d4a98a1c984bd335a97d9aa04aadcc812ca97b282f38ced6703	-	ol9_aarch64_appstream
	nginx-mod-devel-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.aarch64.rpm	8054aba5b3f78c60dbf7db82e2c5a1f755036dca32dfd2f5816d965aded6bbfe	-	ol9_aarch64_appstream
	nginx-mod-http-image-filter-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.aarch64.rpm	f8e26ec8cecff38bf7c646fb3d22028daa3a30db0ef725bd904d82db57d654d3	-	ol9_aarch64_appstream
	nginx-mod-http-perl-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.aarch64.rpm	095f64fbac35c5070add29d4be42b59392ce26666cc9e13bc16759b18de32b49	-	ol9_aarch64_appstream
	nginx-mod-http-xslt-filter-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.aarch64.rpm	2452e9ee1f7e58f61cc49567bde7588e2a39e3b2999e4eafa23912e6f2158491	-	ol9_aarch64_appstream
	nginx-mod-mail-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.aarch64.rpm	2bda45ee1c09b499daee599b52659135dc55fdb5e4f9fe772281c541d3fa125f	-	ol9_aarch64_appstream
	nginx-mod-stream-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.aarch64.rpm	3b6ca336ed37acde9bca830591a47a799d42353923aa9071460d33f0d668b128	-	ol9_aarch64_appstream
Oracle Linux 9 (x86_64)	nginx-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.src.rpm	f0580136c6ac7362b601c41ce5c051e376a1ccd47ac855f5c4ae9812e95a4784	-	ol9_x86_64_appstream
	nginx-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.x86_64.rpm	1a08c442ed01b7becbc9cbf6e9a443a9732181a1be59d7c4e51f5da974951e57	-	ol9_x86_64_appstream
	nginx-all-modules-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.noarch.rpm	ada09187e7007ffe6511e9e3446aea4ab0747686bb3230ff90d5ec4bb1695209	-	ol9_x86_64_appstream
	nginx-core-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.x86_64.rpm	f9a6ca7518c379e3f1909059c01fdc1ea4730b674cb73cd2089f37015a20a8ef	-	ol9_x86_64_appstream
	nginx-filesystem-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.noarch.rpm	79ac351c55987d4a98a1c984bd335a97d9aa04aadcc812ca97b282f38ced6703	-	ol9_x86_64_appstream
	nginx-mod-devel-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.x86_64.rpm	1e9aad5c4f64adc28648127175a8fbd5c1a03499b1541e3b54cba71f6d36d2b7	-	ol9_x86_64_appstream
	nginx-mod-http-image-filter-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.x86_64.rpm	ac230a985a0ef1af2c1772da53f0cf188f00506e2dc44f883309441dca5b8758	-	ol9_x86_64_appstream
	nginx-mod-http-perl-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.x86_64.rpm	f74d6b1f2a9a9266364662ca0eca738248e4be0b8952436552a9728f550f2f98	-	ol9_x86_64_appstream
	nginx-mod-http-xslt-filter-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.x86_64.rpm	d89fec6d29c60adcbc4c39fb39ca98a5bf5fb56d03892040ddf4422f82294823	-	ol9_x86_64_appstream
	nginx-mod-mail-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.x86_64.rpm	4e96b944393889acc82a3f08b12c3cda37aec921ad9b48ebeb5a9a48d4f7f956	-	ol9_x86_64_appstream
	nginx-mod-stream-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.x86_64.rpm	ccd51b2383b293128862f9af7681ed1999b21a2239375e0bdd65ea9f8a5dc4f2	-	ol9_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team