ELSA-2026-36364

ELSA-2026-36364 - nginx security, bug fix, and enhancement update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-07-16

Description

[1.26.3-6.0.1.el10_2.5]
- Reference oracle-indexhtml within Requires [Orabug: 33802044]

[2:1.26.3-6.5]
- Resolves: RHEL-191778 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI
causing crashes
- Resolves: RHEL-188402 - nginx: NGINX: Arbitrary code execution or.
Denial of Service via heap-based buffer overflow with crafted HTTP/2
headers (CVE-2026-42055)

[2:1.26.3-6.4]
- Resolves: RHEL-178669 - nginx: code execution and denial of
service (CVE-2026-9256)
- Resolves: RHEL-182544 - nginx: HTTP/2: Remote Denial of Service via
compression bomb and Slowloris-style attack

[2:1.26.3-6.3]
- Resolves: RHEL-176231 - nginx: NGINX: Arbitrary Code Execution
Vulnerability (CVE-2026-42945)

[2:1.26.3-6.2]
- rebuild for the right candidate tag

[2:1.26.3-6.1]
- RHEL-159547 CVE-2026-27654 nginx: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module
- RHEL-159526 CVE-2026-27784 nginx: NGINX: Denial of Service due to memory corruption via crafted MP4 file
- RHEL-159434 CVE-2026-27651 nginx: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled
- RHEL-157875 CVE-2026-32647 nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files

Related CVEs

CVE-2026-42055

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	nginx-1.26.3-6.0.1.el10_2.5.src.rpm	5ccca84a6303df01c5a84c8f33818cad06b43a1af73e67ae04e3cc9d7fd6542f	-	ol10_aarch64_appstream
	nginx-1.26.3-6.0.1.el10_2.5.src.rpm	5ccca84a6303df01c5a84c8f33818cad06b43a1af73e67ae04e3cc9d7fd6542f	-	ol10_aarch64_codeready_builder
	nginx-1.26.3-6.0.1.el10_2.5.aarch64.rpm	e84ae91ea7730c2d1df867f64f09aed94c6a152fbff815ad0d56d24b01ab84c8	-	ol10_aarch64_appstream
	nginx-all-modules-1.26.3-6.0.1.el10_2.5.noarch.rpm	eb7a094551e158dbf123ef616198d6c1a93e1871238c15b458944eddb66553d9	-	ol10_aarch64_appstream
	nginx-core-1.26.3-6.0.1.el10_2.5.aarch64.rpm	b1f8b5f4ecff6f9fdc020d682a6472524dfb7ba3b8bcb521a482962d51a79a07	-	ol10_aarch64_appstream
	nginx-filesystem-1.26.3-6.0.1.el10_2.5.noarch.rpm	958cc1e7ae58b708cf42a34d63e44cd19b228d98acd02ef3ad0c2d9304f3a9b2	-	ol10_aarch64_appstream
	nginx-mod-devel-1.26.3-6.0.1.el10_2.5.aarch64.rpm	b28e557287ac0c6e383d3aa6e98cd81203844fa1db32b5b84c2298e700c5cab7	-	ol10_aarch64_codeready_builder
	nginx-mod-http-image-filter-1.26.3-6.0.1.el10_2.5.aarch64.rpm	334b782ab7150177062aaf6053f18536112b4e3c1f4668a30d5538500b499046	-	ol10_aarch64_appstream
	nginx-mod-http-perl-1.26.3-6.0.1.el10_2.5.aarch64.rpm	8e18dd7f76e0ca85be373d58788001f39adf6ee1f1a89eb53df7202bceeb2fab	-	ol10_aarch64_appstream
	nginx-mod-http-xslt-filter-1.26.3-6.0.1.el10_2.5.aarch64.rpm	d4f2cd7008a81c43180234bcc441db954ae4f8b16f1e03b62e335a74ca7b64ce	-	ol10_aarch64_appstream
	nginx-mod-mail-1.26.3-6.0.1.el10_2.5.aarch64.rpm	a4781e03b868f88c6e9476c4c9914a8d22b9642c9389fb2d1a8995f4ff454228	-	ol10_aarch64_appstream
	nginx-mod-stream-1.26.3-6.0.1.el10_2.5.aarch64.rpm	34ff95a2725371ab6cd28da2f490878aec9940c3603dbda1a4b561e5432b2ead	-	ol10_aarch64_appstream
Oracle Linux 10 (x86_64)	nginx-1.26.3-6.0.1.el10_2.5.src.rpm	5ccca84a6303df01c5a84c8f33818cad06b43a1af73e67ae04e3cc9d7fd6542f	-	ol10_x86_64_appstream
	nginx-1.26.3-6.0.1.el10_2.5.src.rpm	5ccca84a6303df01c5a84c8f33818cad06b43a1af73e67ae04e3cc9d7fd6542f	-	ol10_x86_64_codeready_builder
	nginx-1.26.3-6.0.1.el10_2.5.x86_64.rpm	8a3e1cd844ad12b0ce424ed54d19c79483677a4dbc8fb566d7789a833cc62762	-	ol10_x86_64_appstream
	nginx-all-modules-1.26.3-6.0.1.el10_2.5.noarch.rpm	eb7a094551e158dbf123ef616198d6c1a93e1871238c15b458944eddb66553d9	-	ol10_x86_64_appstream
	nginx-core-1.26.3-6.0.1.el10_2.5.x86_64.rpm	9334bf13f6e04989a469a558ec557999ab9ce9a20f9f08fd146132531026210c	-	ol10_x86_64_appstream
	nginx-filesystem-1.26.3-6.0.1.el10_2.5.noarch.rpm	958cc1e7ae58b708cf42a34d63e44cd19b228d98acd02ef3ad0c2d9304f3a9b2	-	ol10_x86_64_appstream
	nginx-mod-devel-1.26.3-6.0.1.el10_2.5.x86_64.rpm	1db3a2759fa8191c110066fecdf94b432aaf28554d333a0c9ed07f030ce5a8ac	-	ol10_x86_64_codeready_builder
	nginx-mod-http-image-filter-1.26.3-6.0.1.el10_2.5.x86_64.rpm	3c7f87a9f4718550b592465e751f8f3b59697fc511f5c21c4782ff29eb8555f4	-	ol10_x86_64_appstream
	nginx-mod-http-perl-1.26.3-6.0.1.el10_2.5.x86_64.rpm	6775ac5927d8b40598e36bad03fd5f61d943b88e6d082e8968a1c499ff70967f	-	ol10_x86_64_appstream
	nginx-mod-http-xslt-filter-1.26.3-6.0.1.el10_2.5.x86_64.rpm	30412ec91100dfe39bc30a4cb9d07cadc2c06c6be223274c07952ad75e3c0786	-	ol10_x86_64_appstream
	nginx-mod-mail-1.26.3-6.0.1.el10_2.5.x86_64.rpm	d47098c49ed5549d0e4f1b0b2955db555e62508cdd6d9b0679485e01ee2457df	-	ol10_x86_64_appstream
	nginx-mod-stream-1.26.3-6.0.1.el10_2.5.x86_64.rpm	8b11d84052de132d1d6bbc19b87d0d2f9045a1831061edee5e8177b09eb5e3a0	-	ol10_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team