ELSA-2026-67314-0

ELSA-2026-67314-0 - nginx security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-09-15

Description

[1.26.3-6.0.1.el10_2.7]
- Reference oracle-indexhtml within Requires [Orabug: 33802044]

[2:1.26.3-6.7]
- Resolves: RHEL-212454 - nginx: NGINX: Arbitrary code execution via crafted
HTTP requests (CVE-2026-42533)

[2:1.26.3-6.6]
- Resolves: RHEL-219313 - nginx: NGINX: Heap buffer over-read allows memory
modification or denial of service (CVE-2026-56434)
- Resolves: RHEL-217956 - nginx: NGINX: Memory disclosure and denial of service
in ngx_http_slice_module (CVE-2026-60005)

[2:1.26.3-6.5]
- Resolves: RHEL-191778 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI
causing crashes
- Resolves: RHEL-188402 - nginx: NGINX: Arbitrary code execution or.
Denial of Service via heap-based buffer overflow with crafted HTTP/2
headers (CVE-2026-42055)

[2:1.26.3-6.4]
- Resolves: RHEL-178669 - nginx: code execution and denial of
service (CVE-2026-9256)
- Resolves: RHEL-182544 - nginx: HTTP/2: Remote Denial of Service via
compression bomb and Slowloris-style attack

[2:1.26.3-6.3]
- Resolves: RHEL-176231 - nginx: NGINX: Arbitrary Code Execution
Vulnerability (CVE-2026-42945)

[2:1.26.3-6.2]
- rebuild for the right candidate tag

[2:1.26.3-6.1]
- RHEL-159547 CVE-2026-27654 nginx: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module
- RHEL-159526 CVE-2026-27784 nginx: NGINX: Denial of Service due to memory corruption via crafted MP4 file
- RHEL-159434 CVE-2026-27651 nginx: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled
- RHEL-157875 CVE-2026-32647 nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files

Related CVEs

CVE-2026-42533

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	nginx-1.26.3-6.0.1.el10_2.7.src.rpm	7d074b68a651bc0148004af23c96b66bef7c8e5679c35dc9d7b4cdd37bb60bd2	-	ol10_aarch64_appstream
	nginx-1.26.3-6.0.1.el10_2.7.src.rpm	7d074b68a651bc0148004af23c96b66bef7c8e5679c35dc9d7b4cdd37bb60bd2	-	ol10_aarch64_codeready_builder
	nginx-1.26.3-6.0.1.el10_2.7.aarch64.rpm	1e8f38e9280a6c326596b722bed50f2a369d4cc9b17f1fc2690177766ce92392	-	ol10_aarch64_appstream
	nginx-all-modules-1.26.3-6.0.1.el10_2.7.noarch.rpm	bea00b30f4653b915bc3d6c0b20d21595191a0b113f54a56e818362d64abcd5e	-	ol10_aarch64_appstream
	nginx-core-1.26.3-6.0.1.el10_2.7.aarch64.rpm	f1610767056266c484908c8b32df5a281e9c7844c609d6b28810619d44674d7f	-	ol10_aarch64_appstream
	nginx-filesystem-1.26.3-6.0.1.el10_2.7.noarch.rpm	601959c460a5b53c0333fa8ffc47dfe18da6d1526ed3c002a093b5e35a731ef7	-	ol10_aarch64_appstream
	nginx-mod-devel-1.26.3-6.0.1.el10_2.7.aarch64.rpm	bd33c9f1b0597142ba0ab5bc34b488055aafbd97c423c092225acbadc02ae1b5	-	ol10_aarch64_codeready_builder
	nginx-mod-http-image-filter-1.26.3-6.0.1.el10_2.7.aarch64.rpm	ccc6054879b7bf7580657b0dc3fa19fbecf067bad9482dc4ae38788b1df4b081	-	ol10_aarch64_appstream
	nginx-mod-http-perl-1.26.3-6.0.1.el10_2.7.aarch64.rpm	731e78a28cd71da5e58e7730816b60c9886d5c095c71c4319bb6469ea8348de8	-	ol10_aarch64_appstream
	nginx-mod-http-xslt-filter-1.26.3-6.0.1.el10_2.7.aarch64.rpm	a538a1cb60c0fb1cfda1be41d6457e44d2a11a0e4832a9991449718a6281446e	-	ol10_aarch64_appstream
	nginx-mod-mail-1.26.3-6.0.1.el10_2.7.aarch64.rpm	7370066b9edfcd5b14371dcb73c9fb729eb85f13434af692e630f23df86a3b5d	-	ol10_aarch64_appstream
	nginx-mod-stream-1.26.3-6.0.1.el10_2.7.aarch64.rpm	fe528575940d797422cd30c058adc9fa824cd86629f1f80e430df699c9aaaf2f	-	ol10_aarch64_appstream
Oracle Linux 10 (x86_64)	nginx-1.26.3-6.0.1.el10_2.7.src.rpm	7d074b68a651bc0148004af23c96b66bef7c8e5679c35dc9d7b4cdd37bb60bd2	-	ol10_x86_64_appstream
	nginx-1.26.3-6.0.1.el10_2.7.src.rpm	7d074b68a651bc0148004af23c96b66bef7c8e5679c35dc9d7b4cdd37bb60bd2	-	ol10_x86_64_codeready_builder
	nginx-1.26.3-6.0.1.el10_2.7.x86_64.rpm	420c4070a3d03f3a899393145ff6665eca41b15a408896fd85f1db887eb4dc36	-	ol10_x86_64_appstream
	nginx-all-modules-1.26.3-6.0.1.el10_2.7.noarch.rpm	bea00b30f4653b915bc3d6c0b20d21595191a0b113f54a56e818362d64abcd5e	-	ol10_x86_64_appstream
	nginx-core-1.26.3-6.0.1.el10_2.7.x86_64.rpm	ed50c054813733a9151adbf2e0fad3f80b72d11af7e5ed9f950c7b42d023acf4	-	ol10_x86_64_appstream
	nginx-filesystem-1.26.3-6.0.1.el10_2.7.noarch.rpm	601959c460a5b53c0333fa8ffc47dfe18da6d1526ed3c002a093b5e35a731ef7	-	ol10_x86_64_appstream
	nginx-mod-devel-1.26.3-6.0.1.el10_2.7.x86_64.rpm	9a4895fe9e4774a1fc3410387c7c65ee55409bd2354a8db1effc409fafda8137	-	ol10_x86_64_codeready_builder
	nginx-mod-http-image-filter-1.26.3-6.0.1.el10_2.7.x86_64.rpm	fe44c6bf989b69d86d967b0142e3f105999aeebf5e762fa19ec078a1762c8e43	-	ol10_x86_64_appstream
	nginx-mod-http-perl-1.26.3-6.0.1.el10_2.7.x86_64.rpm	8a830e9226f7c71496d69bdba24b1bb5edde1303179e1162eb381b8a81b4739b	-	ol10_x86_64_appstream
	nginx-mod-http-xslt-filter-1.26.3-6.0.1.el10_2.7.x86_64.rpm	c5e616c193b4978e0f4be4a22344e2b29d80032f01cd27873c54df0b4a6011b5	-	ol10_x86_64_appstream
	nginx-mod-mail-1.26.3-6.0.1.el10_2.7.x86_64.rpm	d28c77d0721734f4b65be04cce8a2943118505fdeedf85f5639c7dbc09456184	-	ol10_x86_64_appstream
	nginx-mod-stream-1.26.3-6.0.1.el10_2.7.x86_64.rpm	35caa5b0243fe69ea4fbd82eb49a58aaff10fce461d31ff4d63f4fad67df9f77	-	ol10_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team