ELSA-2026-98671

ELSA-2026-98671 - nginx:1.24 security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-11-12

Description

[1.24.0-3.6.0.1]
- Remove Red Hat references [Orabug: 29498217]

[1:1.24.0-3.6]
- Resolves: RHEL-286573 - nginx:1.24/nginx: nginx: heap-based buffer overflow
in ngx_http_core_module via alias with rewrite referencing
(CVE-2026-15176)
- Resolves: RHEL-285354 - nginx:1.24/nginx: NGINX ngx_http_core_module
vulnerability (CVE-2026-97205)

[1:1.24.0-3.5]
- Resolves: RHEL-212457 - nginx:1.24/nginx: NGINX: Arbitrary code execution via
crafted HTTP requests (CVE-2026-42533)

[1:1.24.0-3.4]
- Resolves: RHEL-217957 - nginx:1.24/nginx: NGINX: Memory disclosure and
denial of service in ngx_http_slice_module (CVE-2026-60005)
- Resolves: RHEL-219309 - nginx:1.24/nginx: NGINX: Heap buffer over-read
allows memory modification or denial of service (CVE-2026-56434)

[1:1.24.0-3.3]
- Resolves: RHEL-191779 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI
causing crashes
- Resolves: RHEL-188406 - nginx: NGINX: Arbitrary code execution or.
Denial of Service via heap-based buffer overflow with crafted HTTP/2
headers (CVE-2026-42055)

[1:1.24.0-3.2]
- Resolves: RHEL-178676 - nginx:1.24/nginx: code execution and denial
of service (CVE-2026-9256)
- Resolves: RHEL-182543 - nginx: HTTP/2: Remote Denial of Service via
compression bomb and Slowloris-style attack

[1:1.24.0-3.1]
- Resolves: RHEL-176224 - nginx:1.24/nginx: NGINX: Arbitrary Code Execution
Vulnerability (CVE-2026-42945)

[1:1.24.0-3]
- Resolves: RHEL-157877 CVE-2026-32647 nginx:1.24/nginx: NGINX: Denial of
Service or Code Execution via specially crafted MP4 files
- Resolves: RHEL-159436 CVE-2026-27651 nginx:1.24/nginx: NGINX: Denial of
Service via undisclosed requests when ngx_mail_auth_http_module is enabled
- Resolves: RHEL-159549 CVE-2026-27654 nginx:1.24/nginx: NGINX: Denial of
Service or file modification via buffer overflow in ngx_http_dav_module
- Resolves: RHEL-159528 CVE-2026-27784 nginx:1.24/nginx: NGINX: Denial of
Service due to memory corruption via crafted MP4 file

[1:1.24.0-2]
- Resolves: RHEL-146517 - nginx:1.24/nginx: NGINX: Data injection via
man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)

[1:1.24.0-1]
- Resolves: RHEL-14714 - add nginx:1.24 to RHEL 8.10

Related CVEs

CVE-2026-15176

CVE-2026-97205

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 8 (aarch64)	nginx-1.24.0-3.0.1.module+el8.10.0+91116+653b4aa5.6.src.rpm	b1cc4bbf9fa4e1238e62fa5061824bc7d9e8627ff2b0e2c9adda89f6332f78ef	-	ol8_aarch64_appstream
	nginx-1.24.0-3.0.1.module+el8.10.0+91116+653b4aa5.6.aarch64.rpm	2826c80e2b72e33b4ed62aa488fe70e07f2a3e3eed080737846a66ca1229602a	-	ol8_aarch64_appstream
	nginx-all-modules-1.24.0-3.0.1.module+el8.10.0+91116+653b4aa5.6.noarch.rpm	c9d46c45c17c1d1848cd7328f0b13cee16938339a5ceea8853bd6cf5c655a548	-	ol8_aarch64_appstream
	nginx-filesystem-1.24.0-3.0.1.module+el8.10.0+91116+653b4aa5.6.noarch.rpm	f02f65380d633d92a6ca080d57e244f8af74f89a1014f922519e406771defee0	-	ol8_aarch64_appstream
	nginx-mod-devel-1.24.0-3.0.1.module+el8.10.0+91116+653b4aa5.6.aarch64.rpm	5e25852abd101d3229706fd5120dc7a1d04d87a2064b24430d22bd556189474d	-	ol8_aarch64_appstream
	nginx-mod-http-image-filter-1.24.0-3.0.1.module+el8.10.0+91116+653b4aa5.6.aarch64.rpm	e3a045a4072e146ced237d7879e22cec9da19aa8f31c765d18758b09378c11c1	-	ol8_aarch64_appstream
	nginx-mod-http-perl-1.24.0-3.0.1.module+el8.10.0+91116+653b4aa5.6.aarch64.rpm	73973da2cf26c8d5c864010e610f8af64fa918adf3887eec36436f7ca7b75e58	-	ol8_aarch64_appstream
	nginx-mod-http-xslt-filter-1.24.0-3.0.1.module+el8.10.0+91116+653b4aa5.6.aarch64.rpm	447531be135128e9464d726f88c902508a8140d2a651b726c68b3900cc024a8e	-	ol8_aarch64_appstream
	nginx-mod-mail-1.24.0-3.0.1.module+el8.10.0+91116+653b4aa5.6.aarch64.rpm	ecce6ec5c9676342d8951017c184f2d6b99e0cc547cd7e97a41e57dbc0c072df	-	ol8_aarch64_appstream
	nginx-mod-stream-1.24.0-3.0.1.module+el8.10.0+91116+653b4aa5.6.aarch64.rpm	f1e62d761fff2db866695daba7685412b567cc91d17990d72f82fadf9354fa92	-	ol8_aarch64_appstream
Oracle Linux 8 (x86_64)	nginx-1.24.0-3.0.1.module+el8.10.0+91116+653b4aa5.6.src.rpm	b1cc4bbf9fa4e1238e62fa5061824bc7d9e8627ff2b0e2c9adda89f6332f78ef	-	ol8_x86_64_appstream
	nginx-1.24.0-3.0.1.module+el8.10.0+91116+653b4aa5.6.x86_64.rpm	7a4e3a76f2019c1bafe2fb5f9b40d6c9318af015aa63072a07e02b776f29d829	-	ol8_x86_64_appstream
	nginx-all-modules-1.24.0-3.0.1.module+el8.10.0+91116+653b4aa5.6.noarch.rpm	c9d46c45c17c1d1848cd7328f0b13cee16938339a5ceea8853bd6cf5c655a548	-	ol8_x86_64_appstream
	nginx-filesystem-1.24.0-3.0.1.module+el8.10.0+91116+653b4aa5.6.noarch.rpm	f02f65380d633d92a6ca080d57e244f8af74f89a1014f922519e406771defee0	-	ol8_x86_64_appstream
	nginx-mod-devel-1.24.0-3.0.1.module+el8.10.0+91116+653b4aa5.6.x86_64.rpm	96f998c19a480e731cf08bb499b639426d239140cf8d5be82c8ce41381f4729e	-	ol8_x86_64_appstream
	nginx-mod-http-image-filter-1.24.0-3.0.1.module+el8.10.0+91116+653b4aa5.6.x86_64.rpm	37e0d56807860509027fa9db9ccec82eb212d5951fb43aef97a0aa91c0fbb95b	-	ol8_x86_64_appstream
	nginx-mod-http-perl-1.24.0-3.0.1.module+el8.10.0+91116+653b4aa5.6.x86_64.rpm	65d510110e99811ff7934e1a06f5cab18a51a9255ae860d541bbd580d5cd2c9e	-	ol8_x86_64_appstream
	nginx-mod-http-xslt-filter-1.24.0-3.0.1.module+el8.10.0+91116+653b4aa5.6.x86_64.rpm	8f33f8c7f354579d8efc3f506ea61bbcccf983c2113e896da1625d4da8d89606	-	ol8_x86_64_appstream
	nginx-mod-mail-1.24.0-3.0.1.module+el8.10.0+91116+653b4aa5.6.x86_64.rpm	3b52d0b22f9c40cc12703d9c724287998aff07dd5bf8f7a91e634e3e8d59afde	-	ol8_x86_64_appstream
	nginx-mod-stream-1.24.0-3.0.1.module+el8.10.0+91116+653b4aa5.6.x86_64.rpm	639d79cab9bef1c9479584fc39c7912ddf354b3d60fd6afe5b72a2f26ead317c	-	ol8_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team