Critical Vulnerability in nginx: Denial of Service and Code Execution Risks
Summary
RLSA-2026:6906: Important: nginx security update. Affects nginx versions < 2:1.26.3-2.el10_1.1. Fixed in 2:1.26.3-2.el10_1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nginx is a high-performance web and proxy server that supports HTTP and other protocols, designed for high concurrency, performance, and low memory usage. It is widely used for serving static content, load balancing, and as a reverse proxy. However, recent vulnerabilities have been identified that could compromise its security and stability.
Vulnerability Detail
The vulnerabilities in nginx stem from several issues related to specially crafted MP4 files and buffer overflows in the ngx_http_dav_module. These vulnerabilities can lead to Denial of Service (DoS) attacks, where the server becomes unresponsive, or even allow for code execution under certain conditions. Specifically, CVE-2026-32647 and CVE-2026-27784 relate to memory corruption and crafted file handling, while CVE-2026-27654 involves a buffer overflow that can lead to file modification. CVE-2026-27651 presents a risk of DoS via undisclosed requests when the ngx_mail_auth_http_module is enabled. The CVSS score for these vulnerabilities is 8.2, indicating a high severity level.
How To Fix
Minimum fixed version
2:1.26.3-2.el10_1.1
This is the first release that contains the fix.
sudo dnf update nginxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider disabling the ngx_mail_auth_http_module to mitigate the risk of DoS attacks until the update can be applied.
Conclusion
The identified vulnerabilities in nginx pose significant risks, including Denial of Service and potential code execution. It is crucial to update to the latest patched version to ensure the security and stability of your web server. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for nginx →
FAQ
The vulnerabilities involve Denial of Service and potential code execution due to memory corruption and buffer overflow issues.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for these vulnerabilities is 8.2, indicating a high severity level.
Update nginx to version 2:1.26.3-2.el10_1.1 using 'sudo yum update nginx' to fix the vulnerabilities.
Disabling the ngx_mail_auth_http_module can serve as a temporary workaround to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for nginx.
