Critical Security Update for nginx:1.24 - Denial of Service and Code Execution Vulnerabilities
Summary
ALSA-2026:6907: Important: nginx:1.24 security update. Affects nginx versions < 1:1.24.0-3.module_el8.10.0+4159+021b4a2a.alma.1. Fixed in 1:1.24.0-3.module_el8.10.0+4159+021b4a2a.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nginx is a widely used web and proxy server known for its high concurrency, performance, and low memory usage. It supports various protocols, including HTTP, and is often employed to serve static content, reverse proxy, and load balancing. However, recent vulnerabilities have been identified that could compromise its stability and security, particularly when handling specially crafted MP4 files and certain HTTP requests.
Vulnerability Detail
The vulnerabilities in nginx version 1.24 include a Denial of Service (DoS) risk and potential code execution through specially crafted MP4 files (CVE-2026-32647). Additionally, a buffer overflow in the ngx_http_dav_module can lead to file modification (CVE-2026-27654), while memory corruption from crafted MP4 files can also cause DoS (CVE-2026-27784). Furthermore, undisclosed requests when the ngx_mail_auth_http_module is enabled may also lead to DoS (CVE-2026-27651). These vulnerabilities can severely impact the availability and integrity of web services running on nginx.
How To Fix
Minimum fixed version
1:1.24.0-3.module_el8.10.0+4159+021b4a2a.alma.1
This is the first release that contains the fix.
sudo dnf update nginxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, consider disabling the ngx_mail_auth_http_module and avoiding the processing of MP4 files until the update can be applied. This can help mitigate the risk of exploitation.
Conclusion
The identified vulnerabilities in nginx version 1.24 pose significant risks to web services, including Denial of Service and potential code execution. It is crucial to update to the latest patched version to ensure the security and stability of your applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for nginx →
FAQ
The vulnerabilities can lead to Denial of Service, allowing attackers to disrupt service availability, and potential code execution, which can compromise server integrity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
nginx version 1.24 is affected by these vulnerabilities. Ensure you update to version 1:1.24.0-3.module_el8.10.0+4159+021b4a2a.alma.1 or later.
Yes, you can disable the ngx_mail_auth_http_module and refrain from processing MP4 files until you can apply the update.
For more details, refer to the CVE pages linked in the advisory or the official nginx documentation.
Related vulnerabilities
Recent vulnerabilities recorded for nginx.
