Critical Security Update for nginx:1.26 - Denial of Service and Code Execution Vulnerabilities
Summary
ALSA-2026:7343: Important: nginx:1.26 security update. Affects nginx versions < 2:1.26.3-2.module_el9.7.0+223+9cd7031b.1. Fixed in 2:1.26.3-2.module_el9.7.0+223+9cd7031b.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nginx is a high-performance web and proxy server that supports HTTP and other protocols, designed for high concurrency, performance, and low memory usage. It is widely used for serving static content, load balancing, and as a reverse proxy. However, recent vulnerabilities have been identified that could compromise its stability and security.
Vulnerability Detail
The vulnerabilities in nginx version 1.26 include multiple Denial of Service (DoS) and potential code execution risks stemming from specially crafted MP4 files and buffer overflow issues in the ngx_http_dav_module. These vulnerabilities can lead to memory corruption and unauthorized file modifications, impacting the server's availability and integrity.
How To Fix
Minimum fixed version
2:1.26.3-2.module_el9.7.0+223+9cd7031b.1
This is the first release that contains the fix.
sudo dnf update nginxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable the ngx_mail_auth_http_module if it is not needed, which may mitigate some of the risks associated with the vulnerabilities until a full update can be applied.
Conclusion
The vulnerabilities identified in nginx version 1.26 pose significant risks, including Denial of Service and potential code execution. It is crucial to update to the patched version to ensure the security and stability of your web server. Utilize tools like Vulert for ongoing monitoring of vulnerabilities in your applications.
See every vulnerability recorded for nginx →
FAQ
The main vulnerabilities include Denial of Service and potential code execution through crafted MP4 files and buffer overflow issues.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Consider disabling the ngx_mail_auth_http_module as a temporary workaround to reduce exposure to the vulnerabilities.
Vulert monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json, providing real-time insights.
For detailed information, refer to the CVE pages linked in the advisory or the official nginx documentation.
Related vulnerabilities
Recent vulnerabilities recorded for nginx.
