Critical Vulnerability in nginx: Denial of Service and Code Execution Risks
Summary
RLSA-2026:7002: Important: nginx security update. Affects nginx versions < 2:1.20.1-24.el9_7.2.rocky.0.1. Fixed in 2:1.20.1-24.el9_7.2.rocky.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nginx is a high-performance web and proxy server designed to handle a large number of concurrent connections efficiently. It supports various protocols, including HTTP, and is widely used for its low memory footprint and high performance. However, recent vulnerabilities have been identified that could potentially compromise the server's integrity and availability, particularly through crafted MP4 files and buffer overflow issues.
Vulnerability Detail
The vulnerabilities in nginx include Denial of Service (DoS) and potential code execution risks stemming from specially crafted MP4 files. Specifically, CVE-2026-32647 allows for DoS or code execution, while CVE-2026-27654 involves a buffer overflow in the ngx_http_dav_module, leading to file modification or DoS. Additionally, CVE-2026-27784 presents a memory corruption issue via crafted MP4 files, and CVE-2026-27651 could lead to DoS through undisclosed requests when the ngx_mail_auth_http_module is enabled. The CVSS score for these vulnerabilities is 8.2, indicating a high severity level.
How To Fix
Minimum fixed version
2:1.20.1-24.el9_7.2.rocky.0.1
This is the first release that contains the fix.
sudo dnf update nginxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable the ngx_mail_auth_http_module if it is not in use, which may help prevent exploitation of CVE-2026-27651. Additionally, avoid processing untrusted MP4 files until the update is applied.
Conclusion
The identified vulnerabilities in nginx pose significant risks, including Denial of Service and potential code execution. It is crucial to update to the latest patched version to safeguard your server. Utilize tools like Vulert for ongoing monitoring and vulnerability management.
See every vulnerability recorded for nginx →
FAQ
nginx is a web server that also functions as a reverse proxy, load balancer, and HTTP cache, known for its high performance and low resource consumption.
The vulnerabilities can lead to Denial of Service attacks, potential code execution, and unauthorized file modifications, compromising server availability and security.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
If an immediate update is not possible, consider disabling vulnerable modules and avoid processing untrusted files until the update can be applied.
Regularly check for updates and vulnerabilities, ideally on a weekly basis, to ensure your software remains secure against newly discovered threats.
References
Related vulnerabilities
Recent vulnerabilities recorded for nginx.
