Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
Nginx: Man-in-the-middle attack possible on secure web traffic
published 7 months ago
Summary
A security update is available for Nginx, a web server that handles many secure connections. If an attacker intercepts and manipulates these connections, they could potentially inject data into websites. This update fixes the issue and is recommended to be applied to prevent potential security risks.
What to do
- Update rocky nginx to version 2:1.26.3-2.el10_1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Rocky Linux:10 | rocky | nginx |
< 2:1.26.3-2.el10_1 Fix: upgrade to 2:1.26.3-2.el10_1
|
Original advisory text
Moderate: nginx security update
nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.
Security Fix(es):
* nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://errata.rockylinux.org/RLSA-2026:4705 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2436738 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published27 Mar 2026
Updated27 Mar 2026
First seen27 Mar 2026
Sources
RLSA-2026:4705 · OSV
Track software like this
Free during beta