Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Red Hat Nginx could let injected data from upstream connections
published 1 month ago
Summary
The Red Hat Nginx packages may accept unencrypted data from a secure upstream source before the encryption handshake begins, which could let an attacker insert false information. This could affect web services that rely on Nginx to forward traffic securely. Update Nginx to the latest version provided by Red Hat to close this gap.
What to do
- Update redhat nginx to version 1:1.20.1-10.el7.tuxcare.els8.
- Update redhat nginx-all-modules to version 1:1.20.1-10.el7.tuxcare.els8.
- Update redhat nginx-filesystem to version 1:1.20.1-10.el7.tuxcare.els8.
- Update redhat nginx-mod-devel to version 1:1.20.1-10.el7.tuxcare.els8.
- Update redhat nginx-mod-http-image-filter to version 1:1.20.1-10.el7.tuxcare.els8.
- Update redhat nginx-mod-http-perl to version 1:1.20.1-10.el7.tuxcare.els8.
- Update redhat nginx-mod-http-xslt-filter to version 1:1.20.1-10.el7.tuxcare.els8.
- Update redhat nginx-mod-mail to version 1:1.20.1-10.el7.tuxcare.els8.
- Update redhat nginx-mod-stream to version 1:1.20.1-10.el7.tuxcare.els8.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:RHEL:7 | redhat | nginx |
< 1:1.20.1-10.el7.tuxcare.els8 Fix: upgrade to 1:1.20.1-10.el7.tuxcare.els8
|
| TuxCare:RHEL:7 | redhat | nginx-all-modules |
< 1:1.20.1-10.el7.tuxcare.els8 Fix: upgrade to 1:1.20.1-10.el7.tuxcare.els8
|
| TuxCare:RHEL:7 | redhat | nginx-filesystem |
< 1:1.20.1-10.el7.tuxcare.els8 Fix: upgrade to 1:1.20.1-10.el7.tuxcare.els8
|
| TuxCare:RHEL:7 | redhat | nginx-mod-devel |
< 1:1.20.1-10.el7.tuxcare.els8 Fix: upgrade to 1:1.20.1-10.el7.tuxcare.els8
|
| TuxCare:RHEL:7 | redhat | nginx-mod-http-image-filter |
< 1:1.20.1-10.el7.tuxcare.els8 Fix: upgrade to 1:1.20.1-10.el7.tuxcare.els8
|
| TuxCare:RHEL:7 | redhat | nginx-mod-http-perl |
< 1:1.20.1-10.el7.tuxcare.els8 Fix: upgrade to 1:1.20.1-10.el7.tuxcare.els8
|
| TuxCare:RHEL:7 | redhat | nginx-mod-http-xslt-filter |
< 1:1.20.1-10.el7.tuxcare.els8 Fix: upgrade to 1:1.20.1-10.el7.tuxcare.els8
|
| TuxCare:RHEL:7 | redhat | nginx-mod-mail |
< 1:1.20.1-10.el7.tuxcare.els8 Fix: upgrade to 1:1.20.1-10.el7.tuxcare.els8
|
| TuxCare:RHEL:7 | redhat | nginx-mod-stream |
< 1:1.20.1-10.el7.tuxcare.els8 Fix: upgrade to 1:1.20.1-10.el7.tuxcare.els8
|
Original advisory text
nginx: Fix of 2 CVEs
- CVE-2026-1642: reject a plain text response read from an SSL-enabled
upstream before the TLS handshake has started, preventing data injection
by a man-in-the-middle on the upstream connection
upstream before the TLS handshake has started, preventing data injection
by a man-in-the-middle on the upstream connection
References
- https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1789729568.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-1642 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-42945 Vendor Advisory
Timeline
Published30 Sep 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1789729568 · OSV
Track software like this
Free during beta