Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
Nginx Server Allows Remote Code Execution Through Malicious Files
published 7 months ago
Summary
A security update is available for Nginx. This update fixes a vulnerability in the way Nginx handles certain types of files, which could allow an attacker to execute code remotely on a server. To stay secure, update your Nginx installation as soon as possible.
What to do
- Update redhat nginx to version 1:1.20.1-14.el9_2.4.
- Update redhat nginx-all-modules to version 1:1.20.1-14.el9_2.4.
- Update redhat nginx-core to version 1:1.20.1-14.el9_2.4.
- Update redhat nginx-core-debuginfo to version 1:1.20.1-14.el9_2.4.
- Update redhat nginx-debuginfo to version 1:1.20.1-14.el9_2.4.
- Update redhat nginx-debugsource to version 1:1.20.1-14.el9_2.4.
- Update redhat nginx-filesystem to version 1:1.20.1-14.el9_2.4.
- Update redhat nginx-mod-http-image-filter to version 1:1.20.1-14.el9_2.4.
- Update redhat nginx-mod-http-image-filter-debuginfo to version 1:1.20.1-14.el9_2.4.
- Update redhat nginx-mod-http-perl to version 1:1.20.1-14.el9_2.4.
- Update redhat nginx-mod-http-perl-debuginfo to version 1:1.20.1-14.el9_2.4.
- Update redhat nginx-mod-http-xslt-filter to version 1:1.20.1-14.el9_2.4.
- Update redhat nginx-mod-http-xslt-filter-debuginfo to version 1:1.20.1-14.el9_2.4.
- Update redhat nginx-mod-mail to version 1:1.20.1-14.el9_2.4.
- Update redhat nginx-mod-mail-debuginfo to version 1:1.20.1-14.el9_2.4.
- Update redhat nginx-mod-stream to version 1:1.20.1-14.el9_2.4.
- Update redhat nginx-mod-stream-debuginfo to version 1:1.20.1-14.el9_2.4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:rhel_e4s:9.2::appstream | redhat | nginx |
< 1:1.20.1-14.el9_2.4 Fix: upgrade to 1:1.20.1-14.el9_2.4
|
| Red Hat:rhel_e4s:9.2::appstream | redhat | nginx-all-modules |
< 1:1.20.1-14.el9_2.4 Fix: upgrade to 1:1.20.1-14.el9_2.4
|
| Red Hat:rhel_e4s:9.2::appstream | redhat | nginx-core |
< 1:1.20.1-14.el9_2.4 Fix: upgrade to 1:1.20.1-14.el9_2.4
|
| Red Hat:rhel_e4s:9.2::appstream | redhat | nginx-core-debuginfo |
< 1:1.20.1-14.el9_2.4 Fix: upgrade to 1:1.20.1-14.el9_2.4
|
| Red Hat:rhel_e4s:9.2::appstream | redhat | nginx-debuginfo |
< 1:1.20.1-14.el9_2.4 Fix: upgrade to 1:1.20.1-14.el9_2.4
|
| Red Hat:rhel_e4s:9.2::appstream | redhat | nginx-debugsource |
< 1:1.20.1-14.el9_2.4 Fix: upgrade to 1:1.20.1-14.el9_2.4
|
| Red Hat:rhel_e4s:9.2::appstream | redhat | nginx-filesystem |
< 1:1.20.1-14.el9_2.4 Fix: upgrade to 1:1.20.1-14.el9_2.4
|
| Red Hat:rhel_e4s:9.2::appstream | redhat | nginx-mod-http-image-filter |
< 1:1.20.1-14.el9_2.4 Fix: upgrade to 1:1.20.1-14.el9_2.4
|
| Red Hat:rhel_e4s:9.2::appstream | redhat | nginx-mod-http-image-filter-debuginfo |
< 1:1.20.1-14.el9_2.4 Fix: upgrade to 1:1.20.1-14.el9_2.4
|
| Red Hat:rhel_e4s:9.2::appstream | redhat | nginx-mod-http-perl |
< 1:1.20.1-14.el9_2.4 Fix: upgrade to 1:1.20.1-14.el9_2.4
|
| Red Hat:rhel_e4s:9.2::appstream | redhat | nginx-mod-http-perl-debuginfo |
< 1:1.20.1-14.el9_2.4 Fix: upgrade to 1:1.20.1-14.el9_2.4
|
| Red Hat:rhel_e4s:9.2::appstream | redhat | nginx-mod-http-xslt-filter |
< 1:1.20.1-14.el9_2.4 Fix: upgrade to 1:1.20.1-14.el9_2.4
|
| Red Hat:rhel_e4s:9.2::appstream | redhat | nginx-mod-http-xslt-filter-debuginfo |
< 1:1.20.1-14.el9_2.4 Fix: upgrade to 1:1.20.1-14.el9_2.4
|
| Red Hat:rhel_e4s:9.2::appstream | redhat | nginx-mod-mail |
< 1:1.20.1-14.el9_2.4 Fix: upgrade to 1:1.20.1-14.el9_2.4
|
| Red Hat:rhel_e4s:9.2::appstream | redhat | nginx-mod-mail-debuginfo |
< 1:1.20.1-14.el9_2.4 Fix: upgrade to 1:1.20.1-14.el9_2.4
|
| Red Hat:rhel_e4s:9.2::appstream | redhat | nginx-mod-stream |
< 1:1.20.1-14.el9_2.4 Fix: upgrade to 1:1.20.1-14.el9_2.4
|
| Red Hat:rhel_e4s:9.2::appstream | redhat | nginx-mod-stream-debuginfo |
< 1:1.20.1-14.el9_2.4 Fix: upgrade to 1:1.20.1-14.el9_2.4
|
Original advisory text
Red Hat Security Advisory: nginx security update
References
- https://access.redhat.com/errata/RHSA-2026:6235 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2436738 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6235.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-1642 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-1642 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-1642 Vendor Advisory
- https://my.f5.com/manage/s/article/K000159824 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published1 Apr 2026
Updated1 Apr 2026
First seen1 Apr 2026
Sources
RHSA-2026:6235 · OSV
Track software like this
Free during beta