Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

nginx may let attackers run code

published 1 month ago

Summary

Several Red Hat nginx packages have a weakness that could allow an attacker to execute their own programs on the web server. This could lead to loss of control over the server and exposure of data. Install the latest nginx updates from Red Hat as soon as possible to close the risk.

What to do

Update redhat nginx-mod-http-image-filter to version 2:1.26.3-6.el10_2.7.
Update redhat nginx to version 2:1.26.3-6.el10_2.7.
Update redhat nginx-all-modules to version 2:1.26.3-6.el10_2.7.
Update redhat nginx-core to version 2:1.26.3-6.el10_2.7.
Update redhat nginx-core-debuginfo to version 2:1.26.3-6.el10_2.7.
Update redhat nginx-debuginfo to version 2:1.26.3-6.el10_2.7.
Update redhat nginx-debugsource to version 2:1.26.3-6.el10_2.7.
Update redhat nginx-filesystem to version 2:1.26.3-6.el10_2.7.
Update redhat nginx-mod-http-image-filter-debuginfo to version 2:1.26.3-6.el10_2.7.
Update redhat nginx-mod-http-perl to version 2:1.26.3-6.el10_2.7.
Update redhat nginx-mod-http-perl-debuginfo to version 2:1.26.3-6.el10_2.7.
Update redhat nginx-mod-http-xslt-filter to version 2:1.26.3-6.el10_2.7.
Update redhat nginx-mod-http-xslt-filter-debuginfo to version 2:1.26.3-6.el10_2.7.
Update redhat nginx-mod-mail to version 2:1.26.3-6.el10_2.7.
Update redhat nginx-mod-mail-debuginfo to version 2:1.26.3-6.el10_2.7.
Update redhat nginx-mod-stream to version 2:1.26.3-6.el10_2.7.
Update redhat nginx-mod-stream-debuginfo to version 2:1.26.3-6.el10_2.7.
Update redhat nginx-mod-devel to version 2:1.26.3-6.el10_2.7.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux:10.2	redhat	nginx-mod-http-image-filter	< 2:1.26.3-6.el10_2.7 Fix: upgrade to 2:1.26.3-6.el10_2.7
Red Hat:enterprise_linux:10.2	redhat	nginx	< 2:1.26.3-6.el10_2.7 Fix: upgrade to 2:1.26.3-6.el10_2.7
Red Hat:enterprise_linux:10.2	redhat	nginx-all-modules	< 2:1.26.3-6.el10_2.7 Fix: upgrade to 2:1.26.3-6.el10_2.7
Red Hat:enterprise_linux:10.2	redhat	nginx-core	< 2:1.26.3-6.el10_2.7 Fix: upgrade to 2:1.26.3-6.el10_2.7
Red Hat:enterprise_linux:10.2	redhat	nginx-core-debuginfo	< 2:1.26.3-6.el10_2.7 Fix: upgrade to 2:1.26.3-6.el10_2.7
Red Hat:enterprise_linux:10.2	redhat	nginx-debuginfo	< 2:1.26.3-6.el10_2.7 Fix: upgrade to 2:1.26.3-6.el10_2.7
Red Hat:enterprise_linux:10.2	redhat	nginx-debugsource	< 2:1.26.3-6.el10_2.7 Fix: upgrade to 2:1.26.3-6.el10_2.7
Red Hat:enterprise_linux:10.2	redhat	nginx-filesystem	< 2:1.26.3-6.el10_2.7 Fix: upgrade to 2:1.26.3-6.el10_2.7
Red Hat:enterprise_linux:10.2	redhat	nginx-mod-http-image-filter-debuginfo	< 2:1.26.3-6.el10_2.7 Fix: upgrade to 2:1.26.3-6.el10_2.7
Red Hat:enterprise_linux:10.2	redhat	nginx-mod-http-perl	< 2:1.26.3-6.el10_2.7 Fix: upgrade to 2:1.26.3-6.el10_2.7
Red Hat:enterprise_linux:10.2	redhat	nginx-mod-http-perl-debuginfo	< 2:1.26.3-6.el10_2.7 Fix: upgrade to 2:1.26.3-6.el10_2.7
Red Hat:enterprise_linux:10.2	redhat	nginx-mod-http-xslt-filter	< 2:1.26.3-6.el10_2.7 Fix: upgrade to 2:1.26.3-6.el10_2.7
Red Hat:enterprise_linux:10.2	redhat	nginx-mod-http-xslt-filter-debuginfo	< 2:1.26.3-6.el10_2.7 Fix: upgrade to 2:1.26.3-6.el10_2.7
Red Hat:enterprise_linux:10.2	redhat	nginx-mod-mail	< 2:1.26.3-6.el10_2.7 Fix: upgrade to 2:1.26.3-6.el10_2.7
Red Hat:enterprise_linux:10.2	redhat	nginx-mod-mail-debuginfo	< 2:1.26.3-6.el10_2.7 Fix: upgrade to 2:1.26.3-6.el10_2.7
Red Hat:enterprise_linux:10.2	redhat	nginx-mod-stream	< 2:1.26.3-6.el10_2.7 Fix: upgrade to 2:1.26.3-6.el10_2.7
Red Hat:enterprise_linux:10.2	redhat	nginx-mod-stream-debuginfo	< 2:1.26.3-6.el10_2.7 Fix: upgrade to 2:1.26.3-6.el10_2.7
Red Hat:enterprise_linux:10.2	redhat	nginx-mod-devel	< 2:1.26.3-6.el10_2.7 Fix: upgrade to 2:1.26.3-6.el10_2.7

Original advisory text

Red Hat Security Advisory: nginx security update

References

https://access.redhat.com/errata/RHSA-2026:67314 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2500967 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67314.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-42533 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-42533 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-42533 Vendor Advisory
https://my.f5.com/manage/s/article/K000162097 Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.0 High

Timeline

Published15 Sep 2026

Updated15 Sep 2026

First seen15 Sep 2026

Sources

RHSA-2026:67314 · OSV

Track software like this

Free during beta