Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
nginx:1.24 - Arbitrary code execution or Denial of Service risk
published 3 months ago
Summary
A security update for nginx fixes a critical issue that could allow attackers to execute arbitrary code or crash the server. This update is important for web servers and proxy servers using HTTP and other protocols. We recommend updating to the latest version to ensure security and stability.
What to do
- Update rocky nginx to version 1:1.24.0-3.module+el8.10.0+40144+38158758.
- Update rocky nginx to version 1:1.24.0-3.module+el8.10.0+40187+52bedf24.1.
- Update rocky nginx to version 1:1.24.0-3.module+el8.10.0+40220+e6a4bcb0.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Rocky Linux:8 | rocky | nginx |
< 1:1.24.0-3.module+el8.10.0+40144+38158758 < 1:1.24.0-3.module+el8.10.0+40187+52bedf24.1 < 1:1.24.0-3.module+el8.10.0+40220+e6a4bcb0.2 Fix: upgrade to 1:1.24.0-3.module+el8.10.0+40144+38158758
|
Original advisory text
Important: nginx:1.24 security, bug fix, and enhancement update
nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.
Security Fix(es):
* nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers (CVE-2026-42055)
Bug Fix(es) and Enhancement(s):
* "HTTP/2 bomb" nginx fix breaks module ABI causing crashes [rhel-8.10.z] (JIRA:Rocky Linux-191779)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers (CVE-2026-42055)
Bug Fix(es) and Enhancement(s):
* "HTTP/2 bomb" nginx fix breaks module ABI causing crashes [rhel-8.10.z] (JIRA:Rocky Linux-191779)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://errata.rockylinux.org/RLSA-2026:38847 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2489866 Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Timeline
Published13 Jul 2026
Updated13 Jul 2026
First seen13 Jul 2026
Sources
RLSA-2026:38847 · OSV
Track software like this
Free during beta