Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Red Hat NGINX may allow memory corruption in rewrite module
published 4 months ago
Summary
Certain Red Hat NGINX packages contain a flaw in the rewrite component that can be triggered by crafted URL patterns, leading to memory errors that could crash the server or be exploited for unauthorized actions. This issue affects the core NGINX package and related module packages. Apply the latest Red Hat NGINX update as soon as possible to resolve the problem.
What to do
- Update redhat nginx to version 1:1.20.1-10.el7.tuxcare.els3.
- Update redhat nginx-all-modules to version 1:1.20.1-10.el7.tuxcare.els3.
- Update redhat nginx-filesystem to version 1:1.20.1-10.el7.tuxcare.els3.
- Update redhat nginx-mod-devel to version 1:1.20.1-10.el7.tuxcare.els3.
- Update redhat nginx-mod-http-image-filter to version 1:1.20.1-10.el7.tuxcare.els3.
- Update redhat nginx-mod-http-perl to version 1:1.20.1-10.el7.tuxcare.els3.
- Update redhat nginx-mod-http-xslt-filter to version 1:1.20.1-10.el7.tuxcare.els3.
- Update redhat nginx-mod-mail to version 1:1.20.1-10.el7.tuxcare.els3.
- Update redhat nginx-mod-stream to version 1:1.20.1-10.el7.tuxcare.els3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:RHEL:7 | redhat | nginx |
< 1:1.20.1-10.el7.tuxcare.els3 Fix: upgrade to 1:1.20.1-10.el7.tuxcare.els3
|
| TuxCare:RHEL:7 | redhat | nginx-all-modules |
< 1:1.20.1-10.el7.tuxcare.els3 Fix: upgrade to 1:1.20.1-10.el7.tuxcare.els3
|
| TuxCare:RHEL:7 | redhat | nginx-filesystem |
< 1:1.20.1-10.el7.tuxcare.els3 Fix: upgrade to 1:1.20.1-10.el7.tuxcare.els3
|
| TuxCare:RHEL:7 | redhat | nginx-mod-devel |
< 1:1.20.1-10.el7.tuxcare.els3 Fix: upgrade to 1:1.20.1-10.el7.tuxcare.els3
|
| TuxCare:RHEL:7 | redhat | nginx-mod-http-image-filter |
< 1:1.20.1-10.el7.tuxcare.els3 Fix: upgrade to 1:1.20.1-10.el7.tuxcare.els3
|
| TuxCare:RHEL:7 | redhat | nginx-mod-http-perl |
< 1:1.20.1-10.el7.tuxcare.els3 Fix: upgrade to 1:1.20.1-10.el7.tuxcare.els3
|
| TuxCare:RHEL:7 | redhat | nginx-mod-http-xslt-filter |
< 1:1.20.1-10.el7.tuxcare.els3 Fix: upgrade to 1:1.20.1-10.el7.tuxcare.els3
|
| TuxCare:RHEL:7 | redhat | nginx-mod-mail |
< 1:1.20.1-10.el7.tuxcare.els3 Fix: upgrade to 1:1.20.1-10.el7.tuxcare.els3
|
| TuxCare:RHEL:7 | redhat | nginx-mod-stream |
< 1:1.20.1-10.el7.tuxcare.els3 Fix: upgrade to 1:1.20.1-10.el7.tuxcare.els3
|
Original advisory text
nginx: Fix of 2 CVEs
- CVE-2026-9256: fix heap buffer overflow in ngx_http_rewrite_module with overlapping captures
References
- https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1779992757.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-44487 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-9256 Vendor Advisory
Timeline
Published26 Jun 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1779992757 · OSV
Track software like this
Free during beta