Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux nginx may crash with certain alias/rewrite settings
published 19 days ago
Summary
The nginx web server packages for AlmaLinux can stop working if a URL rewrite changes the request and the configuration uses an alias. This happens because the server tries to handle the changed request incorrectly. Apply the latest package updates for nginx to prevent the crash.
What to do
- Update almalinux nginx to version 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12.
- Update almalinux nginx-all-modules to version 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12.
- Update almalinux nginx-core to version 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12.
- Update almalinux nginx-filesystem to version 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12.
- Update almalinux nginx-mod-devel to version 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12.
- Update almalinux nginx-mod-http-image-filter to version 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12.
- Update almalinux nginx-mod-http-perl to version 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12.
- Update almalinux nginx-mod-http-xslt-filter to version 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12.
- Update almalinux nginx-mod-mail to version 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12.
- Update almalinux nginx-mod-stream to version 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:AlmaLinux:9.6 | almalinux | nginx |
< 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12 Fix: upgrade to 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12
|
| TuxCare:AlmaLinux:9.6 | almalinux | nginx-all-modules |
< 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12 Fix: upgrade to 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12
|
| TuxCare:AlmaLinux:9.6 | almalinux | nginx-core |
< 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12 Fix: upgrade to 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12
|
| TuxCare:AlmaLinux:9.6 | almalinux | nginx-filesystem |
< 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12 Fix: upgrade to 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12
|
| TuxCare:AlmaLinux:9.6 | almalinux | nginx-mod-devel |
< 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12 Fix: upgrade to 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12
|
| TuxCare:AlmaLinux:9.6 | almalinux | nginx-mod-http-image-filter |
< 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12 Fix: upgrade to 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12
|
| TuxCare:AlmaLinux:9.6 | almalinux | nginx-mod-http-perl |
< 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12 Fix: upgrade to 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12
|
| TuxCare:AlmaLinux:9.6 | almalinux | nginx-mod-http-xslt-filter |
< 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12 Fix: upgrade to 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12
|
| TuxCare:AlmaLinux:9.6 | almalinux | nginx-mod-mail |
< 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12 Fix: upgrade to 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12
|
| TuxCare:AlmaLinux:9.6 | almalinux | nginx-mod-stream |
< 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12 Fix: upgrade to 2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12
|
Original advisory text
nginx: Fix of CVE-2026-15176
- CVE-2026-15176: fix heap buffer overflow in ngx_http_map_uri_to_path()
when a location using "alias" maps a URI changed by "rewrite" before a
new location is selected; reject the mapping while r->uri_changed is set
when a location using "alias" maps a URI changed by "rewrite" before a
new location is selected; reject the mapping while r->uri_changed is set
References
- https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1792146840.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-15176 Vendor Advisory
Timeline
Published16 Oct 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1792146840 · OSV
Track software like this
Free during beta