This vulnerability in NGINX's ngx_http_dav_module allows a heap-based buffer overflow triggered by specific configurations involving DAV MOVE or COPY methods combined with prefix location and alias directives. Successful exploitation can lead to denial of service by terminating the NGINX worker process or integrity impact by modifying source or destination file names outside the document root. The NGINX worker process runs with low privileges, constraining the potential impact. Red Hat has released security advisories and patches for affected Red Hat Enterprise Linux versions, including nginx version 1.26.3 as a fixed update.

The vulnerability can cause denial of service by crashing the NGINX worker process or integrity issues by modifying file names outside the document root. However, the impact is constrained because the NGINX worker process operates with low privileges and does not have full system access. There are no known exploits in the wild at this time.

Red Hat has published security advisories and released updated nginx packages (e.g., nginx-1.26.3-1.el10_0.8) that fix this vulnerability. Users should apply these official patches as provided by their vendor distributions. Patch status is confirmed by Red Hat advisories. No alternative mitigations or workarounds are indicated in the vendor advisory.