This security advisory from Red Hat Product Security addresses vulnerabilities in Red Hat Hardened Images RPMs, specifically affecting nginx packages version 1.30.3-2.hum1 across aarch64 and x86_64 architectures and associated modules. The vulnerabilities correspond to CVE-2026-42055 and CVE-2026-48142, involving memory-related weaknesses categorized under CWE-131 (Incorrect Calculation of Buffer Size) and CWE-125 (Out-of-bounds Read). The update includes bug fixes and enhancements to mitigate these issues. No exploits in the wild have been reported. The advisory references updated RPMs available from Red Hat for remediation.

Successful exploitation of these vulnerabilities could lead to high impact on confidentiality, integrity, and availability of affected systems, as indicated by the CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). This suggests remote network attack with high complexity but no privileges or user interaction required, potentially allowing attackers to compromise system security. However, no known active exploits have been reported.

Red Hat has released updated RPM packages for nginx (version 1.30.3-2.hum1) as part of the Red Hat Hardened Images update to address these vulnerabilities. Users should apply these official updates promptly to remediate the issues. Detailed update instructions and packages are available via Red Hat's official channels at https://images.redhat.com/ and https://access.redhat.com/security/updates/classification/. There is no indication that additional mitigation steps are required beyond applying the vendor-provided updates.