Threats affecting pkg:rpm/redhat/nginx

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server permits retry by returning the Auth-Wait response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-27654 is a heap-based buffer overflow vulnerability in the ngx_http_dav_module of NGINX Open Source and NGINX Plus. It occurs when the configuration uses DAV module MOVE or COPY methods combined with prefix location and alias directives. Exploitation can cause termination of the NGINX worker process (denial of service) or modification of file names outside the document root. The impact on system integrity is limited due to the low privileges of the NGINX worker process user. A patch is available to address this vulnerability.

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: specially crafted MP4 file may cause denial of service (CVE-2024-7347) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A vulnerability in nginx allows bypassing client certificate authentication when multiple server blocks share the same IP address and port using TLS session resumption. This occurs if TLS Session Tickets or SSL session cache are used in the default server performing client certificate authentication. The issue has a moderate security impact and affects multiple nginx versions. A patch is available from Red Hat and users are advised to update to fixed versions.