RHSA-2026:93472
Vulnerability from csaf_redhat - Published: 2026-11-02 03:38 - Updated: 2026-11-02 10:51Summary
Red Hat Security Advisory: nginx security update
Severity
Important
Notes
Topic: An update for nginx is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.
Security Fix(es):
* nginx: ngx_http_rewrite_module: code execution and denial of service (CVE-2026-9256)
* nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers (CVE-2026-42055)
* nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2026-56434)
* nginx: NGINX: Arbitrary code execution via crafted HTTP requests (CVE-2026-42533)
* nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module (CVE-2026-60005)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the ngx_http_rewrite_module module of NGINX. When a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures and a replacement string that references multiple such captures in a redirect or arguments context, an unauthenticated attacker can send crafted HTTP requests and cause a heap-based buffer overflow in the worker process, potentially allowing code execution or a denial of service by forcing the process to restart.
8.1 (High)
Affected products
Fixed
63 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-all-modules-1:1.20.1-14.el9_2.7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-filesystem-1:1.20.1-14.el9_2.7.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in NGINX. When NGINX is configured to proxy HTTP/2 traffic using the ngx_http_proxy_v2_module or ngx_http_grpc_module with specific settings, a remote, unauthenticated attacker can send specially crafted large headers. This can trigger a heap-based buffer overflow, leading to a restart of the NGINX worker process and a Denial of Service (DoS). Under certain conditions, such as when Address Space Layout Randomization (ASLR) is disabled or bypassed, this vulnerability could also allow for arbitrary code execution.
8.1 (High)
Affected products
Fixed
63 products, the same list as for
CVE-2026-9256
Threats
Impact
Important
A flaw was found in NGINX. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests when the `map` directive uses regular expression (regex) matching and references regex capture variables before referencing the map output variable. This can lead to a heap buffer overflow, which may allow for arbitrary code execution on systems where Address Space Layout Randomization (ASLR) is disabled or bypassed. Additionally, this flaw can cause a denial-of-service (DoS) due to the NGINX worker process restarting.
7.0 (High)
Affected products
Fixed
63 products, the same list as for
CVE-2026-9256
Threats
Impact
Important
A vulnerability in NGINX's ngx_http_ssi_module allows an unauthenticated MITM attacker to trigger a heap buffer over-read by manipulating upstream server responses. This requires SSI, proxy_pass, and proxy_buffering off to be configured, and can result in memory modification or a Denial of Service (DoS).
6.5 (Medium)
Affected products
Fixed
63 products, the same list as for
CVE-2026-9256
Threats
Impact
Moderate
A vulnerability in the NGINX ngx_http_slice_module allows remote, unauthenticated attackers to access uninitialized memory via crafted requests. If configured with unnamed regex captures or background cache updates, this flaw can result in limited memory disclosure or a denial-of-service crash.
8.2 (High)
Affected products
Fixed
63 products, the same list as for
CVE-2026-9256
Threats
Impact
Important
References
33 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for nginx is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. \n\nSecurity Fix(es):\n\n* nginx: ngx_http_rewrite_module: code execution and denial of service (CVE-2026-9256)\n\n* nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers (CVE-2026-42055)\n\n* nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2026-56434)\n\n* nginx: NGINX: Arbitrary code execution via crafted HTTP requests (CVE-2026-42533)\n\n* nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module (CVE-2026-60005)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:93472",
"url": "https://access.redhat.com/errata/RHSA-2026:93472"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2480746",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480746"
},
{
"category": "external",
"summary": "2489866",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489866"
},
{
"category": "external",
"summary": "2500960",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500960"
},
{
"category": "external",
"summary": "2500967",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500967"
},
{
"category": "external",
"summary": "2500992",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500992"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_93472.json"
}
],
"title": "Red Hat Security Advisory: nginx security update",
"tracking": {
"current_release_date": "2026-11-02T10:51:15+00:00",
"generator": {
"date": "2026-11-02T10:51:15+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.4"
}
},
"id": "RHSA-2026:93472",
"initial_release_date": "2026-11-02T03:38:56+00:00",
"revision_history": [
{
"date": "2026-11-02T03:38:56+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-11-02T03:38:56+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-11-02T10:51:15+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product": {
"name": "Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_e4s:9.2::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "nginx-1:1.20.1-14.el9_2.7.src",
"product": {
"name": "nginx-1:1.20.1-14.el9_2.7.src",
"product_id": "nginx-1:1.20.1-14.el9_2.7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx@1.20.1-14.el9_2.7?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "nginx-1:1.20.1-14.el9_2.7.aarch64",
"product": {
"name": "nginx-1:1.20.1-14.el9_2.7.aarch64",
"product_id": "nginx-1:1.20.1-14.el9_2.7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx@1.20.1-14.el9_2.7?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-core-1:1.20.1-14.el9_2.7.aarch64",
"product": {
"name": "nginx-core-1:1.20.1-14.el9_2.7.aarch64",
"product_id": "nginx-core-1:1.20.1-14.el9_2.7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-core@1.20.1-14.el9_2.7?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64",
"product": {
"name": "nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64",
"product_id": "nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-http-image-filter@1.20.1-14.el9_2.7?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-http-perl-1:1.20.1-14.el9_2.7.aarch64",
"product": {
"name": "nginx-mod-http-perl-1:1.20.1-14.el9_2.7.aarch64",
"product_id": "nginx-mod-http-perl-1:1.20.1-14.el9_2.7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-http-perl@1.20.1-14.el9_2.7?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.aarch64",
"product": {
"name": "nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.aarch64",
"product_id": "nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-http-xslt-filter@1.20.1-14.el9_2.7?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-mail-1:1.20.1-14.el9_2.7.aarch64",
"product": {
"name": "nginx-mod-mail-1:1.20.1-14.el9_2.7.aarch64",
"product_id": "nginx-mod-mail-1:1.20.1-14.el9_2.7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-mail@1.20.1-14.el9_2.7?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-stream-1:1.20.1-14.el9_2.7.aarch64",
"product": {
"name": "nginx-mod-stream-1:1.20.1-14.el9_2.7.aarch64",
"product_id": "nginx-mod-stream-1:1.20.1-14.el9_2.7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-stream@1.20.1-14.el9_2.7?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64",
"product": {
"name": "nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64",
"product_id": "nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-debugsource@1.20.1-14.el9_2.7?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"product": {
"name": "nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"product_id": "nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-core-debuginfo@1.20.1-14.el9_2.7?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"product": {
"name": "nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"product_id": "nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-debuginfo@1.20.1-14.el9_2.7?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"product": {
"name": "nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"product_id": "nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-http-image-filter-debuginfo@1.20.1-14.el9_2.7?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"product": {
"name": "nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"product_id": "nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-http-perl-debuginfo@1.20.1-14.el9_2.7?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"product": {
"name": "nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"product_id": "nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-http-xslt-filter-debuginfo@1.20.1-14.el9_2.7?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"product": {
"name": "nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"product_id": "nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-mail-debuginfo@1.20.1-14.el9_2.7?arch=aarch64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"product": {
"name": "nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"product_id": "nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-stream-debuginfo@1.20.1-14.el9_2.7?arch=aarch64\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "nginx-1:1.20.1-14.el9_2.7.ppc64le",
"product": {
"name": "nginx-1:1.20.1-14.el9_2.7.ppc64le",
"product_id": "nginx-1:1.20.1-14.el9_2.7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx@1.20.1-14.el9_2.7?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-core-1:1.20.1-14.el9_2.7.ppc64le",
"product": {
"name": "nginx-core-1:1.20.1-14.el9_2.7.ppc64le",
"product_id": "nginx-core-1:1.20.1-14.el9_2.7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-core@1.20.1-14.el9_2.7?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le",
"product": {
"name": "nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le",
"product_id": "nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-http-image-filter@1.20.1-14.el9_2.7?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-http-perl-1:1.20.1-14.el9_2.7.ppc64le",
"product": {
"name": "nginx-mod-http-perl-1:1.20.1-14.el9_2.7.ppc64le",
"product_id": "nginx-mod-http-perl-1:1.20.1-14.el9_2.7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-http-perl@1.20.1-14.el9_2.7?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.ppc64le",
"product": {
"name": "nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.ppc64le",
"product_id": "nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-http-xslt-filter@1.20.1-14.el9_2.7?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-mail-1:1.20.1-14.el9_2.7.ppc64le",
"product": {
"name": "nginx-mod-mail-1:1.20.1-14.el9_2.7.ppc64le",
"product_id": "nginx-mod-mail-1:1.20.1-14.el9_2.7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-mail@1.20.1-14.el9_2.7?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-stream-1:1.20.1-14.el9_2.7.ppc64le",
"product": {
"name": "nginx-mod-stream-1:1.20.1-14.el9_2.7.ppc64le",
"product_id": "nginx-mod-stream-1:1.20.1-14.el9_2.7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-stream@1.20.1-14.el9_2.7?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le",
"product": {
"name": "nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le",
"product_id": "nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-debugsource@1.20.1-14.el9_2.7?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"product": {
"name": "nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"product_id": "nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-core-debuginfo@1.20.1-14.el9_2.7?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"product": {
"name": "nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"product_id": "nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-debuginfo@1.20.1-14.el9_2.7?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"product": {
"name": "nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"product_id": "nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-http-image-filter-debuginfo@1.20.1-14.el9_2.7?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"product": {
"name": "nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"product_id": "nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-http-perl-debuginfo@1.20.1-14.el9_2.7?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"product": {
"name": "nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"product_id": "nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-http-xslt-filter-debuginfo@1.20.1-14.el9_2.7?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"product": {
"name": "nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"product_id": "nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-mail-debuginfo@1.20.1-14.el9_2.7?arch=ppc64le\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"product": {
"name": "nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"product_id": "nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-stream-debuginfo@1.20.1-14.el9_2.7?arch=ppc64le\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "nginx-1:1.20.1-14.el9_2.7.s390x",
"product": {
"name": "nginx-1:1.20.1-14.el9_2.7.s390x",
"product_id": "nginx-1:1.20.1-14.el9_2.7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx@1.20.1-14.el9_2.7?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-core-1:1.20.1-14.el9_2.7.s390x",
"product": {
"name": "nginx-core-1:1.20.1-14.el9_2.7.s390x",
"product_id": "nginx-core-1:1.20.1-14.el9_2.7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-core@1.20.1-14.el9_2.7?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x",
"product": {
"name": "nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x",
"product_id": "nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-http-image-filter@1.20.1-14.el9_2.7?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-http-perl-1:1.20.1-14.el9_2.7.s390x",
"product": {
"name": "nginx-mod-http-perl-1:1.20.1-14.el9_2.7.s390x",
"product_id": "nginx-mod-http-perl-1:1.20.1-14.el9_2.7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-http-perl@1.20.1-14.el9_2.7?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.s390x",
"product": {
"name": "nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.s390x",
"product_id": "nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-http-xslt-filter@1.20.1-14.el9_2.7?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-mail-1:1.20.1-14.el9_2.7.s390x",
"product": {
"name": "nginx-mod-mail-1:1.20.1-14.el9_2.7.s390x",
"product_id": "nginx-mod-mail-1:1.20.1-14.el9_2.7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-mail@1.20.1-14.el9_2.7?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-stream-1:1.20.1-14.el9_2.7.s390x",
"product": {
"name": "nginx-mod-stream-1:1.20.1-14.el9_2.7.s390x",
"product_id": "nginx-mod-stream-1:1.20.1-14.el9_2.7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-stream@1.20.1-14.el9_2.7?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-debugsource-1:1.20.1-14.el9_2.7.s390x",
"product": {
"name": "nginx-debugsource-1:1.20.1-14.el9_2.7.s390x",
"product_id": "nginx-debugsource-1:1.20.1-14.el9_2.7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-debugsource@1.20.1-14.el9_2.7?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"product": {
"name": "nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"product_id": "nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-core-debuginfo@1.20.1-14.el9_2.7?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"product": {
"name": "nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"product_id": "nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-debuginfo@1.20.1-14.el9_2.7?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"product": {
"name": "nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"product_id": "nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-http-image-filter-debuginfo@1.20.1-14.el9_2.7?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"product": {
"name": "nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"product_id": "nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-http-perl-debuginfo@1.20.1-14.el9_2.7?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"product": {
"name": "nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"product_id": "nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-http-xslt-filter-debuginfo@1.20.1-14.el9_2.7?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"product": {
"name": "nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"product_id": "nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-mail-debuginfo@1.20.1-14.el9_2.7?arch=s390x\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"product": {
"name": "nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"product_id": "nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-stream-debuginfo@1.20.1-14.el9_2.7?arch=s390x\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "nginx-1:1.20.1-14.el9_2.7.x86_64",
"product": {
"name": "nginx-1:1.20.1-14.el9_2.7.x86_64",
"product_id": "nginx-1:1.20.1-14.el9_2.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx@1.20.1-14.el9_2.7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-core-1:1.20.1-14.el9_2.7.x86_64",
"product": {
"name": "nginx-core-1:1.20.1-14.el9_2.7.x86_64",
"product_id": "nginx-core-1:1.20.1-14.el9_2.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-core@1.20.1-14.el9_2.7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64",
"product": {
"name": "nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64",
"product_id": "nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-http-image-filter@1.20.1-14.el9_2.7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-http-perl-1:1.20.1-14.el9_2.7.x86_64",
"product": {
"name": "nginx-mod-http-perl-1:1.20.1-14.el9_2.7.x86_64",
"product_id": "nginx-mod-http-perl-1:1.20.1-14.el9_2.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-http-perl@1.20.1-14.el9_2.7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.x86_64",
"product": {
"name": "nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.x86_64",
"product_id": "nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-http-xslt-filter@1.20.1-14.el9_2.7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-mail-1:1.20.1-14.el9_2.7.x86_64",
"product": {
"name": "nginx-mod-mail-1:1.20.1-14.el9_2.7.x86_64",
"product_id": "nginx-mod-mail-1:1.20.1-14.el9_2.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-mail@1.20.1-14.el9_2.7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-stream-1:1.20.1-14.el9_2.7.x86_64",
"product": {
"name": "nginx-mod-stream-1:1.20.1-14.el9_2.7.x86_64",
"product_id": "nginx-mod-stream-1:1.20.1-14.el9_2.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-stream@1.20.1-14.el9_2.7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64",
"product": {
"name": "nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64",
"product_id": "nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-debugsource@1.20.1-14.el9_2.7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"product": {
"name": "nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"product_id": "nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-core-debuginfo@1.20.1-14.el9_2.7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"product": {
"name": "nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"product_id": "nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-debuginfo@1.20.1-14.el9_2.7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"product": {
"name": "nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"product_id": "nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-http-image-filter-debuginfo@1.20.1-14.el9_2.7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"product": {
"name": "nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"product_id": "nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-http-perl-debuginfo@1.20.1-14.el9_2.7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"product": {
"name": "nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"product_id": "nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-http-xslt-filter-debuginfo@1.20.1-14.el9_2.7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"product": {
"name": "nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"product_id": "nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-mail-debuginfo@1.20.1-14.el9_2.7?arch=x86_64\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"product": {
"name": "nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"product_id": "nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-mod-stream-debuginfo@1.20.1-14.el9_2.7?arch=x86_64\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "nginx-all-modules-1:1.20.1-14.el9_2.7.noarch",
"product": {
"name": "nginx-all-modules-1:1.20.1-14.el9_2.7.noarch",
"product_id": "nginx-all-modules-1:1.20.1-14.el9_2.7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-all-modules@1.20.1-14.el9_2.7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "nginx-filesystem-1:1.20.1-14.el9_2.7.noarch",
"product": {
"name": "nginx-filesystem-1:1.20.1-14.el9_2.7.noarch",
"product_id": "nginx-filesystem-1:1.20.1-14.el9_2.7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/nginx-filesystem@1.20.1-14.el9_2.7?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-1:1.20.1-14.el9_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.aarch64"
},
"product_reference": "nginx-1:1.20.1-14.el9_2.7.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-1:1.20.1-14.el9_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.ppc64le"
},
"product_reference": "nginx-1:1.20.1-14.el9_2.7.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-1:1.20.1-14.el9_2.7.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.s390x"
},
"product_reference": "nginx-1:1.20.1-14.el9_2.7.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-1:1.20.1-14.el9_2.7.src as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.src"
},
"product_reference": "nginx-1:1.20.1-14.el9_2.7.src",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-1:1.20.1-14.el9_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.x86_64"
},
"product_reference": "nginx-1:1.20.1-14.el9_2.7.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-all-modules-1:1.20.1-14.el9_2.7.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-all-modules-1:1.20.1-14.el9_2.7.noarch"
},
"product_reference": "nginx-all-modules-1:1.20.1-14.el9_2.7.noarch",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-core-1:1.20.1-14.el9_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.aarch64"
},
"product_reference": "nginx-core-1:1.20.1-14.el9_2.7.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-core-1:1.20.1-14.el9_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.ppc64le"
},
"product_reference": "nginx-core-1:1.20.1-14.el9_2.7.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-core-1:1.20.1-14.el9_2.7.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.s390x"
},
"product_reference": "nginx-core-1:1.20.1-14.el9_2.7.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-core-1:1.20.1-14.el9_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.x86_64"
},
"product_reference": "nginx-core-1:1.20.1-14.el9_2.7.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64"
},
"product_reference": "nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le"
},
"product_reference": "nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x"
},
"product_reference": "nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64"
},
"product_reference": "nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64"
},
"product_reference": "nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le"
},
"product_reference": "nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x"
},
"product_reference": "nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64"
},
"product_reference": "nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64"
},
"product_reference": "nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le"
},
"product_reference": "nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-debugsource-1:1.20.1-14.el9_2.7.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.s390x"
},
"product_reference": "nginx-debugsource-1:1.20.1-14.el9_2.7.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64"
},
"product_reference": "nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-filesystem-1:1.20.1-14.el9_2.7.noarch as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-filesystem-1:1.20.1-14.el9_2.7.noarch"
},
"product_reference": "nginx-filesystem-1:1.20.1-14.el9_2.7.noarch",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64"
},
"product_reference": "nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le"
},
"product_reference": "nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x"
},
"product_reference": "nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64"
},
"product_reference": "nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64"
},
"product_reference": "nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le"
},
"product_reference": "nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x"
},
"product_reference": "nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64"
},
"product_reference": "nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-http-perl-1:1.20.1-14.el9_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.aarch64"
},
"product_reference": "nginx-mod-http-perl-1:1.20.1-14.el9_2.7.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-http-perl-1:1.20.1-14.el9_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.ppc64le"
},
"product_reference": "nginx-mod-http-perl-1:1.20.1-14.el9_2.7.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-http-perl-1:1.20.1-14.el9_2.7.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.s390x"
},
"product_reference": "nginx-mod-http-perl-1:1.20.1-14.el9_2.7.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-http-perl-1:1.20.1-14.el9_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.x86_64"
},
"product_reference": "nginx-mod-http-perl-1:1.20.1-14.el9_2.7.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.aarch64"
},
"product_reference": "nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.ppc64le"
},
"product_reference": "nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.s390x"
},
"product_reference": "nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.x86_64"
},
"product_reference": "nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.aarch64"
},
"product_reference": "nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.ppc64le"
},
"product_reference": "nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.s390x"
},
"product_reference": "nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.x86_64"
},
"product_reference": "nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64"
},
"product_reference": "nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le"
},
"product_reference": "nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x"
},
"product_reference": "nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64"
},
"product_reference": "nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-mail-1:1.20.1-14.el9_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.aarch64"
},
"product_reference": "nginx-mod-mail-1:1.20.1-14.el9_2.7.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-mail-1:1.20.1-14.el9_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.ppc64le"
},
"product_reference": "nginx-mod-mail-1:1.20.1-14.el9_2.7.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-mail-1:1.20.1-14.el9_2.7.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.s390x"
},
"product_reference": "nginx-mod-mail-1:1.20.1-14.el9_2.7.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-mail-1:1.20.1-14.el9_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.x86_64"
},
"product_reference": "nginx-mod-mail-1:1.20.1-14.el9_2.7.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.aarch64"
},
"product_reference": "nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.ppc64le"
},
"product_reference": "nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.s390x"
},
"product_reference": "nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.x86_64"
},
"product_reference": "nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-stream-1:1.20.1-14.el9_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.aarch64"
},
"product_reference": "nginx-mod-stream-1:1.20.1-14.el9_2.7.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-stream-1:1.20.1-14.el9_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.ppc64le"
},
"product_reference": "nginx-mod-stream-1:1.20.1-14.el9_2.7.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-stream-1:1.20.1-14.el9_2.7.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.s390x"
},
"product_reference": "nginx-mod-stream-1:1.20.1-14.el9_2.7.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-stream-1:1.20.1-14.el9_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.x86_64"
},
"product_reference": "nginx-mod-stream-1:1.20.1-14.el9_2.7.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.aarch64"
},
"product_reference": "nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.ppc64le"
},
"product_reference": "nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.s390x as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.s390x"
},
"product_reference": "nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)",
"product_id": "AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.x86_64"
},
"product_reference": "nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"relates_to_product_reference": "AppStream-9.2.0.Z.E4S"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-9256",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-05-22T15:00:55.131994+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480746"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the ngx_http_rewrite_module module of NGINX. When a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures and a replacement string that references multiple such captures in a redirect or arguments context, an unauthenticated attacker can send crafted HTTP requests and cause a heap-based buffer overflow in the worker process, potentially allowing code execution or a denial of service by forcing the process to restart.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nginx: ngx_http_rewrite_module: code execution and denial of service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this vulnerability, a rewrite directive must be configured with a regex pattern that uses distinct, overlapping PCRE captures and a replacement string referencing multiple such captures, limiting its exposure as this is not the default configuration. This issue allows an attacker to potentially execute arbitrary code or cause a denial of service by forcing the worker process to restart.\n\nDefault Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability.\n\nDue to these reasons, this flaw has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.src",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-all-modules-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-filesystem-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-9256"
},
{
"category": "external",
"summary": "RHBZ#2480746",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480746"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-9256",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9256"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-9256",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9256"
},
{
"category": "external",
"summary": "https://my.f5.com/manage/s/article/K000161377",
"url": "https://my.f5.com/manage/s/article/K000161377"
}
],
"release_date": "2026-05-22T14:11:41.877000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-02T03:38:56+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.src",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-all-modules-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-filesystem-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:93472"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, use named captures instead of unnamed captures in rewrite definitions.\n\nFor example, the following rewrite directive uses unnamed PCRE capture groups, $1 and $2:\n\n~~~\nrewrite ^/users/([0-9]+)/profile/(.*)$ /profile.php?id=$1\u0026tab=$2 last;\n~~~\n\nTo mitigate this vulnerability for this example, replace $1 and $2 with the appropriate named captures, $user_id and $section:\n\n~~~\nrewrite ^/users/(?\u003cuser_id\u003e[0-9]+)/profile/(?\u003csection\u003e.*)$ /profile.php?id=$user_id\u0026tab=$section last;\n~~~",
"product_ids": [
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.src",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-all-modules-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-filesystem-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.src",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-all-modules-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-filesystem-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "nginx: ngx_http_rewrite_module: code execution and denial of service"
},
{
"cve": "CVE-2026-42055",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-06-17T16:01:41.848723+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2489866"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in NGINX. When NGINX is configured to proxy HTTP/2 traffic using the ngx_http_proxy_v2_module or ngx_http_grpc_module with specific settings, a remote, unauthenticated attacker can send specially crafted large headers. This can trigger a heap-based buffer overflow, leading to a restart of the NGINX worker process and a Denial of Service (DoS). Under certain conditions, such as when Address Space Layout Randomization (ASLR) is disabled or bypassed, this vulnerability could also allow for arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is classified as Important severity primarily because:\nConditions for Exploitation: A remote, unauthenticated attacker can only exploit this if NGINX is explicitly configured to proxy HTTP/2 traffic using the ngx_http_proxy_v2_module or ngx_http_grpc_module.\n\nImpact Limitations: While the flaw reliably causes a Denial of Service (worker restart), achieving arbitrary code execution is highly complex in modern environments as it requires the attacker to bypass or disable Address Space Layout Randomization (ASLR)",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.src",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-all-modules-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-filesystem-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42055"
},
{
"category": "external",
"summary": "RHBZ#2489866",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489866"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42055",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42055"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42055",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42055"
},
{
"category": "external",
"summary": "https://my.f5.com/manage/s/article/K000161584",
"url": "https://my.f5.com/manage/s/article/K000161584"
}
],
"release_date": "2026-06-17T14:04:32.520000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-02T03:38:56+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.src",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-all-modules-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-filesystem-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:93472"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, ensure that the `ignore_invalid_headers` directive is set to `on` in your NGINX configuration, or reduce the size specified by the `large_client_header_buffers` directive to 2 megabytes or less. These changes require an NGINX service reload or restart to take effect. Reloading the NGINX service is generally safe, but a restart will briefly interrupt service.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.src",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-all-modules-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-filesystem-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.src",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-all-modules-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-filesystem-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers"
},
{
"cve": "CVE-2026-42533",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-07-15T15:01:51.992917+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500967"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in NGINX. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests when the `map` directive uses regular expression (regex) matching and references regex capture variables before referencing the map output variable. This can lead to a heap buffer overflow, which may allow for arbitrary code execution on systems where Address Space Layout Randomization (ASLR) is disabled or bypassed. Additionally, this flaw can cause a denial-of-service (DoS) due to the NGINX worker process restarting.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nginx: NGINX: Arbitrary code execution via crafted HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in NGINX allows a remote, unauthenticated attacker to trigger a heap buffer overflow, leading to a denial of service (Dos). This occurs when the `map` directive uses regex matching and references regex capture variables before the map output variable. While arbitrary code execution is a theoretical risk, it is significantly reduced on Red Hat systems where Address Space Layout Randomization (ASLR) is enabled by default.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.src",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-all-modules-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-filesystem-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42533"
},
{
"category": "external",
"summary": "RHBZ#2500967",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500967"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42533",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42533"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42533",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42533"
},
{
"category": "external",
"summary": "https://my.f5.com/manage/s/article/K000162097",
"url": "https://my.f5.com/manage/s/article/K000162097"
}
],
"release_date": "2026-07-15T14:33:45.810000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-02T03:38:56+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.src",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-all-modules-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-filesystem-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:93472"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.src",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-all-modules-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-filesystem-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.src",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-all-modules-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-filesystem-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "nginx: NGINX: Arbitrary code execution via crafted HTTP requests"
},
{
"cve": "CVE-2026-56434",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-07-15T15:01:11.109948+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500960"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability in NGINX\u0027s ngx_http_ssi_module allows an unauthenticated MITM attacker to trigger a heap buffer over-read by manipulating upstream server responses. This requires SSI, proxy_pass, and proxy_buffering off to be configured, and can result in memory modification or a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nginx: NGINX: Heap buffer over-read allows memory modification or denial of service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate severity vulnerability in NGINX affects configurations utilizing the `ngx_http_ssi_module` alongside `proxy_pass` and `proxy_buffering off`. Exploitation requires an unauthenticated man-in-the-middle attacker to control upstream server responses, leading to limited memory modification or a worker process restart. The specific combination of directives and an active MITM position limits the overall impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.src",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-all-modules-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-filesystem-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56434"
},
{
"category": "external",
"summary": "RHBZ#2500960",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500960"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56434",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56434"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56434",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56434"
},
{
"category": "external",
"summary": "https://my.f5.com/manage/s/article/K000162098",
"url": "https://my.f5.com/manage/s/article/K000162098"
}
],
"release_date": "2026-07-15T14:33:46.142000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-02T03:38:56+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.src",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-all-modules-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-filesystem-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:93472"
},
{
"category": "workaround",
"details": "To prevent exploitation, avoid configuring NGINX with `ngx_http_ssi_module` when `proxy_pass` and `proxy_buffering off` are simultaneously active. If Server-Side Includes (SSI) are not essential, disable the `ngx_http_ssi_module` by removing or commenting out the `ssi on;` directive. Alternatively, ensure `proxy_buffering` is explicitly enabled (`proxy_buffering on;`) when `proxy_pass` is used with SSI. A reload or restart of the NGINX service is necessary for configuration changes to apply, which may cause a brief service interruption.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.src",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-all-modules-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-filesystem-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.src",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-all-modules-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-filesystem-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nginx: NGINX: Heap buffer over-read allows memory modification or denial of service"
},
{
"cve": "CVE-2026-60005",
"cwe": {
"id": "CWE-824",
"name": "Access of Uninitialized Pointer"
},
"discovery_date": "2026-07-15T16:00:58.750113+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500992"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability in the NGINX ngx_http_slice_module allows remote, unauthenticated attackers to access uninitialized memory via crafted requests. If configured with unnamed regex captures or background cache updates, this flaw can result in limited memory disclosure or a denial-of-service crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This vulnerability in NGINX\u0027s `ngx_http_slice_module` could lead to memory disclosure or denial of service. The impact on Red Hat products is reduced because the `ngx_http_slice_module` is not enabled by default. Exploitation requires explicit configuration of the module with the `slice` directive and unnamed regex captures, or during a background cache update, limiting exposure in typical deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.src",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-all-modules-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-filesystem-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-60005"
},
{
"category": "external",
"summary": "RHBZ#2500992",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500992"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-60005",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-60005"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-60005",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60005"
},
{
"category": "external",
"summary": "https://my.f5.com/manage/s/article/K000162100",
"url": "https://my.f5.com/manage/s/article/K000162100"
}
],
"release_date": "2026-07-15T15:04:21.040000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-02T03:38:56+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.src",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-all-modules-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-filesystem-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:93472"
},
{
"category": "workaround",
"details": "To mitigate this issue, disable the ngx_http_slice_module entirely if it is not required.\nIf the module must be used, avoid unnamed regex captures with the slice directive and explicitly disable proxy_cache_background_update.\nReload or restart the NGINX service to apply these changes. Please note this may cause a brief service interruption.",
"product_ids": [
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.src",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-all-modules-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-filesystem-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.src",
"AppStream-9.2.0.Z.E4S:nginx-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-all-modules-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-core-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-debugsource-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-filesystem-1:1.20.1-14.el9_2.7.noarch",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-image-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-perl-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-http-xslt-filter-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-mail-debuginfo-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-1:1.20.1-14.el9_2.7.x86_64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.aarch64",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.ppc64le",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.s390x",
"AppStream-9.2.0.Z.E4S:nginx-mod-stream-debuginfo-1:1.20.1-14.el9_2.7.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.