RHSA-2026:6907: Important: nginx:1.24 security update
Published Apr 7, 2026
·Updated
Important: nginx:1.24 security update
Other sources
nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files (CVE-2026-32647) NGINX: NGINX: Denial of Service or file modification via buffer overflow in ngxhttpdavmodule (CVE-2026-27654) NGINX: NGINX: Denial of Service due to memory corruption via crafted MP4 file (CVE-2026-27784) NGINX: NGINX: Denial of Service via undisclosed requests when ngxmailauthhttpmodule is enabled (CVE-2026-27651) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
66 affected componentsFixes available
Red Hat Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle
Red Hat Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle
Red Hat Red Hat Enterprise Linux for x86_64
Red Hat Red Hat Enterprise Linux for ARM 64
Red Hat Red Hat Enterprise Linux for IBM z Systems
Red Hat Red Hat Enterprise Linux for Power, little endian
Red Hat Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle
Red Hat Red Hat Enterprise Linux for x86_64 - Extended Life Cycle
redhat/nginx<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-all-modules<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-filesystem<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-debuginfo<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-debugsource<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-devel<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-http-image-filter<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-http-image-filter-debuginfo<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-http-perl<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-http-perl-debuginfo<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-http-xslt-filter<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-http-xslt-filter-debuginfo<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-mail<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-mail-debuginfo<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-stream<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-stream-debuginfo<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-debuginfo<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-debugsource<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-devel<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-http-image-filter<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-http-image-filter-debuginfo<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-http-perl<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-http-perl-debuginfo<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-http-xslt-filter<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-http-xslt-filter-debuginfo<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-mail<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-mail-debuginfo<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-stream<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-stream-debuginfo<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-debuginfo<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-debugsource<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-devel<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-http-image-filter<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-http-image-filter-debuginfo<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-http-perl<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-http-perl-debuginfo<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-http-xslt-filter<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-http-xslt-filter-debuginfo<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-mail<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-mail-debuginfo<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-stream<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx-mod-stream-debuginfo<1.24.0-3.module+el8.10.0+24155+8a5ade52
1.24.0-3.module+el8.10.0+24155+8a5ade52
redhat/nginx<1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
redhat/nginx-debuginfo<1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
redhat/nginx-debugsource<1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
redhat/nginx-mod-devel<1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
redhat/nginx-mod-http-image-filter<1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
redhat/nginx-mod-http-image-filter-debuginfo<1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
redhat/nginx-mod-http-perl<1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
redhat/nginx-mod-http-perl-debuginfo<1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
redhat/nginx-mod-http-xslt-filter<1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
redhat/nginx-mod-http-xslt-filter-debuginfo<1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
redhat/nginx-mod-mail<1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
redhat/nginx-mod-mail-debuginfo<1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
redhat/nginx-mod-stream<1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
redhat/nginx-mod-stream-debuginfo<1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
1.24.0-3.module+el8.10.0+24155+8a5ade52.aa
Remediation
Event History
Apr 7, 2026
Advisory Published
via Red Hat·04:45 PM
Data Sourced
via Red Hat·04:45 PM
DescriptionSeverityAffected Software
Apr 10, 2026
Advisory Published
via Red Hat·07:08 PM
Data Sourced
via Red Hat·07:08 PM
Remedy
Frequently Asked Questions
1
What is the severity of RHSA-2026:6907?
The severity of RHSA-2026:6907 is high with a rating of 7.
2
What vulnerabilities does RHSA-2026:6907 address?
RHSA-2026:6907 addresses a denial of service or code execution vulnerability via specially crafted MP4 files, identified as CVE-2026-32647.
3
How do I fix RHSA-2026:6907?
To fix RHSA-2026:6907, apply the provided security update for nginx version 1.24 as recommended in the advisory.
4
Which software packages are affected by RHSA-2026:6907?
The affected software packages include redhat/nginx, redhat/nginx-debuginfo, and several nginx module packages.
5
What type of vulnerability is associated with RHSA-2026:6907?
RHSA-2026:6907 is associated with a buffer overflow vulnerability.