RLSA-2026:98529: Important: nginx security update

Q: Which nginx deployments are most likely to be exposed to the listed issues?

Exposure depends on enabled nginx functionality. The advisory specifically identifies ngx_http_dav_module, MP4-file handling, ngx_mail_auth_http_module, and configurations using alias with rewrite that references $request_filename; deployments using those features should be prioritized.

Q: Does exploitation require an authenticated user or user interaction?

No. The supplied severity vector identifies network attack access, low attack complexity, no privileges required, and no user interaction.

Q: What impacts are identified by the advisory?

The listed issues include denial of service, file modification, memory corruption, and heap-based buffer overflow. The supplied vector indicates high availability impact, low integrity impact, and no confidentiality impact.

Q: How can I determine whether this advisory applies to a Rocky Linux system?

Check whether the system has any of the listed packages installed: rocky-linux/nginx, nginx-core, or the listed nginx debug, development, and image-filter module packages. Then review nginx configuration and enabled modules for DAV, MP4 handling, mail auth HTTP, or alias/rewrite usage involving $request_filename.

Published Nov 13, 2026

Updated

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

NGINX: NGINX: Denial of Service or file modification via buffer overflow in ngxhttpdavmodule (CVE-2026-27654)

NGINX: NGINX: Denial of Service due to memory corruption via crafted MP4 file (CVE-2026-27784)

NGINX: NGINX: Denial of Service via undisclosed requests when ngxmailauthhttpmodule is enabled (CVE-2026-27651)

nginx: nginx: heap-based buffer overflow in ngxhttpcoremodule via alias with rewrite referencing $requestfilename (CVE-2026-15176)

nginx: NGINX ngxhttpcoremodule vulnerability (CVE-2026-97205)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

18 affected componentsFixes available

rocky-linux/nginx<2:1.20.1-32.el9_9.1.rocky.0.1

2:1.20.1-32.el9_9.1.rocky.0.1

rocky-linux/nginx-core<2:1.20.1-32.el9_9.1.rocky.0.1

2:1.20.1-32.el9_9.1.rocky.0.1

rocky-linux/nginx-core-debuginfo<2:1.20.1-32.el9_9.1.rocky.0.1

2:1.20.1-32.el9_9.1.rocky.0.1

rocky-linux/nginx-debuginfo<2:1.20.1-32.el9_9.1.rocky.0.1

2:1.20.1-32.el9_9.1.rocky.0.1

rocky-linux/nginx-debugsource<2:1.20.1-32.el9_9.1.rocky.0.1

2:1.20.1-32.el9_9.1.rocky.0.1

rocky-linux/nginx-mod-devel<2:1.20.1-32.el9_9.1.rocky.0.1

2:1.20.1-32.el9_9.1.rocky.0.1

rocky-linux/nginx-mod-http-image-filter<2:1.20.1-32.el9_9.1.rocky.0.1

2:1.20.1-32.el9_9.1.rocky.0.1

rocky-linux/nginx-mod-http-image-filter-debuginfo<2:1.20.1-32.el9_9.1.rocky.0.1

2:1.20.1-32.el9_9.1.rocky.0.1

rocky-linux/nginx-mod-http-perl<2:1.20.1-32.el9_9.1.rocky.0.1

2:1.20.1-32.el9_9.1.rocky.0.1

rocky-linux/nginx-mod-http-perl-debuginfo<2:1.20.1-32.el9_9.1.rocky.0.1

2:1.20.1-32.el9_9.1.rocky.0.1

rocky-linux/nginx-mod-http-xslt-filter<2:1.20.1-32.el9_9.1.rocky.0.1

2:1.20.1-32.el9_9.1.rocky.0.1

rocky-linux/nginx-mod-http-xslt-filter-debuginfo<2:1.20.1-32.el9_9.1.rocky.0.1

2:1.20.1-32.el9_9.1.rocky.0.1

rocky-linux/nginx-mod-mail<2:1.20.1-32.el9_9.1.rocky.0.1

2:1.20.1-32.el9_9.1.rocky.0.1

rocky-linux/nginx-mod-mail-debuginfo<2:1.20.1-32.el9_9.1.rocky.0.1

2:1.20.1-32.el9_9.1.rocky.0.1

rocky-linux/nginx-mod-stream<2:1.20.1-32.el9_9.1.rocky.0.1

2:1.20.1-32.el9_9.1.rocky.0.1

rocky-linux/nginx-mod-stream-debuginfo<2:1.20.1-32.el9_9.1.rocky.0.1

2:1.20.1-32.el9_9.1.rocky.0.1

rocky-linux/nginx-all-modules<2:1.20.1-32.el9_9.1.rocky.0.1

2:1.20.1-32.el9_9.1.rocky.0.1

rocky-linux/nginx-filesystem<2:1.20.1-32.el9_9.1.rocky.0.1

2:1.20.1-32.el9_9.1.rocky.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rocky-linux/nginx to a version that resolves this vulnerability.
Fixed in 2:1.20.1-32.el9_9.1.rocky.0.1
Upgrade
Upgrade rocky-linux/nginx-core to a version that resolves this vulnerability.
Fixed in 2:1.20.1-32.el9_9.1.rocky.0.1
Upgrade
Upgrade rocky-linux/nginx-core-debuginfo to a version that resolves this vulnerability.
Fixed in 2:1.20.1-32.el9_9.1.rocky.0.1
Upgrade
Upgrade rocky-linux/nginx-debuginfo to a version that resolves this vulnerability.
Fixed in 2:1.20.1-32.el9_9.1.rocky.0.1
Upgrade
Upgrade rocky-linux/nginx-debugsource to a version that resolves this vulnerability.
Fixed in 2:1.20.1-32.el9_9.1.rocky.0.1
Upgrade
Upgrade rocky-linux/nginx-mod-devel to a version that resolves this vulnerability.
Fixed in 2:1.20.1-32.el9_9.1.rocky.0.1
Upgrade
Upgrade rocky-linux/nginx-mod-http-image-filter to a version that resolves this vulnerability.
Fixed in 2:1.20.1-32.el9_9.1.rocky.0.1
Upgrade
Upgrade rocky-linux/nginx-mod-http-image-filter-debuginfo to a version that resolves this vulnerability.
Fixed in 2:1.20.1-32.el9_9.1.rocky.0.1
Upgrade
Upgrade rocky-linux/nginx-mod-http-perl to a version that resolves this vulnerability.
Fixed in 2:1.20.1-32.el9_9.1.rocky.0.1
Upgrade
Upgrade rocky-linux/nginx-mod-http-perl-debuginfo to a version that resolves this vulnerability.
Fixed in 2:1.20.1-32.el9_9.1.rocky.0.1
Upgrade
Upgrade rocky-linux/nginx-mod-http-xslt-filter to a version that resolves this vulnerability.
Fixed in 2:1.20.1-32.el9_9.1.rocky.0.1
Upgrade
Upgrade rocky-linux/nginx-mod-http-xslt-filter-debuginfo to a version that resolves this vulnerability.
Fixed in 2:1.20.1-32.el9_9.1.rocky.0.1
Upgrade
Upgrade rocky-linux/nginx-mod-mail to a version that resolves this vulnerability.
Fixed in 2:1.20.1-32.el9_9.1.rocky.0.1
Upgrade
Upgrade rocky-linux/nginx-mod-mail-debuginfo to a version that resolves this vulnerability.
Fixed in 2:1.20.1-32.el9_9.1.rocky.0.1
Upgrade
Upgrade rocky-linux/nginx-mod-stream to a version that resolves this vulnerability.
Fixed in 2:1.20.1-32.el9_9.1.rocky.0.1
Upgrade
Upgrade rocky-linux/nginx-mod-stream-debuginfo to a version that resolves this vulnerability.
Fixed in 2:1.20.1-32.el9_9.1.rocky.0.1
Upgrade
Upgrade rocky-linux/nginx-all-modules to a version that resolves this vulnerability.
Fixed in 2:1.20.1-32.el9_9.1.rocky.0.1
Upgrade
Upgrade rocky-linux/nginx-filesystem to a version that resolves this vulnerability.
Fixed in 2:1.20.1-32.el9_9.1.rocky.0.1

Event History

Nov 13, 2026

Advisory Published

via OSV·12:04 PM

Data Sourced

via OSV·12:04 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which nginx deployments are most likely to be exposed to the listed issues?

Exposure depends on enabled nginx functionality. The advisory specifically identifies ngx_http_dav_module, MP4-file handling, ngx_mail_auth_http_module, and configurations using alias with rewrite that references $request_filename; deployments using those features should be prioritized.

Does exploitation require an authenticated user or user interaction?

No. The supplied severity vector identifies network attack access, low attack complexity, no privileges required, and no user interaction.

What impacts are identified by the advisory?

The listed issues include denial of service, file modification, memory corruption, and heap-based buffer overflow. The supplied vector indicates high availability impact, low integrity impact, and no confidentiality impact.

How can I determine whether this advisory applies to a Rocky Linux system?

Check whether the system has any of the listed packages installed: rocky-linux/nginx, nginx-core, or the listed nginx debug, development, and image-filter module packages. Then review nginx configuration and enabled modules for DAV, MP4 handling, mail auth HTTP, or alias/rewrite usage involving $request_filename.

RLSA-2026:98529: Important: nginx security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which nginx deployments are most likely to be exposed to the listed issues?

Does exploitation require an authenticated user or user interaction?

What impacts are identified by the advisory?

How can I determine whether this advisory applies to a Rocky Linux system?

Company

Resources

Contact

Frequently Asked Questions

Which nginx deployments are most likely to be exposed to the listed issues?

Does exploitation require an authenticated user or user interaction?

What impacts are identified by the advisory?

How can I determine whether this advisory applies to a Rocky Linux system?