RLSA-2026:98634: Important: nginx security update
nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.
Security Fix(es):
nginx: nginx: heap-based buffer overflow in ngxhttpcoremodule via alias with rewrite referencing $requestfilename (CVE-2026-15176)
nginx: NGINX ngxhttpcoremodule vulnerability (CVE-2026-97205)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/nginx-mod-http-perl-debuginfoto a version that resolves this vulnerability.Fixed in 2:1.26.3-16.el10_3.1 - Upgrade
Upgrade
rocky-linux/nginx-core-debuginfoto a version that resolves this vulnerability.Fixed in 2:1.26.3-16.el10_3.1 - Upgrade
Upgrade
rocky-linux/nginx-debugsourceto a version that resolves this vulnerability.Fixed in 2:1.26.3-16.el10_3.1 - Upgrade
Upgrade
rocky-linux/nginx-mod-http-perlto a version that resolves this vulnerability.Fixed in 2:1.26.3-16.el10_3.1 - Upgrade
Upgrade
rocky-linux/nginx-mod-http-image-filter-debuginfoto a version that resolves this vulnerability.Fixed in 2:1.26.3-16.el10_3.1 - Upgrade
Upgrade
rocky-linux/nginx-coreto a version that resolves this vulnerability.Fixed in 2:1.26.3-16.el10_3.1 - Upgrade
Upgrade
rocky-linux/nginx-mod-mailto a version that resolves this vulnerability.Fixed in 2:1.26.3-16.el10_3.1 - Upgrade
Upgrade
rocky-linux/nginx-mod-develto a version that resolves this vulnerability.Fixed in 2:1.26.3-16.el10_3.1 - Upgrade
Upgrade
rocky-linux/nginx-debuginfoto a version that resolves this vulnerability.Fixed in 2:1.26.3-16.el10_3.1 - Upgrade
Upgrade
rocky-linux/nginx-mod-stream-debuginfoto a version that resolves this vulnerability.Fixed in 2:1.26.3-16.el10_3.1 - Upgrade
Upgrade
rocky-linux/nginx-mod-http-image-filterto a version that resolves this vulnerability.Fixed in 2:1.26.3-16.el10_3.1 - Upgrade
Upgrade
rocky-linux/nginx-mod-http-xslt-filter-debuginfoto a version that resolves this vulnerability.Fixed in 2:1.26.3-16.el10_3.1 - Upgrade
Upgrade
rocky-linux/nginxto a version that resolves this vulnerability.Fixed in 2:1.26.3-16.el10_3.1 - Upgrade
Upgrade
rocky-linux/nginx-mod-http-xslt-filterto a version that resolves this vulnerability.Fixed in 2:1.26.3-16.el10_3.1 - Upgrade
Upgrade
rocky-linux/nginx-mod-streamto a version that resolves this vulnerability.Fixed in 2:1.26.3-16.el10_3.1 - Upgrade
Upgrade
rocky-linux/nginx-mod-mail-debuginfoto a version that resolves this vulnerability.Fixed in 2:1.26.3-16.el10_3.1 - Upgrade
Upgrade
rocky-linux/nginx-filesystemto a version that resolves this vulnerability.Fixed in 2:1.26.3-16.el10_3.1 - Upgrade
Upgrade
rocky-linux/nginx-all-modulesto a version that resolves this vulnerability.Fixed in 2:1.26.3-16.el10_3.1
Event History
Frequently Asked Questions
Which installed packages are identified as affected by this advisory?
The advisory lists nginx-core, nginx-mod-http-perl, nginx-mod-http-image-filter, nginx-mod-mail, nginx-mod-devel, and the associated nginx-core, nginx-mod-http-perl, and nginx-mod-http-image-filter debuginfo/debugsource packages.
What configuration condition is described for exploitation of CVE-2026-15176?
The issue is described as a heap-based buffer overflow in ngx_http_core_module involving an alias directive with a rewrite that references $request_filename. The advisory does not provide further exploitation prerequisites or configuration examples.
Does the advisory provide affected or fixed package versions, CVSS scores, or temporary mitigations?
No. It directs readers to the referenced CVE pages for impact, CVSS, acknowledgments, and related details, and does not state a workaround or fixed version.