Most recent entries from all

ALSA-2026:3638 — Moderate: nginx:1.24 security update

Affected: AlmaLinux:9: nginx, AlmaLinux:9: nginx-all-modules, AlmaLinux:9: nginx-core, AlmaLinux:9: nginx-filesystem, AlmaLinux:9: nginx-mod-devel, AlmaLinux:9: nginx-mod-http-image-filter, AlmaLinux:9: nginx-mod-http-perl, AlmaLinux:9: nginx-mod-http-xslt-filter, AlmaLinux:9: nginx-mod-mail, AlmaLinux:9: nginx-mod-stream

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.

Security Fix(es):

* nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-03559

BELL-CVE-2026-1642

Affected: Alpaquita:23: nginx, Alpaquita:25: nginx, Alpaquita:stream: nginx

BIT-nginx-2026-1642

Affected: Bitnami: nginx

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

certfr-2026-avi-0120 — De multiples vulnérabilités ont été découvertes dans les produits F5. Certaines d'entre elles permettent à un attaquant…

certfr-2026-avi-0120

EUVD-2026-267413

fkie_cve-2026-1642

GHSA-7chh-rv6q-8pp3

OESA-2026-1572 — nginx security update

Affected: openEuler:20.03-LTS-SP4: nginx, openEuler:22.03-LTS-SP4: nginx, openEuler:24.03-LTS: nginx, openEuler:24.03-LTS-SP1: nginx, openEuler:24.03-LTS-SP2: nginx, openEuler:24.03-LTS-SP3: nginx

NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server. Security Fix(es):

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. The vulnerability is classified as CWE-349: The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted. This vulnerability primarily affects data integrity.(CVE-2026-1642)

openSUSE-SU-2026:10158-1 — nginx-1.29.5-1.1 on GA media

nginx-1.29.5-1.1 on GA media

RHSA-2026:10065 — Red Hat Security Advisory: Red Hat Update Infrastructure 5.1 security update

libxslt: Processing web content may disclose sensitive information nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing python: Python: Command-line option injection in webbrowser.open() via crafted URLs libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing net/url: Incorrect parsing of IPv6 host literals in net/url vim: Vim: Arbitrary code execution via 'helpfile' option processing nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination NGINX: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled NGINX: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module NGINX: NGINX: Denial of Service due to memory corruption via crafted MP4 file vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin vim: Vim: Denial of service and information disclosure via crafted swap file nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files vim: Vim: Arbitrary code execution via command injection in glob() function

SUSE-SU-2026:21823-1 — Security update for nginx

Security update for nginx

UBUNTU-CVE-2026-1642

Affected: Ubuntu:Pro:14.04:LTS: nginx, Ubuntu:Pro:16.04:LTS: nginx, Ubuntu:Pro:18.04:LTS: nginx, Ubuntu:Pro:20.04:LTS: nginx, Ubuntu:22.04:LTS: nginx, Ubuntu:24.04:LTS: nginx, Ubuntu:25.10: nginx, Ubuntu:26.04:LTS: nginx

WID-SEC-W-2026-0309 — NGINX OSS und NGINX Plus: Schwachstelle ermöglicht Manipulation von Dateien

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in NGINX und NGINX Plus ausnutzen, um Dateien zu manipulieren.