[CLSA-2026:1792170794] nginx: Fix of CVE-2026-15176
Type:
security
Severity:
Critical
Release date:
2026-10-16 17:13:24 UTC
Description:
- CVE-2026-15176: fix heap buffer overflow in ngx_http_map_uri_to_path() when a location using "alias" maps a URI changed by "rewrite" before a new location is selected; reject the mapping while r->uri_changed is set
CVEs fixed:
Updated packages:
  • nginx-1.20.1-14.el9_2.1.alma.1.tuxcare.els15.aarch64.rpm
    sha:e7476ffd8ae4938faa89bb7004f815321439711068d07fc71355588aa9910640
  • nginx-1.20.1-14.el9_2.1.alma.1.tuxcare.els15.i686.rpm
    sha:6960c68d469275a155f71e889a49c34f94bb5ca5842a7296da29cd76d9501931
  • nginx-1.20.1-14.el9_2.1.alma.1.tuxcare.els15.x86_64.rpm
    sha:67986e04b991daaf9eacd1f1e6abd050a6af5e06dea72a26b902f7901e60afc2
  • nginx-all-modules-1.20.1-14.el9_2.1.alma.1.tuxcare.els15.noarch.rpm
    sha:5efbc750fff42b7b5034d79d71c453c3db80e3a97628e52f4a68250f81625b27
  • nginx-core-1.20.1-14.el9_2.1.alma.1.tuxcare.els15.aarch64.rpm
    sha:3356ff48904a87bdac99b86096f96b5e018a36342c46925f6ae55cd01224f641
  • nginx-core-1.20.1-14.el9_2.1.alma.1.tuxcare.els15.i686.rpm
    sha:db0b7a189b15efe19707f87da28387546a17ae61fbb8daa755cdf521f140f6a1
  • nginx-core-1.20.1-14.el9_2.1.alma.1.tuxcare.els15.x86_64.rpm
    sha:68d110544f24ff01a58aa1ad6c1bf36e55d412c61132d278d32a5d0c8f133a7f
  • nginx-filesystem-1.20.1-14.el9_2.1.alma.1.tuxcare.els15.noarch.rpm
    sha:ce05885b88ef515018e734bb7f7508f8d528b90e8e39a48de217d495e7b62360
  • nginx-mod-devel-1.20.1-14.el9_2.1.alma.1.tuxcare.els15.aarch64.rpm
    sha:c5cb631d340f1c268acbe3f8124e9b9245aee42953d9fcdbeb31e73fbf6d08cb
  • nginx-mod-devel-1.20.1-14.el9_2.1.alma.1.tuxcare.els15.i686.rpm
    sha:67e3a1efc1dde2c66fdcc6cab4066e6767314809f86746ffaf18e2220fabc46e
  • nginx-mod-devel-1.20.1-14.el9_2.1.alma.1.tuxcare.els15.x86_64.rpm
    sha:c9abaed488f9944ca93b3d8bebb1d227eb70d63dd5bc7e597845cf5aa1656a4a
  • nginx-mod-http-image-filter-1.20.1-14.el9_2.1.alma.1.tuxcare.els15.aarch64.rpm
    sha:ebe28fac6586adef1744e75027b4e87ec259ca4354dca83f5e331817c94ec1c9
  • nginx-mod-http-image-filter-1.20.1-14.el9_2.1.alma.1.tuxcare.els15.i686.rpm
    sha:fad1600850c0d9284d9c9f76f18b75567905f42f317e0670175f0b8f4f160f14
  • nginx-mod-http-image-filter-1.20.1-14.el9_2.1.alma.1.tuxcare.els15.x86_64.rpm
    sha:c13391100357d3374e443bec0a0c4c9423da7c47fbf5772975a8c6474aa81046
  • nginx-mod-http-perl-1.20.1-14.el9_2.1.alma.1.tuxcare.els15.aarch64.rpm
    sha:b5e25188063e218ae4740a4c7e2544d6d18032c643fec932b8e637d92d296468
  • nginx-mod-http-perl-1.20.1-14.el9_2.1.alma.1.tuxcare.els15.i686.rpm
    sha:56d9dd34244624af68e3832a6f3bf629722d67534cbfd7e6d0e0d690dc3cb723
  • nginx-mod-http-perl-1.20.1-14.el9_2.1.alma.1.tuxcare.els15.x86_64.rpm
    sha:64e0e4baff36b0b2cb20cfd7b7d934678c0db37ec368396c1eeb520d66b2ac8d
  • nginx-mod-http-xslt-filter-1.20.1-14.el9_2.1.alma.1.tuxcare.els15.aarch64.rpm
    sha:41239b05b8145bdc0c95eee0e147d13ea02d2fc3f2026a1e90f88409a6f4ed44
  • nginx-mod-http-xslt-filter-1.20.1-14.el9_2.1.alma.1.tuxcare.els15.i686.rpm
    sha:648514a190c147dce4935a4946292c6b20f557ad42218f13eed181828c726935
  • nginx-mod-http-xslt-filter-1.20.1-14.el9_2.1.alma.1.tuxcare.els15.x86_64.rpm
    sha:a728b59d7be4d842a0b55614a129ed974a91bfb567d742b9777628ecb8fe449d
  • nginx-mod-mail-1.20.1-14.el9_2.1.alma.1.tuxcare.els15.aarch64.rpm
    sha:6f8eaa7cb102468e5a59018452c6abc80c8e6b8bca794e5c760fc73575c420e7
  • nginx-mod-mail-1.20.1-14.el9_2.1.alma.1.tuxcare.els15.i686.rpm
    sha:9c9361e101610a76824a94f64a578c284d86bee0b9cbac4ebab80d3011935ef3
  • nginx-mod-mail-1.20.1-14.el9_2.1.alma.1.tuxcare.els15.x86_64.rpm
    sha:322cb35a0ea8a113e501e3f7a7d1e862e38b93c6fd341cb1fdfbbc935d3ad6d6
  • nginx-mod-stream-1.20.1-14.el9_2.1.alma.1.tuxcare.els15.aarch64.rpm
    sha:2a8acac75d7034823ad654dafa634660cbd4f31cacef4c880c59876b04b0912e
  • nginx-mod-stream-1.20.1-14.el9_2.1.alma.1.tuxcare.els15.i686.rpm
    sha:790029434d3466e7cd58c8caf91fdf0e3ea69cf6ae7933945bdbd799a49a5667
  • nginx-mod-stream-1.20.1-14.el9_2.1.alma.1.tuxcare.els15.x86_64.rpm
    sha:ad458c3c0d9ac8da93c5a1a4174b4e9cce607dc6e15d1fb31a060ccfa4b325cb
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.