[CLSA-2026:1783633126] nginx: Fix of CVE-2026-49975
Type:
security
Severity:
Important
Release date:
2026-07-11 17:06:53 UTC
Description:
- CVE-2026-49975: add max_headers directive (default 1000) to cap HTTP/2 request-header memory exhaustion (HTTP/2 Bomb)
CVEs fixed:
Updated packages:
  • nginx-1.10.3-4.el6.tuxcare.els10.x86_64.rpm
    sha:6c9f912633d49d60d67a6a553b11ec982c76b33bcd3f724ec2b82bd95a958ee1
  • nginx-all-modules-1.10.3-4.el6.tuxcare.els10.noarch.rpm
    sha:7c70d73ddf9025d25a679692f16ae8b8204bfab0a3f2ae0aa6a0640e5f52904a
  • nginx-filesystem-1.10.3-4.el6.tuxcare.els10.noarch.rpm
    sha:d92dfa7fb63e0f18d36a41a5f872e88dba9f2ff474724db97474ec3b538b675d
  • nginx-mod-http-geoip-1.10.3-4.el6.tuxcare.els10.x86_64.rpm
    sha:e6f25a2edb98636737f3d6ffc7fd35d1a9dac35455f68d68385171955f192c3f
  • nginx-mod-http-image-filter-1.10.3-4.el6.tuxcare.els10.x86_64.rpm
    sha:d80bccd0a45a446e44251e282cd2c1dc7412283dd7eb094069d22d36ed055e9a
  • nginx-mod-http-perl-1.10.3-4.el6.tuxcare.els10.x86_64.rpm
    sha:e57b8c5c30a6bbb4276e94d2e3e485d0ec2fced466e9bfe46dc4e46a27000617
  • nginx-mod-http-xslt-filter-1.10.3-4.el6.tuxcare.els10.x86_64.rpm
    sha:fcaefe47b0576355cba662ac9a0998117825e585cca4dd189dda4eb00ae63b0b
  • nginx-mod-mail-1.10.3-4.el6.tuxcare.els10.x86_64.rpm
    sha:a639f807896d2a9769b7fff46b429fbae6951915acd111462d46ec2aabbb54c0
  • nginx-mod-stream-1.10.3-4.el6.tuxcare.els10.x86_64.rpm
    sha:7a8262921d033a467ca9c428c89c15c363c877ba7dec383b59c3792bd4d87558
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.