[CLSA-2026:1790073266] nginx: Fix of CVE-2026-42946
Type:
security
Severity:
Important
Release date:
2026-09-22 10:34:36 UTC
Description:
- CVE-2026-42946: reset the status-line parser state on fallback so scgi and uwsgi header parsing can't alias into a leftover FSM state and leak worker memory into response headers
CVEs fixed:
Updated packages:
  • nginx-1.14.1-9.module_el8.4.0+2576+932bbf14.tuxcare.els16.x86_64.rpm
    sha:fdf38e6c4c8f468a206530553d69479ac3ade03e64b98588696ce7eaaf802627
  • nginx-all-modules-1.14.1-9.module_el8.4.0+2576+932bbf14.tuxcare.els16.noarch.rpm
    sha:64b2b1b59c29d15b38b3bff8a2120b31390488674bb8337b52500ff20dc9ccaf
  • nginx-filesystem-1.14.1-9.module_el8.4.0+2576+932bbf14.tuxcare.els16.noarch.rpm
    sha:0024077e8043855cb4ec007233e9b8cc98441b644f0d55acbabf2a6b15bf57bb
  • nginx-mod-http-image-filter-1.14.1-9.module_el8.4.0+2576+932bbf14.tuxcare.els16.x86_64.rpm
    sha:382705fa1b014fd54e5190bcd4bbb8b89c54400729fe1a92a04ee9f76b31a4cd
  • nginx-mod-http-perl-1.14.1-9.module_el8.4.0+2576+932bbf14.tuxcare.els16.x86_64.rpm
    sha:34e493d8abcd966df95bfa8f1d9d6801c602403de5bb6112e855d28d8a29f040
  • nginx-mod-http-xslt-filter-1.14.1-9.module_el8.4.0+2576+932bbf14.tuxcare.els16.x86_64.rpm
    sha:4f98a94c88466c1c91a64abb3a8bb0fb384378ac3cc512fea4160e9d17f080ab
  • nginx-mod-mail-1.14.1-9.module_el8.4.0+2576+932bbf14.tuxcare.els16.x86_64.rpm
    sha:1e7f208b91b1b9e1a83fab44a4c1bcd18ff4da129b8ded3533dbe2772e30798d
  • nginx-mod-stream-1.14.1-9.module_el8.4.0+2576+932bbf14.tuxcare.els16.x86_64.rpm
    sha:00fb227d11822798b69beb16df25ac500e349cd2c0a83b0725e48e93beb68641
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.