[CLSA-2026:1792164686] nginx: Fix of CVE-2026-15176
Type:
security
Severity:
Critical
Release date:
2026-10-16 15:31:37 UTC
Description:
- CVE-2026-15176: reject "alias" URI to path mapping in ngx_http_map_uri_to_path() after a rewrite changed the URI and before a new location is selected, and invalidate the location after a standalone "break" following a rewrite, preventing a heap buffer overflow
CVEs fixed:
Updated packages:
  • nginx-1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17.i686.rpm
    sha:66cf8ccc8a2786c71e94b8f95f8902e64c679c5c24176d3ab2d40ca4ec2b7130
  • nginx-1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17.x86_64.rpm
    sha:850e98c9758d3c53d88480615932a9274b1e9d5ccb2199405119d56401544695
  • nginx-all-modules-1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17.noarch.rpm
    sha:7d1762d17053760165b4cd44c34275ea7246c318e186acd4ac3be5243196afca
  • nginx-filesystem-1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17.noarch.rpm
    sha:ba424d270e0e99f113e192f682a440f37d669d1f4a633870893cb37753f0ed4e
  • nginx-mod-http-image-filter-1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17.i686.rpm
    sha:d5633e73b0a07970fc133c06d350e4d3864f033490b1f60c4f514affaf8cb253
  • nginx-mod-http-image-filter-1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17.x86_64.rpm
    sha:8d163b428093ac8f3f6521cfecfa29b66087f6a3785bd4dfd6492289a590cda0
  • nginx-mod-http-perl-1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17.i686.rpm
    sha:c8774f3e134b071cedc7a8e1e8e90bf316772655f45a0d5c99cfa10617a3023e
  • nginx-mod-http-perl-1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17.x86_64.rpm
    sha:6cc7d784c3b97d1c26e3d250d5a05df306a570b7c4e5f3033ec83c2258080217
  • nginx-mod-http-xslt-filter-1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17.i686.rpm
    sha:a43925c675facb51403b168372d22d338cfe45f03dbf91db704ab1413b0732d8
  • nginx-mod-http-xslt-filter-1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17.x86_64.rpm
    sha:e3d56aa2e2ee2f797bc6053acd43768d3d416ecb36585106a933271b26d2b767
  • nginx-mod-mail-1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17.i686.rpm
    sha:1be2f89d34b5e45f7a73a272db1c913fea2c2bd01dd86d4b015a7331d3d2b3fd
  • nginx-mod-mail-1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17.x86_64.rpm
    sha:0ddd5a64d7ce893c430da61d3ac164beba7265ebb2692c8c8ea6493428bb70a2
  • nginx-mod-stream-1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17.i686.rpm
    sha:efdb77ad12b822fd80749637b4c244d671b8428e630c6f567a570a29207c1450
  • nginx-mod-stream-1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17.x86_64.rpm
    sha:ad757409fdfd4bbc4d7fe4428f15e5ed451c24025416e4560606aa56f44ccc7e
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.