[CLSA-2026:1790072773] nginx: Fix of CVE-2026-42946
Type:
security
Severity:
Important
Release date:
2026-09-22 10:26:22 UTC
Description:
- CVE-2026-42946: reset the status-line parser state on fallback so scgi and uwsgi header parsing can't alias into a leftover FSM state and leak worker memory into response headers
CVEs fixed:
Updated packages:
  • nginx-1.14.1-9.module_el8.5.0+2577+7d56c248.tuxcare.els16.x86_64.rpm
    sha:b6ee203edccc4d4b2448ff381254b8aee496100e82d43a0b8f6ceea149da533c
  • nginx-all-modules-1.14.1-9.module_el8.5.0+2577+7d56c248.tuxcare.els16.noarch.rpm
    sha:2d12aa177a10bfa7be4196dda7ac225fbfdf025c902a3f5c20a08bd76c3c58f9
  • nginx-filesystem-1.14.1-9.module_el8.5.0+2577+7d56c248.tuxcare.els16.noarch.rpm
    sha:9afccb723396810c773a47eb82e693924a460a43753ff60697d6e7eddade5d87
  • nginx-mod-http-image-filter-1.14.1-9.module_el8.5.0+2577+7d56c248.tuxcare.els16.x86_64.rpm
    sha:6807a5bf4acd5e3d0a3c72e1bebe44d148f02704cafed4e59479f3e902168392
  • nginx-mod-http-perl-1.14.1-9.module_el8.5.0+2577+7d56c248.tuxcare.els16.x86_64.rpm
    sha:ef48ba003b5f2321cb78ae67f20e812d3d068a309fc428e0d4759ee6d20fab1f
  • nginx-mod-http-xslt-filter-1.14.1-9.module_el8.5.0+2577+7d56c248.tuxcare.els16.x86_64.rpm
    sha:315a9018d6bd5308661a702c6bf2d6403abf80ffec0da3aa8d54beab4e4c9c59
  • nginx-mod-mail-1.14.1-9.module_el8.5.0+2577+7d56c248.tuxcare.els16.x86_64.rpm
    sha:7a261ee03f992a7b3235eda127d3e46395020c7e6855306ce38ec6258364ed87
  • nginx-mod-stream-1.14.1-9.module_el8.5.0+2577+7d56c248.tuxcare.els16.x86_64.rpm
    sha:24fe5a824b76ccee53325ec99f7f3db2e0c7d47172eb5b65e24adf30a1651c80
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.