[CLSA-2026:1792165116] nginx: Fix of CVE-2026-15176
Type:
security
Severity:
Critical
Release date:
2026-10-16 16:56:01 UTC
Description:
- CVE-2026-15176: reject "alias" URI to path mapping in ngx_http_map_uri_to_path() after a rewrite changed the URI and before a new location is selected, and invalidate the location after a standalone "break" following a rewrite, preventing a heap buffer overflow
CVEs fixed:
Updated packages:
  • nginx-1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17.i686.rpm
    sha:24f845e6a637acb07e19055d81343f689ce3431f9b573e62f8ee59a53902392f
  • nginx-1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17.x86_64.rpm
    sha:16f67f0e504a779ccede6a1024c25ec61d96d20ea01f0344de289878a1eb61a9
  • nginx-all-modules-1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17.noarch.rpm
    sha:59a8dcc251a71ee5ff4ffac76cbe279060d2f471d93f781b582bdcdd20325a57
  • nginx-filesystem-1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17.noarch.rpm
    sha:896d7127acffce329b47361481a4ca82ea60ff28b16c81d2a78448894ad855dc
  • nginx-mod-http-image-filter-1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17.i686.rpm
    sha:f73c0b45a6b03d3a935a3208806311eea66ecc8d830b790c8e342e95e935bb74
  • nginx-mod-http-image-filter-1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17.x86_64.rpm
    sha:54834bb33c5cbb790d8323bcc23daa6f7928fd9650e25ebe8cd87ba3a2410b6a
  • nginx-mod-http-perl-1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17.i686.rpm
    sha:2dd409ad75fce660e9fc6e3911b9cc1779c693388792c95b1cc42f750e629b31
  • nginx-mod-http-perl-1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17.x86_64.rpm
    sha:1c59504994a3a658677c06496f701a24a426289b66f84c3334dca0141cfcca49
  • nginx-mod-http-xslt-filter-1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17.i686.rpm
    sha:327f9f4be3c389e32df2e0049020011ba42b1d386721ff4600508833cd8779ef
  • nginx-mod-http-xslt-filter-1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17.x86_64.rpm
    sha:9b5fbc5741ee3bba7350c4408dd99e9faa5998c5776e2dc2aa199503e7dbe4de
  • nginx-mod-mail-1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17.i686.rpm
    sha:49fc7febe141a3a25df876273d8fbc255d71bc5903e3d130f7effa06d0922ef5
  • nginx-mod-mail-1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17.x86_64.rpm
    sha:1f450321a9afbbceda8b819d9bb93991512b0c1a9a8c8a841330938b9355246a
  • nginx-mod-stream-1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17.i686.rpm
    sha:cf9645299b87cb14e66d18edd95fa80fc825f71996079f90ce1779ac5ba52ce0
  • nginx-mod-stream-1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17.x86_64.rpm
    sha:3d1f4711a376cc2fe819d343edf7b7115fa5c90bd4719ceb94ee9a15b2b0f0ef
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.