Release date:
2026-10-19 16:12:09 UTC
Description:
* SECURITY UPDATE: heap buffer overflow via alias with rewrite and $request_filename
- debian/patches/CVE-2026-15176-pre.patch: clear r->valid_location on
a standalone "break" after the URI was rewritten
- debian/patches/CVE-2026-15176.patch: reject URI to path mapping in
ngx_http_map_uri_to_path() for an "alias" location once rewrite has
changed the URI
- CVE-2026-15176
Updated packages:
-
nginx_1.10.3-0ubuntu0.16.04.8+tuxcare.els12_all.deb
sha:7c2f5480d625606c971986663bc925ab0418df1c
-
nginx-common_1.10.3-0ubuntu0.16.04.8+tuxcare.els12_all.deb
sha:a4a6fb72bb80e36b1f97cd763dadc4aa66129330
-
nginx-core_1.10.3-0ubuntu0.16.04.8+tuxcare.els12_amd64.deb
sha:24882c33e9c550a913f0d5945a343c9a10a86f53
-
nginx-doc_1.10.3-0ubuntu0.16.04.8+tuxcare.els12_all.deb
sha:4e1f91aeafb6b66c67ebf1d93cfe9195ba5767c4
-
nginx-extras_1.10.3-0ubuntu0.16.04.8+tuxcare.els12_amd64.deb
sha:30f99abd70c356c1400ba3f2f3184e485679d0ee
-
nginx-full_1.10.3-0ubuntu0.16.04.8+tuxcare.els12_amd64.deb
sha:b844c3debe0f2505e6abac3c84a249094c4987ea
-
nginx-light_1.10.3-0ubuntu0.16.04.8+tuxcare.els12_amd64.deb
sha:3dabce5c5dd5e0427197cc1e085e97b8500f504a
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
