[CLSA-2026:1790152715] Fix CVE(s): CVE-2026-42055
Type:
security
Severity:
Critical
Release date:
2026-09-23 08:38:47 UTC
Description:
* SECURITY UPDATE: heap buffer overflow via oversized HTTP/2 and gRPC upstream request headers - debian/patches/CVE-2026-42055.patch: reject header fields longer than NGX_HTTP_V2_MAX_FIELD in ngx_http_grpc_create_request() before the upstream request buffer length is computed, and in ngx_http_v2_header_filter() for the Content-Type and Location response header values - CVE-2026-42055
CVEs fixed:
Updated packages:
  • libnginx-mod-http-auth-pam_1.14.0-0ubuntu1.11+tuxcare.els8_amd64.deb
    sha:f4e618a376be5cf34c3856f3a70ca6f8c8979d99
  • libnginx-mod-http-cache-purge_1.14.0-0ubuntu1.11+tuxcare.els8_amd64.deb
    sha:e42c875d7df137482b3780740d1bd49487c3414a
  • libnginx-mod-http-dav-ext_1.14.0-0ubuntu1.11+tuxcare.els8_amd64.deb
    sha:63c82721c08ac578f0ca3dbc3a23b1390f462176
  • libnginx-mod-http-echo_1.14.0-0ubuntu1.11+tuxcare.els8_amd64.deb
    sha:27a76015119a0565c3332904618d077372913f22
  • libnginx-mod-http-fancyindex_1.14.0-0ubuntu1.11+tuxcare.els8_amd64.deb
    sha:03f2743222568fcbad15e0907d7ed1da90908af3
  • libnginx-mod-http-geoip_1.14.0-0ubuntu1.11+tuxcare.els8_amd64.deb
    sha:8f9e926815ad6c4ed78bfcf1735f326219d58150
  • libnginx-mod-http-headers-more-filter_1.14.0-0ubuntu1.11+tuxcare.els8_amd64.deb
    sha:63387cebd3051d95888dc10a425434cd456091d6
  • libnginx-mod-http-image-filter_1.14.0-0ubuntu1.11+tuxcare.els8_amd64.deb
    sha:d876a3744e67d2631a316eb19de02130fd4e47ac
  • libnginx-mod-http-lua_1.14.0-0ubuntu1.11+tuxcare.els8_amd64.deb
    sha:61961577cd8744a5869f33fe76f51b1ade9abd86
  • libnginx-mod-http-ndk_1.14.0-0ubuntu1.11+tuxcare.els8_amd64.deb
    sha:dfe40475327e9789d17a696dc238a2c14b821f97
  • libnginx-mod-http-perl_1.14.0-0ubuntu1.11+tuxcare.els8_amd64.deb
    sha:174e4baadd69f909f99761c7e1016dd681e6ca12
  • libnginx-mod-http-subs-filter_1.14.0-0ubuntu1.11+tuxcare.els8_amd64.deb
    sha:41d89b74031da094e5a899737e3868251f208b87
  • libnginx-mod-http-uploadprogress_1.14.0-0ubuntu1.11+tuxcare.els8_amd64.deb
    sha:f8cda3bdfc4fafe92de10e97ea3f32e36656f301
  • libnginx-mod-http-upstream-fair_1.14.0-0ubuntu1.11+tuxcare.els8_amd64.deb
    sha:6b043ffbb7bac752c1375cc47028f14179c30b8d
  • libnginx-mod-http-xslt-filter_1.14.0-0ubuntu1.11+tuxcare.els8_amd64.deb
    sha:36ac64ba02c195c0248815050318e436b1acf02b
  • libnginx-mod-mail_1.14.0-0ubuntu1.11+tuxcare.els8_amd64.deb
    sha:cd21705ecb28fcd109f40e448b86296837b30f73
  • libnginx-mod-nchan_1.14.0-0ubuntu1.11+tuxcare.els8_amd64.deb
    sha:b921b0e0f331a0c6092779c317cb01b13d29128c
  • libnginx-mod-rtmp_1.14.0-0ubuntu1.11+tuxcare.els8_amd64.deb
    sha:2bb1f6b5f5656cb9f64ff7c4cf10001c2ac69f55
  • libnginx-mod-stream_1.14.0-0ubuntu1.11+tuxcare.els8_amd64.deb
    sha:375b40bd80f1c84025d9814e1a2118053a25ae5f
  • nginx_1.14.0-0ubuntu1.11+tuxcare.els8_all.deb
    sha:4b11a1c39ba78d1adc0526131ba64a2dd059254f
  • nginx-common_1.14.0-0ubuntu1.11+tuxcare.els8_all.deb
    sha:8ad79ca67f900e108960bd9d9109bc240268cccb
  • nginx-core_1.14.0-0ubuntu1.11+tuxcare.els8_amd64.deb
    sha:253622c86f8e8387670e157c0a8299b82b39f72a
  • nginx-doc_1.14.0-0ubuntu1.11+tuxcare.els8_all.deb
    sha:8773dea591a7754a388b93fdfce03193a694ac52
  • nginx-extras_1.14.0-0ubuntu1.11+tuxcare.els8_amd64.deb
    sha:00a970e2f88de26fa479a064ec04c7208416bfac
  • nginx-full_1.14.0-0ubuntu1.11+tuxcare.els8_amd64.deb
    sha:fcf3cb312d5b2339648316b2592381945c85dcb0
  • nginx-light_1.14.0-0ubuntu1.11+tuxcare.els8_amd64.deb
    sha:062e0ef3794e46df8edcfee312f1c602887ebb3b
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.