Release date:
2026-10-23 23:35:05 UTC
Description:
* SECURITY UPDATE: heap buffer overflow via post-rewrite URI to path
mapping with alias
- debian/patches/CVE-2026-15176.patch: in ngx_http_map_uri_to_path(),
reject the mapping for a location using "alias" when r->uri_changed is
set, so a rewritten URI shorter than the location prefix is no longer
mapped to a path (e.g. via $request_filename)
- debian/patches/CVE-2026-15176-2.patch: in ngx_http_script_break_code(),
clear r->valid_location when the URI was changed, so the alias check
also rejects the mapping after a standalone "break"
- CVE-2026-15176
Updated packages:
-
libnginx-mod-http-auth-pam_1.14.0-0ubuntu1.11+tuxcare.els10_amd64.deb
sha:670f4187240a89fc92913a27da895057fec6022d
-
libnginx-mod-http-cache-purge_1.14.0-0ubuntu1.11+tuxcare.els10_amd64.deb
sha:91a0f52bf9f08e2f3afab43daec1ce8d859ab068
-
libnginx-mod-http-dav-ext_1.14.0-0ubuntu1.11+tuxcare.els10_amd64.deb
sha:c7cf4183f98d312225eb9c9b6abc3ca399d3ae46
-
libnginx-mod-http-echo_1.14.0-0ubuntu1.11+tuxcare.els10_amd64.deb
sha:3fbe6489cc15a733850ccc9fe55d1a0de2c26ea5
-
libnginx-mod-http-fancyindex_1.14.0-0ubuntu1.11+tuxcare.els10_amd64.deb
sha:3eccfd7e31469ee79b8cdccb71cbfb87fe644740
-
libnginx-mod-http-geoip_1.14.0-0ubuntu1.11+tuxcare.els10_amd64.deb
sha:f40c0958c40bffe265638786d037af2210dd7085
-
libnginx-mod-http-headers-more-filter_1.14.0-0ubuntu1.11+tuxcare.els10_amd64.deb
sha:01cf81f8d5c16f5baf29adc590d63d371f27e63a
-
libnginx-mod-http-image-filter_1.14.0-0ubuntu1.11+tuxcare.els10_amd64.deb
sha:496c569a2a67a326cd0eced3383d38fab5b35bdc
-
libnginx-mod-http-lua_1.14.0-0ubuntu1.11+tuxcare.els10_amd64.deb
sha:e339d216b77199ad43041b5615f12a7b85bf14c5
-
libnginx-mod-http-ndk_1.14.0-0ubuntu1.11+tuxcare.els10_amd64.deb
sha:f64b33812b5c39c51f1216e178a2e916322a922b
-
libnginx-mod-http-perl_1.14.0-0ubuntu1.11+tuxcare.els10_amd64.deb
sha:cc3fe35c6da64666136283a9e94bd660cc7ab1e8
-
libnginx-mod-http-subs-filter_1.14.0-0ubuntu1.11+tuxcare.els10_amd64.deb
sha:b39d25d65ef2d292f347f250878084f35e6bf552
-
libnginx-mod-http-uploadprogress_1.14.0-0ubuntu1.11+tuxcare.els10_amd64.deb
sha:e8ed146f30ad56489a4ec597c267ce830b9ae963
-
libnginx-mod-http-upstream-fair_1.14.0-0ubuntu1.11+tuxcare.els10_amd64.deb
sha:e5526cc43ce75823258bfe8ebed74e32533ed6d8
-
libnginx-mod-http-xslt-filter_1.14.0-0ubuntu1.11+tuxcare.els10_amd64.deb
sha:544edae6fb81dfeed336698272c011fc08930b49
-
libnginx-mod-mail_1.14.0-0ubuntu1.11+tuxcare.els10_amd64.deb
sha:b3eda163c36291d1183ef8e7babb7ec2b62053a6
-
libnginx-mod-nchan_1.14.0-0ubuntu1.11+tuxcare.els10_amd64.deb
sha:53d6bf0452de1a39d36465bedfa96f96139a8a02
-
libnginx-mod-rtmp_1.14.0-0ubuntu1.11+tuxcare.els10_amd64.deb
sha:8ed35abc9c509ac023e3b401ac68f687fe024092
-
libnginx-mod-stream_1.14.0-0ubuntu1.11+tuxcare.els10_amd64.deb
sha:6de7f5bbbbbeab8bd1d2e9c2b07377bacd7948f1
-
nginx_1.14.0-0ubuntu1.11+tuxcare.els10_all.deb
sha:cd070ae6331fed8b1ee5ca7d3f4576bf3fe0c973
-
nginx-common_1.14.0-0ubuntu1.11+tuxcare.els10_all.deb
sha:ea4783e17884e38916b2280a723908fa6531b7b7
-
nginx-core_1.14.0-0ubuntu1.11+tuxcare.els10_amd64.deb
sha:4c83f29b2717946a37908a0b54341d383b5b772b
-
nginx-doc_1.14.0-0ubuntu1.11+tuxcare.els10_all.deb
sha:c362cd8e52904f3571d663f27f30581a20c9e90b
-
nginx-extras_1.14.0-0ubuntu1.11+tuxcare.els10_amd64.deb
sha:308100910bfdeb54720b7b50ced2986dd28457be
-
nginx-full_1.14.0-0ubuntu1.11+tuxcare.els10_amd64.deb
sha:aca8ff6a2618676fadbbd39868c2f9cf6807c780
-
nginx-light_1.14.0-0ubuntu1.11+tuxcare.els10_amd64.deb
sha:cdb0398d7bc2a8ba51ca222fd7b948d0c6f4265d
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
