Release date:
2026-10-20 09:12:52 UTC
Description:
* SECURITY UPDATE: heap buffer overflow when mapping a rewritten URI to a
path in a location using alias
- debian/patches/CVE-2026-15176.patch: reject URI to path mapping in
ngx_http_map_uri_to_path() when r->uri_changed is set, so a rewrite
that shortens the URI below the alias location prefix can no longer
overflow the path buffer through $request_filename
- CVE-2026-15176
* SECURITY UPDATE: use-after-free via duplicate subrequest finalization
- debian/patches/CVE-2026-56434.patch: skip posting a request in
ngx_http_post_request() if it is already posted, and reset the
subrequest write event handler during finalization in
ngx_http_finalize_request(), so an SSI subrequest double-posted during
unbuffered proxying can no longer be finalized twice
- CVE-2026-56434
Updated packages:
-
libnginx-mod-http-auth-pam_1.18.0-0ubuntu1.7+tuxcare.els10_amd64.deb
sha:8c95c9211490682c8051ee230f585b8305805055
-
libnginx-mod-http-cache-purge_1.18.0-0ubuntu1.7+tuxcare.els10_amd64.deb
sha:94076ba23f0bf56c05415d0025ba65355af01da5
-
libnginx-mod-http-dav-ext_1.18.0-0ubuntu1.7+tuxcare.els10_amd64.deb
sha:18d18970cd8d4a0d5fbb72ec48873fd24245b722
-
libnginx-mod-http-echo_1.18.0-0ubuntu1.7+tuxcare.els10_amd64.deb
sha:659c78f929332a4c8902c5b59696f593de524b5e
-
libnginx-mod-http-fancyindex_1.18.0-0ubuntu1.7+tuxcare.els10_amd64.deb
sha:2d042fb0835ff028a00491177554131f4074810a
-
libnginx-mod-http-geoip_1.18.0-0ubuntu1.7+tuxcare.els10_amd64.deb
sha:f04ca16910a508e358bca632cc8e52c041f9d1b3
-
libnginx-mod-http-geoip2_1.18.0-0ubuntu1.7+tuxcare.els10_amd64.deb
sha:f965955fa7bcd06aad0d51ef49a35bc9e9a3c35c
-
libnginx-mod-http-headers-more-filter_1.18.0-0ubuntu1.7+tuxcare.els10_amd64.deb
sha:bc9b4bce012ad17d7c7409833b2ea11196160bb6
-
libnginx-mod-http-image-filter_1.18.0-0ubuntu1.7+tuxcare.els10_amd64.deb
sha:733745a08bfb106a2c46072b19b603e8a8b6d74e
-
libnginx-mod-http-lua_1.18.0-0ubuntu1.7+tuxcare.els10_amd64.deb
sha:b71a178e24bf5199d2b652f5829dd6ca6d5abde5
-
libnginx-mod-http-ndk_1.18.0-0ubuntu1.7+tuxcare.els10_amd64.deb
sha:a5b423c26150d56341ad9a35e70c82ccd0783cc7
-
libnginx-mod-http-perl_1.18.0-0ubuntu1.7+tuxcare.els10_amd64.deb
sha:27af5377e6e22a86bfdd56f18f4d228c1c9aab95
-
libnginx-mod-http-subs-filter_1.18.0-0ubuntu1.7+tuxcare.els10_amd64.deb
sha:5f90f85b3ec181ee25a0e2c2aa1375ac78903a00
-
libnginx-mod-http-uploadprogress_1.18.0-0ubuntu1.7+tuxcare.els10_amd64.deb
sha:7520939f06864031e286cdccaac36d3509e2f087
-
libnginx-mod-http-upstream-fair_1.18.0-0ubuntu1.7+tuxcare.els10_amd64.deb
sha:945ba7f861feddb8a7de090dec7b67be5fc57aaf
-
libnginx-mod-http-xslt-filter_1.18.0-0ubuntu1.7+tuxcare.els10_amd64.deb
sha:d110dd4d0be1e7714ac7d28921c6d14e65ef83b1
-
libnginx-mod-mail_1.18.0-0ubuntu1.7+tuxcare.els10_amd64.deb
sha:326ba00d6f02bc994104dc349e2c8728b624ed9b
-
libnginx-mod-nchan_1.18.0-0ubuntu1.7+tuxcare.els10_amd64.deb
sha:a0af0e147e1cfcaf3751cc16b47f60c3b2318b9c
-
libnginx-mod-rtmp_1.18.0-0ubuntu1.7+tuxcare.els10_amd64.deb
sha:6c6f973ae290614dacd229f9a37e60660e344c50
-
libnginx-mod-stream_1.18.0-0ubuntu1.7+tuxcare.els10_amd64.deb
sha:30c6f694c4b90007ce050ceb145996e952949262
-
nginx_1.18.0-0ubuntu1.7+tuxcare.els10_all.deb
sha:a5dcfd763819d57794df8ff6896e74b5104c2d7b
-
nginx-common_1.18.0-0ubuntu1.7+tuxcare.els10_all.deb
sha:19d35dfefb7da197de0d653b36efec1efb324ca7
-
nginx-core_1.18.0-0ubuntu1.7+tuxcare.els10_amd64.deb
sha:2c4416302418f038bcafef61d45a99979db8f67d
-
nginx-doc_1.18.0-0ubuntu1.7+tuxcare.els10_all.deb
sha:f5126d0730997a808da38a1980ea89e7dbc0930a
-
nginx-extras_1.18.0-0ubuntu1.7+tuxcare.els10_amd64.deb
sha:581eef3379c7659ab65d6898bb4dc1d3ab6bb083
-
nginx-full_1.18.0-0ubuntu1.7+tuxcare.els10_amd64.deb
sha:2d52dcb7fff82c175719bb80486c7502ad8215c2
-
nginx-light_1.18.0-0ubuntu1.7+tuxcare.els10_amd64.deb
sha:f54c5d89b241c5e86359d52d7d72aa1430e88fdf
-
libnginx-mod-http-auth-pam_1.18.0-0ubuntu1.7+tuxcare.els10_arm64.deb
sha:cb6901eb913d7c5518c11ca932f778a5204fb2d5
-
libnginx-mod-http-cache-purge_1.18.0-0ubuntu1.7+tuxcare.els10_arm64.deb
sha:db70d9eed74313509940cf9ab68a09fa31fb0bd7
-
libnginx-mod-http-dav-ext_1.18.0-0ubuntu1.7+tuxcare.els10_arm64.deb
sha:59537b18dad58a7aef5ebc2e464215a5d694f04c
-
libnginx-mod-http-echo_1.18.0-0ubuntu1.7+tuxcare.els10_arm64.deb
sha:3072ecc9db04d7ba4d76499a0529a376bb42c95a
-
libnginx-mod-http-fancyindex_1.18.0-0ubuntu1.7+tuxcare.els10_arm64.deb
sha:5f3ff6b2bd7fbf3ea599b3095232bbbea3fdf51a
-
libnginx-mod-http-geoip_1.18.0-0ubuntu1.7+tuxcare.els10_arm64.deb
sha:8af4ceb21643d065e8ec258b0dd4beff469ed2af
-
libnginx-mod-http-geoip2_1.18.0-0ubuntu1.7+tuxcare.els10_arm64.deb
sha:0a9dd00446defd6703484f188639ecb94612b439
-
libnginx-mod-http-headers-more-filter_1.18.0-0ubuntu1.7+tuxcare.els10_arm64.deb
sha:03f47db3875a5ba4e8ad13b07ae647be7a01fad9
-
libnginx-mod-http-image-filter_1.18.0-0ubuntu1.7+tuxcare.els10_arm64.deb
sha:ae734b9ba07d81e426a1c53ed7c81a65aff99e08
-
libnginx-mod-http-lua_1.18.0-0ubuntu1.7+tuxcare.els10_arm64.deb
sha:644d288afea7b44f55030c0e314b17622c91254f
-
libnginx-mod-http-ndk_1.18.0-0ubuntu1.7+tuxcare.els10_arm64.deb
sha:6022ad1e473dc735f26d8aa05b37cac9ff5243d4
-
libnginx-mod-http-perl_1.18.0-0ubuntu1.7+tuxcare.els10_arm64.deb
sha:a75377f1a7982e2040288754a2e45711635f4e59
-
libnginx-mod-http-subs-filter_1.18.0-0ubuntu1.7+tuxcare.els10_arm64.deb
sha:448aa7c7b777b6d65e629749ef1627aa6fbbf1c5
-
libnginx-mod-http-uploadprogress_1.18.0-0ubuntu1.7+tuxcare.els10_arm64.deb
sha:7392f2ed3754cef04169298f9f838ebcba927c1b
-
libnginx-mod-http-upstream-fair_1.18.0-0ubuntu1.7+tuxcare.els10_arm64.deb
sha:f43648e6ded7e4d7c539f4032d6b5874acb57449
-
libnginx-mod-http-xslt-filter_1.18.0-0ubuntu1.7+tuxcare.els10_arm64.deb
sha:44ed8ac356af4373dc9298040c4adeddb098ef2b
-
libnginx-mod-mail_1.18.0-0ubuntu1.7+tuxcare.els10_arm64.deb
sha:e5fe7f8aa3313119c92a7a8fe31033ddfeae2526
-
libnginx-mod-nchan_1.18.0-0ubuntu1.7+tuxcare.els10_arm64.deb
sha:95cee5862dbc0ad377a13091ab1143f674cc872b
-
libnginx-mod-rtmp_1.18.0-0ubuntu1.7+tuxcare.els10_arm64.deb
sha:d786294248be1d527fd066a31c690263be471140
-
libnginx-mod-stream_1.18.0-0ubuntu1.7+tuxcare.els10_arm64.deb
sha:bb6209234901502672d5252eb36c68c9e1286427
-
nginx-core_1.18.0-0ubuntu1.7+tuxcare.els10_arm64.deb
sha:5c1f6cbebae30f7a02018657bdbedfbeae698e42
-
nginx-extras_1.18.0-0ubuntu1.7+tuxcare.els10_arm64.deb
sha:80b6a13fe4f2648ca12d4dc0627fd308d2366804
-
nginx-full_1.18.0-0ubuntu1.7+tuxcare.els10_arm64.deb
sha:b37dbd0aab8d5cee1f20c0f50c03376578da3296
-
nginx-light_1.18.0-0ubuntu1.7+tuxcare.els10_arm64.deb
sha:a1ec135193e8c811ce057bc3ad8ffa4013ae6d43
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
