{ "document": { "aggregate_severity": { "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "* SECURITY UPDATE: Heap buffer overflow in njs proxy URL credential decoding\n - debian/patches/CVE-2026-8711.patch: size decoded username and password\n buffers from their encoded input lengths and add a regression test\n - CVE-2026-8711\n * SECURITY UPDATE: Use-after-free caused by duplicate subrequest finalization\n - debian/patches/CVE-2026-56434.patch: prevent duplicate request posting and\n reset the write event handler during active subrequest finalization\n - CVE-2026-56434\n * SECURITY UPDATE: Heap buffer overflow from oversized gRPC headers\n - debian/patches/CVE-2026-42055.patch: enforce HTTP/2 field length limits\n when constructing gRPC requests\n - CVE-2026-42055\n * SECURITY UPDATE: Buffer over-read while recoding invalid UTF-8 sequences\n - debian/patches/CVE-2026-48142.patch: advance the saved input pointer over\n the complete saved sequence after invalid UTF-8 input\n - CVE-2026-48142", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786710609", "url": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786710609" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_docker/debian13/advisories/2026/clsa-2026_1786710609.json" } ], "tracking": { "current_release_date": "2026-08-17T16:11:56Z", "generator": { "date": "2026-08-17T16:11:56Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1786710609", "initial_release_date": "2026-08-14T12:30:52Z", "revision_history": [ { "date": "2026-08-14T12:30:52Z", "number": "1", "summary": "Initial version" }, { "date": "2026-08-17T14:05:12Z", "number": "2", "summary": "Update document" }, { "date": "2026-08-17T16:11:56Z", "number": "3", "summary": "Update document" } ], "status": "final", "version": "3" }, "title": "Fix CVE(s): CVE-2026-42055, CVE-2026-48142, CVE-2026-56434, CVE-2026-8711" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian 13", "product": { "name": "Debian 13", "product_id": "Debian-13", "product_identification_helper": { "cpe": "cpe:2.3:o:debian:debian_linux:13:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Debian" } ], "category": "vendor", "name": "Software in the Public Interest, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64", "product": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64", "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els17?arch=arm64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "product": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els16?arch=arm64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "product": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els15?arch=arm64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "product": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els12?arch=arm64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64", "product": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64", "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els9?arch=arm64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "product": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els8?arch=arm64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "product": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els5?arch=arm64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "product": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els4?arch=arm64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "product": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els2?arch=arm64&os_name=debian&os_version=13" } } } ], "category": "architecture", "name": "arm64" }, { "branches": [ { "category": "product_version", "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64", "product": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64", "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els17?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "product": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els16?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "product": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els15?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "product": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els12?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "product": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els9?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "product": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els8?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "product": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els5?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "product": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els4?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "product": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els2?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "product": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "product_id": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.25@1.25.5-1~trixie%2Btuxcare.els1?arch=amd64&os_name=debian&os_version=13" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64 as a component of Debian 13", "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64" }, "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64 as a component of Debian 13", "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64" }, "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64 as a component of Debian 13", "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64" }, "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64 as a component of Debian 13", "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64" }, "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64 as a component of Debian 13", "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64" }, "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64 as a component of Debian 13", "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64" }, "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64 as a component of Debian 13", "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64" }, "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64 as a component of Debian 13", "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64" }, "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64 as a component of Debian 13", "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" }, "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64 as a component of Debian 13", "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64" }, "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64 as a component of Debian 13", "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64" }, "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64 as a component of Debian 13", "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64" }, "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64 as a component of Debian 13", "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64" }, "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64 as a component of Debian 13", "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64" }, "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64 as a component of Debian 13", "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64" }, "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64 as a component of Debian 13", "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64" }, "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64 as a component of Debian 13", "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64" }, "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64 as a component of Debian 13", "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64" }, "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64 as a component of Debian 13", "product_id": "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64" }, "product_reference": "nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "relates_to_product_reference": "Debian-13" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-48142", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with both source_charset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64" ], "known_affected": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-docker/cve/CVE-2026-48142" }, { "category": "external", "summary": "https://my.f5.com/manage/s/article/K000161585", "url": "https://my.f5.com/manage/s/article/K000161585" } ], "release_date": "2026-06-17T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-08-14T12:30:11.433355Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786710609", "product_ids": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64" ], "url": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786710609" }, { "category": "none_available", "date": "2026-06-17T15:16:00Z", "details": "Affected", "product_ids": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-42055", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64" ], "known_affected": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-docker/cve/CVE-2026-42055" }, { "category": "external", "summary": "https://my.f5.com/manage/s/article/K000161584", "url": "https://my.f5.com/manage/s/article/K000161584" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:27197", "url": "https://access.redhat.com/errata/RHSA-2026:27197" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:36331", "url": "https://access.redhat.com/errata/RHSA-2026:36331" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:36364", "url": "https://access.redhat.com/errata/RHSA-2026:36364" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:36618", "url": "https://access.redhat.com/errata/RHSA-2026:36618" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:36639", "url": "https://access.redhat.com/errata/RHSA-2026:36639" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:38847", "url": "https://access.redhat.com/errata/RHSA-2026:38847" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:44481", "url": "https://access.redhat.com/errata/RHSA-2026:44481" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:46836", "url": "https://access.redhat.com/errata/RHSA-2026:46836" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-42055", "url": "https://access.redhat.com/security/cve/CVE-2026-42055" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2489866", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489866" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42055.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42055.json" } ], "release_date": "2026-06-17T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-08-14T12:30:11.433355Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786710609", "product_ids": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64" ], "url": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786710609" }, { "category": "none_available", "date": "2026-06-17T15:16:00Z", "details": "Affected", "product_ids": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-27654", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names outside the document root. This issue affects NGINX Open Source and NGINX Plus when the configuration file uses DAV module MOVE or COPY methods, prefix location (nonregular expression location configuration), and alias directives. The integrity impact is constrained because the NGINX worker process user has low privileges and does not have access to the entire system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64" ], "known_affected": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-docker/cve/CVE-2026-27654" }, { "category": "external", "summary": "https://my.f5.com/manage/s/article/K000160382", "url": "https://my.f5.com/manage/s/article/K000160382" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:10065", "url": "https://access.redhat.com/errata/RHSA-2026:10065" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:13634", "url": "https://access.redhat.com/errata/RHSA-2026:13634" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:13680", "url": "https://access.redhat.com/errata/RHSA-2026:13680" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:13839", "url": "https://access.redhat.com/errata/RHSA-2026:13839" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:14836", "url": "https://access.redhat.com/errata/RHSA-2026:14836" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:15942", "url": "https://access.redhat.com/errata/RHSA-2026:15942" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:15943", "url": "https://access.redhat.com/errata/RHSA-2026:15943" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:15945", "url": "https://access.redhat.com/errata/RHSA-2026:15945" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:15966", "url": "https://access.redhat.com/errata/RHSA-2026:15966" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6906", "url": "https://access.redhat.com/errata/RHSA-2026:6906" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6907", "url": "https://access.redhat.com/errata/RHSA-2026:6907" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6923", "url": "https://access.redhat.com/errata/RHSA-2026:6923" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7002", "url": "https://access.redhat.com/errata/RHSA-2026:7002" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7343", "url": "https://access.redhat.com/errata/RHSA-2026:7343" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:8346", "url": "https://access.redhat.com/errata/RHSA-2026:8346" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-27654", "url": "https://access.redhat.com/security/cve/CVE-2026-27654" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2450776", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450776" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27654.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27654.json" } ], "release_date": "2026-03-24T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-08-14T12:30:11.433355Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786710609", "product_ids": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64" ], "url": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786710609" }, { "category": "none_available", "date": "2026-03-24T15:16:00Z", "details": "Affected", "product_ids": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-1642", "cwe": { "id": "CWE-349", "name": "Acceptance of Extraneous Untrusted Data With Trusted Data" }, "notes": [ { "category": "description", "text": "A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64" ], "known_affected": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-docker/cve/CVE-2026-1642" }, { "category": "external", "summary": "https://my.f5.com/manage/s/article/K000159824", "url": "https://my.f5.com/manage/s/article/K000159824" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2026/02/05/1", "url": "http://www.openwall.com/lists/oss-security/2026/02/05/1" } ], "release_date": "2026-02-04T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-08-14T12:30:11.433355Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786710609", "product_ids": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64" ], "url": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786710609" }, { "category": "none_available", "date": "2026-02-04T15:16:00Z", "details": "Affected", "product_ids": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-56434", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a use-after-free in the NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX worker process.\n\nImpact:\nThis vulnerability may allow remote attackers to have limited control to modify memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only.\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64" ], "known_affected": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-docker/cve/CVE-2026-56434" }, { "category": "external", "summary": "https://my.f5.com/manage/s/article/K000162098", "url": "https://my.f5.com/manage/s/article/K000162098" } ], "release_date": "2026-07-15T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-08-14T12:30:11.433355Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786710609", "product_ids": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64" ], "url": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786710609" }, { "category": "none_available", "date": "2026-07-15T15:16:00Z", "details": "Affected", "product_ids": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2024-7347", "cwe": { "id": "CWE-126", "name": "Buffer Over-read" }, "notes": [ { "category": "description", "text": "NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted mp4 file with the ngx_http_mp4_module.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64" ], "known_affected": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-docker/cve/CVE-2024-7347" }, { "category": "external", "summary": "https://my.f5.com/manage/s/article/K000140529", "url": "https://my.f5.com/manage/s/article/K000140529" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2024/08/14/4", "url": "http://www.openwall.com/lists/oss-security/2024/08/14/4" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2025/03/msg00017.html", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00017.html" } ], "release_date": "2024-08-14T15:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-08-14T12:30:11.433355Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786710609", "product_ids": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64" ], "url": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786710609" }, { "category": "none_available", "date": "2024-08-14T15:15:00Z", "details": "Affected", "product_ids": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-40701", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to \"on\" or \"optional,\" and the ssl_ocsp directive is set to \"on\" or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can send requests along with conditions beyond its control that may cause a heap-use-after-free error in the NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker process restarting.\n\n\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64" ], "known_affected": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-docker/cve/CVE-2026-40701" }, { "category": "external", "summary": "https://my.f5.com/manage/s/article/K000161021", "url": "https://my.f5.com/manage/s/article/K000161021" } ], "release_date": "2026-05-13T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-08-14T12:30:11.433355Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786710609", "product_ids": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64" ], "url": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786710609" }, { "category": "none_available", "date": "2026-05-13T16:16:00Z", "details": "Affected", "product_ids": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1" }, "products": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-42946", "cwe": { "id": "CWE-789", "name": "Memory Allocation with Excessive Size Value" }, "notes": [ { "category": "description", "text": "A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64" ], "known_affected": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-docker/cve/CVE-2026-42946" }, { "category": "external", "summary": "https://my.f5.com/manage/s/article/K000161027", "url": "https://my.f5.com/manage/s/article/K000161027" } ], "release_date": "2026-05-13T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-08-14T12:30:11.433355Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786710609", "product_ids": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64" ], "url": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786710609" }, { "category": "none_available", "date": "2026-05-13T16:16:00Z", "details": "Affected", "product_ids": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-8711", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64" ], "known_affected": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-docker/cve/CVE-2026-8711" }, { "category": "external", "summary": "https://my.f5.com/manage/s/article/K000161307", "url": "https://my.f5.com/manage/s/article/K000161307" } ], "release_date": "2026-05-19T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-08-14T12:30:11.433355Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786710609", "product_ids": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64" ], "url": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786710609" }, { "category": "none_available", "date": "2026-05-19T15:16:00Z", "details": "Affected", "product_ids": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-32647", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 file. This issue affects NGINX Open Source and NGINX Plus if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64" ], "known_affected": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-docker/cve/CVE-2026-32647" }, { "category": "external", "summary": "https://my.f5.com/manage/s/article/K000160366", "url": "https://my.f5.com/manage/s/article/K000160366" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:10065", "url": "https://access.redhat.com/errata/RHSA-2026:10065" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:13634", "url": "https://access.redhat.com/errata/RHSA-2026:13634" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:13680", "url": "https://access.redhat.com/errata/RHSA-2026:13680" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:13839", "url": "https://access.redhat.com/errata/RHSA-2026:13839" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:14836", "url": "https://access.redhat.com/errata/RHSA-2026:14836" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:15942", "url": "https://access.redhat.com/errata/RHSA-2026:15942" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:15943", "url": "https://access.redhat.com/errata/RHSA-2026:15943" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:15945", "url": "https://access.redhat.com/errata/RHSA-2026:15945" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:15966", "url": "https://access.redhat.com/errata/RHSA-2026:15966" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6906", "url": "https://access.redhat.com/errata/RHSA-2026:6906" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6907", "url": "https://access.redhat.com/errata/RHSA-2026:6907" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6923", "url": "https://access.redhat.com/errata/RHSA-2026:6923" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7002", "url": "https://access.redhat.com/errata/RHSA-2026:7002" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7343", "url": "https://access.redhat.com/errata/RHSA-2026:7343" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:8346", "url": "https://access.redhat.com/errata/RHSA-2026:8346" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-32647", "url": "https://access.redhat.com/security/cve/CVE-2026-32647" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2449598", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449598" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32647.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32647.json" } ], "release_date": "2026-03-24T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-08-14T12:30:11.433355Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786710609", "product_ids": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64" ], "url": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786710609" }, { "category": "none_available", "date": "2026-03-24T15:16:00Z", "details": "Affected", "product_ids": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-27784", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NGINX worker memory resulting in its termination, using a specially crafted MP4 file. The issue only affects 32-bit NGINX Open Source if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64" ], "known_affected": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-docker/cve/CVE-2026-27784" }, { "category": "external", "summary": "https://my.f5.com/manage/s/article/K000160364", "url": "https://my.f5.com/manage/s/article/K000160364" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:10065", "url": "https://access.redhat.com/errata/RHSA-2026:10065" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:13634", "url": "https://access.redhat.com/errata/RHSA-2026:13634" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:13680", "url": "https://access.redhat.com/errata/RHSA-2026:13680" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:13839", "url": "https://access.redhat.com/errata/RHSA-2026:13839" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:14836", "url": "https://access.redhat.com/errata/RHSA-2026:14836" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:15942", "url": "https://access.redhat.com/errata/RHSA-2026:15942" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:15943", "url": "https://access.redhat.com/errata/RHSA-2026:15943" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:15945", "url": "https://access.redhat.com/errata/RHSA-2026:15945" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:15966", "url": "https://access.redhat.com/errata/RHSA-2026:15966" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6906", "url": "https://access.redhat.com/errata/RHSA-2026:6906" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6907", "url": "https://access.redhat.com/errata/RHSA-2026:6907" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:6923", "url": "https://access.redhat.com/errata/RHSA-2026:6923" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7002", "url": "https://access.redhat.com/errata/RHSA-2026:7002" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:7343", "url": "https://access.redhat.com/errata/RHSA-2026:7343" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:8346", "url": "https://access.redhat.com/errata/RHSA-2026:8346" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-27784", "url": "https://access.redhat.com/security/cve/CVE-2026-27784" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2450785", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450785" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27784.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27784.json" } ], "release_date": "2026-03-24T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-08-14T12:30:11.433355Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786710609", "product_ids": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els17.arm64" ], "url": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786710609" }, { "category": "none_available", "date": "2026-03-24T15:16:00Z", "details": "Affected", "product_ids": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els1.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els15.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els16.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els2.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els4.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.25-0:1.25.5-1~trixie+tuxcare.els9.arm64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }