{ "document": { "aggregate_severity": { "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "* SECURITY UPDATE: heap buffer overflow when proxying oversized headers to\n an HTTP/2 or gRPC upstream, and when emitting oversized Content-Type and\n Location response headers over HTTP/2\n - debian/patches/CVE-2026-42055.patch: reject header fields longer than\n NGX_HTTP_V2_MAX_FIELD in ngx_http_grpc_create_request() for the method\n name, uri, host and each header key and value, and add the same length\n guards for content_type and location in ngx_http_v2_header_filter()\n - CVE-2026-42055\n * SECURITY UPDATE: use-after-free in the ssi module during unbuffered\n proxying when a subrequest was posted twice and finalized in both calls\n - debian/patches/CVE-2026-56434.patch: skip posting a request that is\n already on r->main->posted_requests, and reset r->write_event_handler\n to ngx_http_request_empty_handler during subrequest finalization\n - CVE-2026-56434", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786965098", "url": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786965098" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_docker/debian13/advisories/2026/clsa-2026_1786965098.json" } ], "tracking": { "current_release_date": "2026-08-17T11:12:14Z", "generator": { "date": "2026-08-17T11:12:14Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1786965098", "initial_release_date": "2026-08-17T11:12:14Z", "revision_history": [ { "date": "2026-08-17T11:12:14Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "Fix CVE(s): CVE-2026-42055, CVE-2026-56434" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian 13", "product": { "name": "Debian 13", "product_id": "Debian-13", "product_identification_helper": { "cpe": "cpe:2.3:o:debian:debian_linux:13:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Debian" } ], "category": "vendor", "name": "Software in the Public Interest, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els14.arm64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els14.arm64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els14.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els14?arch=arm64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els13.arm64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els13.arm64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els13.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els13?arch=arm64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.arm64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.arm64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els12?arch=arm64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.arm64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.arm64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els9?arch=arm64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.arm64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.arm64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els8?arch=arm64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.arm64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.arm64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els6?arch=arm64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.arm64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.arm64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els5?arch=arm64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.arm64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.arm64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els3?arch=arm64&os_name=debian&os_version=13" } } } ], "category": "architecture", "name": "arm64" }, { "branches": [ { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els14.amd64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els14.amd64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els14.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els14?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els13.amd64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els13.amd64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els13.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els13?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.amd64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.amd64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els12?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.amd64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.amd64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els9?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.amd64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.amd64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els8?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.amd64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.amd64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els6?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.amd64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.amd64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els5?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.amd64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.amd64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els3?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els2.amd64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els2.amd64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els2.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els2?arch=amd64&os_name=debian&os_version=13" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els14.arm64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els14.arm64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els14.arm64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els14.amd64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els14.amd64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els14.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els13.arm64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els13.arm64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els13.arm64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els13.amd64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els13.amd64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els13.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.amd64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.amd64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.arm64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.arm64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.arm64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.amd64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.amd64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.arm64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.arm64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.arm64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.amd64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.amd64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.arm64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.arm64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.arm64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.arm64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.arm64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.arm64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.amd64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.amd64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.amd64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.amd64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.arm64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.arm64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.arm64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.amd64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.amd64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.arm64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.arm64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.arm64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els2.amd64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els2.amd64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els2.amd64", "relates_to_product_reference": "Debian-13" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-42055", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els14.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els14.arm64" ], "known_affected": [ "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els13.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els13.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.arm64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-docker/cve/CVE-2026-42055" }, { "category": "external", "summary": "https://my.f5.com/manage/s/article/K000161584", "url": "https://my.f5.com/manage/s/article/K000161584" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:27197", "url": "https://access.redhat.com/errata/RHSA-2026:27197" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:36331", "url": "https://access.redhat.com/errata/RHSA-2026:36331" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:36364", "url": "https://access.redhat.com/errata/RHSA-2026:36364" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:36618", "url": "https://access.redhat.com/errata/RHSA-2026:36618" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:36639", "url": "https://access.redhat.com/errata/RHSA-2026:36639" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:38847", "url": "https://access.redhat.com/errata/RHSA-2026:38847" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:44481", "url": "https://access.redhat.com/errata/RHSA-2026:44481" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:46836", "url": "https://access.redhat.com/errata/RHSA-2026:46836" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-42055", "url": "https://access.redhat.com/security/cve/CVE-2026-42055" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2489866", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489866" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42055.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42055.json" } ], "release_date": "2026-06-17T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-08-17T11:11:40.086236Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786965098", "product_ids": [ "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els14.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els14.arm64" ], "url": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786965098" }, { "category": "none_available", "date": "2026-06-17T15:16:00Z", "details": "Affected", "product_ids": [ "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els13.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els13.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.arm64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2026-56434", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "notes": [ { "category": "description", "text": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a use-after-free in the NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX worker process.\n\nImpact:\nThis vulnerability may allow remote attackers to have limited control to modify memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only.\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els14.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els14.arm64" ], "known_affected": [ "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els13.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els13.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.arm64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-docker/cve/CVE-2026-56434" }, { "category": "external", "summary": "https://my.f5.com/manage/s/article/K000162098", "url": "https://my.f5.com/manage/s/article/K000162098" } ], "release_date": "2026-07-15T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-08-17T11:11:40.086236Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786965098", "product_ids": [ "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els14.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els14.arm64" ], "url": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1786965098" }, { "category": "none_available", "date": "2026-07-15T15:16:00Z", "details": "Affected", "product_ids": [ "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els13.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els13.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.arm64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] } ] }