[CLSA-2026:1782317620] nginx: Fix of CVE-2026-49975
Type:
security
Severity:
Important
Release date:
2026-06-24 16:14:00 UTC
Description:
- CVE-2026-49975: add max_headers directive (default 1000) to cap HTTP/2 request-header memory exhaustion (HTTP/2 Bomb)
CVEs fixed:
Updated packages:
  • nginx-1.14.1-9.module_el8+2428+c4299125.tuxcare.els9.x86_64.rpm
    sha:ff2ef4a5de770f79d1f2b57fea855f82c6c120c2267c91ae56ebd28945233abe
  • nginx-all-modules-1.14.1-9.module_el8+2428+c4299125.tuxcare.els9.noarch.rpm
    sha:e8ee1c0679eadf3df0bb393f6e8efe8339ed4ebf8ca43779ad6ef12c969c1bee
  • nginx-filesystem-1.14.1-9.module_el8+2428+c4299125.tuxcare.els9.noarch.rpm
    sha:0e6e6fc067ea579cbac803aaed445f08f9657e4a6ed4520bd7050cf831231f99
  • nginx-mod-http-image-filter-1.14.1-9.module_el8+2428+c4299125.tuxcare.els9.x86_64.rpm
    sha:51b5336fee4506e001142b3b3139ce79d60a72df8e6edc5fa6252226d7d12891
  • nginx-mod-http-perl-1.14.1-9.module_el8+2428+c4299125.tuxcare.els9.x86_64.rpm
    sha:db3cb84a86c4e55dd05a99fdabb443e273ed2e8200b6bfad57650f5b1a8e484e
  • nginx-mod-http-xslt-filter-1.14.1-9.module_el8+2428+c4299125.tuxcare.els9.x86_64.rpm
    sha:4840dbca3b5569cc527cb69950f5298dc9d36e08bfa51469cdaabe7ed91d184f
  • nginx-mod-mail-1.14.1-9.module_el8+2428+c4299125.tuxcare.els9.x86_64.rpm
    sha:6f0e6343b8d9c8fc01d632d242aa1915895558161c2f6d385addbf7e09072945
  • nginx-mod-stream-1.14.1-9.module_el8+2428+c4299125.tuxcare.els9.x86_64.rpm
    sha:87a0a17c6546021ac996d917ad7a9b9d4ad3ac8b0c5f1906ef2fd1a32fc8343b
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.