{"id":"CLSA-2026-1785509707","summary":"nginx: Fix of 6 CVEs","details":"- CVE-2025-53859: fix buffer over-read in the SMTP authentication path that\n  could disclose worker process memory to the authentication server\n- CVE-2026-28753: validate host names resolved from the client address to\n  prevent header injection into auth_http and XCLIENT requests\n- CVE-2026-40701: fix use-after-free by cancelling a pending OCSP responder\n  resolve when the client connection is closed\n- CVE-2026-42934: fix buffer over-read in the charset filter when a UTF-8\n  sequence is split across several buffers\n- CVE-2026-48142: fix remaining buffer over-read in the charset filter on\n  invalid UTF-8 sequences\n- CVE-2026-42946: reset the parsing state and restore the buffer position\n  after an unrecognized upstream status line in the scgi and uwsgi modules","modified":"2026-10-26T09:43:18.215783126Z","published":"2026-07-31T15:01:40Z","upstream":["CVE-2025-53859","CVE-2026-28753","CVE-2026-40701","CVE-2026-42934","CVE-2026-42946","CVE-2026-48142"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1785509707.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53859"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28753"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40701"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42934"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42946"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48142"}],"affected":[{"package":{"name":"nginx","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/nginx?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1785509707.json"}},{"package":{"name":"nginx-all-modules","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/nginx-all-modules?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1785509707.json"}},{"package":{"name":"nginx-core","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/nginx-core?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1785509707.json"}},{"package":{"name":"nginx-filesystem","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/nginx-filesystem?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1785509707.json"}},{"package":{"name":"nginx-mod-devel","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/nginx-mod-devel?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1785509707.json"}},{"package":{"name":"nginx-mod-http-image-filter","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/nginx-mod-http-image-filter?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1785509707.json"}},{"package":{"name":"nginx-mod-http-perl","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/nginx-mod-http-perl?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1785509707.json"}},{"package":{"name":"nginx-mod-http-xslt-filter","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/nginx-mod-http-xslt-filter?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1785509707.json"}},{"package":{"name":"nginx-mod-mail","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/nginx-mod-mail?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1785509707.json"}},{"package":{"name":"nginx-mod-stream","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/nginx-mod-stream?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els9"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1785509707.json"}}],"schema_version":"1.9.0"}