Oracle alert ELSA-2026-29151 (nginx:1.26)

From:
             
 
Errata Announcements for Oracle Linux via El-errata <el-errata@oss.oracle.com>
To:
             
 
el-errata@oss.oracle.com
Subject:
             
 
[El-errata] ELSA-2026-29151 Important: Oracle Linux 9 nginx:1.26 security update
Date:
             
 
Fri, 26 Jun 2026 20:33:18 -0700
Message-ID:
             
 
<mailman.183.1782531210.18.el-errata@oss.oracle.com>
Oracle Linux Security Advisory ELSA-2026-29151

http://linux.oracle.com/errata/ELSA-2026-29151.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

x86_64:
nginx-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.x86_64.rpm
nginx-all-modules-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.noarch.rpm
nginx-core-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.x86_64.rpm
nginx-filesystem-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.noarch.rpm
nginx-mod-devel-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.x86_64.rpm
nginx-mod-http-image-filter-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.x86_64.rpm
nginx-mod-http-perl-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.x86_64.rpm
nginx-mod-http-xslt-filter-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.x86_64.rpm
nginx-mod-mail-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.x86_64.rpm
nginx-mod-stream-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.x86_64.rpm

aarch64:
nginx-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.aarch64.rpm
nginx-all-modules-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.noarch.rpm
nginx-core-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.aarch64.rpm
nginx-filesystem-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.noarch.rpm
nginx-mod-devel-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.aarch64.rpm
nginx-mod-http-image-filter-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.aarch64.rpm
nginx-mod-http-perl-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.aarch64.rpm
nginx-mod-http-xslt-filter-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.aarch64.rpm
nginx-mod-mail-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.aarch64.rpm
nginx-mod-stream-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.aarch64.rpm


SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates/nginx-1.26.3-9.0....

Related CVEs:

CVE-2026-9256




Description of changes:

[1.26.3-9.0.1.1]
- Require oracle-indexhtml

[2:1.26.3-11]
- nginx:1.26/nginx: HTTP/2: Remote Denial of Service via compression bomb
  and Slowloris-style attack

[2:1.26.3-10]
- nginx: code execution and denial of service (CVE-2026-9256)

[2:1.26.3-9]
- Resolves: RHEL-176218 - nginx:1.26/nginx: NGINX: Arbitrary Code Execution
  Vulnerability (CVE-2026-42945)

[2:1.26.3-8]
- CVE-2026-32647 nginx:1.26/nginx: NGINX: Denial of Service or Code
  Execution via specially crafted MP4 files

[2:1.26.3-7]
- CVE-2026-27651 nginx:1.26/nginx: NGINX: Denial of Service via undisclosed
  requests when ngx_mail_auth_http_module is enabled

[2:1.26.3-6]
- CVE-2026-27784 nginx:1.26/nginx: NGINX: Denial of Service due to memory
  corruption via crafted MP4 file

[2:1.26.3-5]
- CVE-2026-27654 nginx:1.26/nginx: NGINX: Denial of Service or file
  modification via buffer overflow in ngx_http_dav_module

[2:1.26.3-4]
- CVE-2026-1642 nginx: NGINX: Data injection via man-in-the-middle attack
  on TLS proxied connections

[2:1.26.3-3]
- Resolves: RHEL-144454 - Clarify binding behavior of -t option


_______________________________________________
El-errata mailing list
El-errata@oss.oracle.com
https://oss.oracle.com/mailman/listinfo/el-errata