Oracle alert ELSA-2026-59496 (nginx:1.26)

From:
             
 
Errata Announcements for Oracle Linux via El-errata <el-errata@oss.oracle.com>
To:
             
 
el-errata@oss.oracle.com
Subject:
             
 
[El-errata] ELSA-2026-59496 Important: Oracle Linux 9 nginx:1.26 security update
Date:
             
 
Thu, 27 Aug 2026 04:16:57 -0700
Message-ID:
             
 
<mailman.134.1787829430.31.el-errata@oss.oracle.com>
Oracle Linux Security Advisory ELSA-2026-59496

http://linux.oracle.com/errata/ELSA-2026-59496.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

x86_64:
nginx-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.x86_64.rpm
nginx-all-modules-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.noarch.rpm
nginx-core-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.x86_64.rpm
nginx-filesystem-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.noarch.rpm
nginx-mod-devel-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.x86_64.rpm
nginx-mod-http-image-filter-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.x86_64.rpm
nginx-mod-http-perl-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.x86_64.rpm
nginx-mod-http-xslt-filter-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.x86_64.rpm
nginx-mod-mail-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.x86_64.rpm
nginx-mod-stream-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.x86_64.rpm

aarch64:
nginx-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.aarch64.rpm
nginx-all-modules-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.noarch.rpm
nginx-core-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.aarch64.rpm
nginx-filesystem-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.noarch.rpm
nginx-mod-devel-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.aarch64.rpm
nginx-mod-http-image-filter-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.aarch64.rpm
nginx-mod-http-perl-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.aarch64.rpm
nginx-mod-http-xslt-filter-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.aarch64.rpm
nginx-mod-mail-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.aarch64.rpm
nginx-mod-stream-1.26.3-9.0.1.module+el9.8.0+91002+d4b54b3d.3.aarch64.rpm


SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates/nginx-1.26.3-9.0....

Related CVEs:

CVE-2026-56434
CVE-2026-60005




Description of changes:

[1.26.3-9.0.1.3]
- Require oracle-indexhtml

[2:1.26.3-13]
- Fixes CVE-2026-56434 and CVE-2026-60005

[2:1.26.3-12]
- Resolves: RHEL-191774 - nginx: "HTTP/2 bomb" nginx fix breaks module ABI
  causing crashes

[2:1.26.3-11]
- nginx:1.26/nginx: HTTP/2: Remote Denial of Service via compression bomb
  and Slowloris-style attack

[2:1.26.3-10]
- nginx: code execution and denial of service (CVE-2026-9256)

[2:1.26.3-9]
- Resolves: RHEL-176218 - nginx:1.26/nginx: NGINX: Arbitrary Code Execution
  Vulnerability (CVE-2026-42945)

[2:1.26.3-8]
- CVE-2026-32647 nginx:1.26/nginx: NGINX: Denial of Service or Code
  Execution via specially crafted MP4 files

[2:1.26.3-7]
- CVE-2026-27651 nginx:1.26/nginx: NGINX: Denial of Service via undisclosed
  requests when ngx_mail_auth_http_module is enabled

[2:1.26.3-6]
- CVE-2026-27784 nginx:1.26/nginx: NGINX: Denial of Service due to memory
  corruption via crafted MP4 file

[2:1.26.3-5]
- CVE-2026-27654 nginx:1.26/nginx: NGINX: Denial of Service or file
  modification via buffer overflow in ngx_http_dav_module


_______________________________________________
El-errata mailing list
El-errata@oss.oracle.com
https://oss.oracle.com/mailman/listinfo/el-errata