elsa-2026-36364

oracle_linux
Description

[1.26.3-6.0.1.el10_2.5] - Reference oracle-indexhtml within Requires [Orabug: 33802044] [2:1.26.3-6.5] - Resolves: RHEL-191778 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI causing crashes - Resolves: RHEL-188402 - nginx: NGINX: Arbitrary code execution or. Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers (CVE-2026-42055) [2:1.26.3-6.4] - Resolves: RHEL-178669 - nginx: code execution and denial of service (CVE-2026-9256) - Resolves: RHEL-182544 - nginx: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack [2:1.26.3-6.3] - Resolves: RHEL-176231 - nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945) [2:1.26.3-6.2] - rebuild for the right candidate tag [2:1.26.3-6.1] - RHEL-159547 CVE-2026-27654 nginx: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module - RHEL-159526 CVE-2026-27784 nginx: NGINX: Denial of Service due to memory corruption via crafted MP4 file - RHEL-159434 CVE-2026-27651 nginx: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled - RHEL-157875 CVE-2026-32647 nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files

Timeline
Published
unknown
Last Modified
unknown
CVSS Details

CVSS details not available.

Affected Products

No product information available.

References

No references available.

Linked Vulnerabilities

No linked vulnerabilities found.

{
  "cves": [
    "CVE-2026-42055"
  ],
  "cvss": 0.0,
  "database_specific": {
    "severity": "IMPORTANT"
  },
  "description": "[1.26.3-6.0.1.el10_2.5]\n- Reference oracle-indexhtml within Requires [Orabug: 33802044]\n\n[2:1.26.3-6.5]\n- Resolves: RHEL-191778 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI\n  causing crashes\n- Resolves: RHEL-188402 - nginx: NGINX: Arbitrary code execution or.\n  Denial of Service via heap-based buffer overflow with crafted HTTP/2\n  headers (CVE-2026-42055)\n\n[2:1.26.3-6.4]\n- Resolves: RHEL-178669 - nginx: code execution and denial of\n  service (CVE-2026-9256)\n- Resolves: RHEL-182544 - nginx: HTTP/2: Remote Denial of Service via\n  compression bomb and Slowloris-style attack\n\n[2:1.26.3-6.3]\n- Resolves: RHEL-176231 - nginx: NGINX: Arbitrary Code Execution\n  Vulnerability (CVE-2026-42945)\n\n[2:1.26.3-6.2]\n- rebuild for the right candidate tag\n\n[2:1.26.3-6.1]\n- RHEL-159547 CVE-2026-27654 nginx: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module\n- RHEL-159526 CVE-2026-27784 nginx: NGINX: Denial of Service due to memory corruption via crafted MP4 file\n- RHEL-159434 CVE-2026-27651 nginx: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled\n- RHEL-157875 CVE-2026-32647 nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files",
  "id": "ELSA-2026-36364",
  "ovalId": "oval:com.oracle.elsa:def:202636364",
  "source": "oracle_linux",
  "title": "ELSA-2026-36364:  nginx security, bug fix, and enhancement update (IMPORTANT)",
  "url": "https://linux.oracle.com/errata/ELSA-2026-36364.html"
}
View JSON API Download JSON