RHSA-2026:36618HighCVSS 8.1

Red Hat Security Advisory: nginx:1.24 security, bug fix, and enhancement update

Published
July 8, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-42055 →

📋 Description

CVE-2026-42055 — nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers

🎯 Affected products68

  • Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.aarch64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.ppc64le (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.s390x (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.src (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.x86_64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-all-modules-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.noarch (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-core-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.aarch64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-core-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.ppc64le (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-core-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.s390x (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-core-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.x86_64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-core-debuginfo-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.aarch64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-core-debuginfo-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.ppc64le (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-core-debuginfo-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.s390x (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-core-debuginfo-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.x86_64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-debuginfo-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.aarch64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-debuginfo-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.ppc64le (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-debuginfo-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.s390x (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-debuginfo-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.x86_64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-debugsource-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.aarch64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-debugsource-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.ppc64le (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-debugsource-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.s390x (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-debugsource-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.x86_64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-filesystem-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.noarch (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-mod-devel-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.aarch64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-mod-devel-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.ppc64le (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-mod-devel-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.s390x (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-mod-devel-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.x86_64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-mod-http-image-filter-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.aarch64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-mod-http-image-filter-1:1.24.0-7.module+el9.8.0+24502+c9b9ab67.3.ppc64le (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • +38 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this vulnerability, ensure that the `ignore_invalid_headers` directive is set to `on` in your NGINX configuration, or reduce the size specified by the `large_client_header_buffers` directive to 2 megabytes or less. These changes require an NGINX service reload or restart to take effect. Reloading the NGINX service is generally safe, but a restart will briefly interrupt service.

🔗 References (4)