RHSA-2026:36639HighCVSS 8.1

Red Hat Security Advisory: nginx:1.26 security, bug fix, and enhancement update

Published
July 8, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-42055 →

📋 Description

CVE-2026-42055 — nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers

🎯 Affected products68

  • Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.aarch64 (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.ppc64le (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.s390x (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.src (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64 (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-all-modules-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.noarch (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-core-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.aarch64 (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-core-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.ppc64le (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-core-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.s390x (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-core-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64 (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-core-debuginfo-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.aarch64 (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-core-debuginfo-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.ppc64le (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-core-debuginfo-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.s390x (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-core-debuginfo-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64 (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-debuginfo-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.aarch64 (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-debuginfo-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.ppc64le (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-debuginfo-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.s390x (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-debuginfo-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64 (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-debugsource-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.aarch64 (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-debugsource-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.ppc64le (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-debugsource-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.s390x (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-debugsource-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64 (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-filesystem-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.noarch (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-mod-devel-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.aarch64 (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-mod-devel-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.ppc64le (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-mod-devel-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.s390x (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-mod-devel-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64 (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-mod-http-image-filter-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.aarch64 (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • nginx-mod-http-image-filter-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.ppc64le (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • +38 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this vulnerability, ensure that the `ignore_invalid_headers` directive is set to `on` in your NGINX configuration, or reduce the size specified by the `large_client_header_buffers` directive to 2 megabytes or less. These changes require an NGINX service reload or restart to take effect. Reloading the NGINX service is generally safe, but a restart will briefly interrupt service.

🔗 References (4)