RHSA-2026:38847HighCVSS 8.1

Red Hat Security Advisory: nginx:1.24 security, bug fix, and enhancement update

Published
July 13, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-42055 →

📋 Description

CVE-2026-42055 — nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers

🎯 Affected products60

  • Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.aarch64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.ppc64le (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.s390x (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.src (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.x86_64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-all-modules-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.noarch (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-debuginfo-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.aarch64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-debuginfo-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.ppc64le (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-debuginfo-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.s390x (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-debuginfo-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.x86_64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-debugsource-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.aarch64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-debugsource-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.ppc64le (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-debugsource-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.s390x (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-debugsource-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.x86_64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-filesystem-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.noarch (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-mod-devel-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.aarch64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-mod-devel-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.ppc64le (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-mod-devel-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.s390x (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-mod-devel-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.x86_64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-mod-http-image-filter-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.aarch64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-mod-http-image-filter-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.ppc64le (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-mod-http-image-filter-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.s390x (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-mod-http-image-filter-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.x86_64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-mod-http-image-filter-debuginfo-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.aarch64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-mod-http-image-filter-debuginfo-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.ppc64le (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-mod-http-image-filter-debuginfo-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.s390x (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-mod-http-image-filter-debuginfo-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.x86_64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-mod-http-perl-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.aarch64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • nginx-mod-http-perl-1:1.24.0-3.module+el8.10.0+24503+61c7c092.3.ppc64le (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • +30 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this vulnerability, ensure that the `ignore_invalid_headers` directive is set to `on` in your NGINX configuration, or reduce the size specified by the `large_client_header_buffers` directive to 2 megabytes or less. These changes require an NGINX service reload or restart to take effect. Reloading the NGINX service is generally safe, but a restart will briefly interrupt service.

🔗 References (4)