[CLSA-2026:1790072954] nginx: Fix of CVE-2026-42946
Type:
security
Severity:
Important
Release date:
2026-09-22 10:29:24 UTC
Description:
- CVE-2026-42946: reset the status-line parser state on fallback so scgi and uwsgi header parsing can't alias into a leftover FSM state and leak worker memory into response headers
CVEs fixed:
Updated packages:
  • nginx-1.14.1-9.module_el8+2578+a5ed698f.tuxcare.els16.x86_64.rpm
    sha:97db0b0e351b588c7a6c6f68dbaa0da2211f3e1dcbd89d3e6210fecbf98c0b9f
  • nginx-all-modules-1.14.1-9.module_el8+2578+a5ed698f.tuxcare.els16.noarch.rpm
    sha:0c0db571b31546342e895412bbd24f97ec25d3caa7d0166b4da36f375986b376
  • nginx-filesystem-1.14.1-9.module_el8+2578+a5ed698f.tuxcare.els16.noarch.rpm
    sha:db66735ddcdfe862f8f49dcb2aa61c4e0cbf40e9c2f1a428ef703d420ee4a768
  • nginx-mod-http-image-filter-1.14.1-9.module_el8+2578+a5ed698f.tuxcare.els16.x86_64.rpm
    sha:52627e1b045e4a1e68202f1bcc8240433fc92f4aa7803ffe049f20abb38e1f4e
  • nginx-mod-http-perl-1.14.1-9.module_el8+2578+a5ed698f.tuxcare.els16.x86_64.rpm
    sha:fad5a5ddf41fcb367eab337b6281b705901646cfa82fe6aaf77d146bb4e7ad09
  • nginx-mod-http-xslt-filter-1.14.1-9.module_el8+2578+a5ed698f.tuxcare.els16.x86_64.rpm
    sha:58bf9ecc9e8a7989d2b3bba72e1d89bfdd641699248d6b2afdb9337be4a95197
  • nginx-mod-mail-1.14.1-9.module_el8+2578+a5ed698f.tuxcare.els16.x86_64.rpm
    sha:bb6929202c3ef9ccdff706d06db3b0abe950f00e44cf3ca14ed057a199abbedd
  • nginx-mod-stream-1.14.1-9.module_el8+2578+a5ed698f.tuxcare.els16.x86_64.rpm
    sha:f2948e00e292037c20e6d3c4a6914a6355e1778e1aa737dc2bbcdfa4f7f62a18
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.