{"id":"CVE-2026-15176","aliases":["ALPINE-CVE-2026-15176","AZL-108446","BELL-CVE-2026-15176","BIT-nginx-2026-15176","BIT-nginx-gateway-2026-15176","CLSA-2026-1792146840","CLSA-2026-1792164102","CLSA-2026-1792164686","CLSA-2026-1792165116","CLSA-2026-1792170794","CLSA-2026-1792426319","CLSA-2026-1792487559","CLSA-2026-1792579760","CLSA-2026-1792580147","CLSA-2026-1792580871","CLSA-2026-1792770638","CLSA-2026-1792798495","DEBIAN-CVE-2026-15176","EUVD-2026-101112","GHSA-cvv4-j4mx-w8q5","OESA-2026-4543","OESA-2026-4544","OESA-2026-4545","OESA-2026-4546","RHSA-2026:83427","RLSA-2026:98671","ROOT-OS-ALPINE-315-CVE-2026-15176","ROOT-OS-ALPINE-321-CVE-2026-15176","ROOT-OS-ALPINE-323-CVE-2026-15176","ROOT-OS-DEBIAN-12-CVE-2026-15176","ROOT-OS-DEBIAN-13-CVE-2026-15176","UBUNTU-CVE-2026-15176","USN-8955-1","USN-8955-2","openSUSE-SU-2026:12143-1"],"status":"published","title":"NGINX ngx_http_core_module vulnerability","description":"A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","severity":{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00998,"percentile":0.63169,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-122"],"published":"2026-10-14T14:40:26Z","modified":"2026-11-11T12:45:02Z","exploits":[{"source":"pocgithub","id":"FranklinF25/cve-2026-15176","title":"FranklinF25/cve-2026-15176","date":"2026-10-27","url":"https://github.com/FranklinF25/cve-2026-15176"}],"fixes":[{"ecosystem":"Alpine:v3.24","package":"nginx","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"nginx","fixed_in":["1.30.6-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"nginx","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"nginx-base","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"nginx","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"nginx-base","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nginx","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nginx-base","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"nginx-base","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"nginx-base","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"nginx-base","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"nginx","fixed_in":["1.30.6","1.31.7"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"nginx-gateway","fixed_in":["1.30.6","1.31.7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx","fixed_in":["2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-all-modules","fixed_in":["2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-core","fixed_in":["2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-filesystem","fixed_in":["2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-devel","fixed_in":["2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-http-image-filter","fixed_in":["2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-http-perl","fixed_in":["2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-http-xslt-filter","fixed_in":["2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-mail","fixed_in":["2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-stream","fixed_in":["2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"nginx","fixed_in":["1:1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"nginx-all-modules","fixed_in":["1:1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"nginx-filesystem","fixed_in":["1:1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"nginx-mod-http-image-filter","fixed_in":["1:1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"nginx-mod-http-perl","fixed_in":["1:1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"nginx-mod-http-xslt-filter","fixed_in":["1:1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"nginx-mod-mail","fixed_in":["1:1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"nginx-mod-stream","fixed_in":["1:1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"nginx","fixed_in":["1:1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"nginx-all-modules","fixed_in":["1:1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"nginx-filesystem","fixed_in":["1:1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"nginx-mod-http-image-filter","fixed_in":["1:1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"nginx-mod-http-perl","fixed_in":["1:1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"nginx-mod-http-xslt-filter","fixed_in":["1:1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"nginx-mod-mail","fixed_in":["1:1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"nginx-mod-stream","fixed_in":["1:1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"nginx","fixed_in":["1:1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"nginx-all-modules","fixed_in":["1:1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"nginx-filesystem","fixed_in":["1:1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"nginx-mod-http-image-filter","fixed_in":["1:1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"nginx-mod-http-perl","fixed_in":["1:1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"nginx-mod-http-xslt-filter","fixed_in":["1:1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"nginx-mod-mail","fixed_in":["1:1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"nginx-mod-stream","fixed_in":["1:1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx","fixed_in":["1:1.20.1-14.el9_2.1.alma.1.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-all-modules","fixed_in":["1:1.20.1-14.el9_2.1.alma.1.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-core","fixed_in":["1:1.20.1-14.el9_2.1.alma.1.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-filesystem","fixed_in":["1:1.20.1-14.el9_2.1.alma.1.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-devel","fixed_in":["1:1.20.1-14.el9_2.1.alma.1.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-http-image-filter","fixed_in":["1:1.20.1-14.el9_2.1.alma.1.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-http-perl","fixed_in":["1:1.20.1-14.el9_2.1.alma.1.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-http-xslt-filter","fixed_in":["1:1.20.1-14.el9_2.1.alma.1.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-mail","fixed_in":["1:1.20.1-14.el9_2.1.alma.1.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-stream","fixed_in":["1:1.20.1-14.el9_2.1.alma.1.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx","fixed_in":["1.10.3-0ubuntu0.16.04.8+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-common","fixed_in":["1.10.3-0ubuntu0.16.04.8+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-core","fixed_in":["1.10.3-0ubuntu0.16.04.8+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-doc","fixed_in":["1.10.3-0ubuntu0.16.04.8+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-extras","fixed_in":["1.10.3-0ubuntu0.16.04.8+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-full","fixed_in":["1.10.3-0ubuntu0.16.04.8+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-light","fixed_in":["1.10.3-0ubuntu0.16.04.8+tuxcare.els12"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"nginx","fixed_in":["1:1.20.1-10.el7.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"nginx-all-modules","fixed_in":["1:1.20.1-10.el7.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"nginx-filesystem","fixed_in":["1:1.20.1-10.el7.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"nginx-mod-devel","fixed_in":["1:1.20.1-10.el7.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"nginx-mod-http-image-filter","fixed_in":["1:1.20.1-10.el7.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"nginx-mod-http-perl","fixed_in":["1:1.20.1-10.el7.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"nginx-mod-http-xslt-filter","fixed_in":["1:1.20.1-10.el7.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"nginx-mod-mail","fixed_in":["1:1.20.1-10.el7.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"nginx-mod-stream","fixed_in":["1:1.20.1-10.el7.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"nginx","fixed_in":["1:1.20.1-10.el7.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"nginx-all-modules","fixed_in":["1:1.20.1-10.el7.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"nginx-filesystem","fixed_in":["1:1.20.1-10.el7.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"nginx-mod-devel","fixed_in":["1:1.20.1-10.el7.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"nginx-mod-http-image-filter","fixed_in":["1:1.20.1-10.el7.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"nginx-mod-http-perl","fixed_in":["1:1.20.1-10.el7.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"nginx-mod-http-xslt-filter","fixed_in":["1:1.20.1-10.el7.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"nginx-mod-mail","fixed_in":["1:1.20.1-10.el7.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"nginx-mod-stream","fixed_in":["1:1.20.1-10.el7.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"nginx","fixed_in":["1:1.20.1-10.el7.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"nginx-all-modules","fixed_in":["1:1.20.1-10.el7.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"nginx-filesystem","fixed_in":["1:1.20.1-10.el7.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"nginx-mod-devel","fixed_in":["1:1.20.1-10.el7.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"nginx-mod-http-image-filter","fixed_in":["1:1.20.1-10.el7.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"nginx-mod-http-perl","fixed_in":["1:1.20.1-10.el7.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"nginx-mod-http-xslt-filter","fixed_in":["1:1.20.1-10.el7.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"nginx-mod-mail","fixed_in":["1:1.20.1-10.el7.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"nginx-mod-stream","fixed_in":["1:1.20.1-10.el7.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-auth-pam","fixed_in":["1.14.2-2+deb10u5+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-cache-purge","fixed_in":["1.14.2-2+deb10u5+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-dav-ext","fixed_in":["1.14.2-2+deb10u5+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-echo","fixed_in":["1.14.2-2+deb10u5+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-fancyindex","fixed_in":["1.14.2-2+deb10u5+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-geoip","fixed_in":["1.14.2-2+deb10u5+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-headers-more-filter","fixed_in":["1.14.2-2+deb10u5+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-image-filter","fixed_in":["1.14.2-2+deb10u5+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-lua","fixed_in":["1.14.2-2+deb10u5+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-ndk","fixed_in":["1.14.2-2+deb10u5+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-perl","fixed_in":["1.14.2-2+deb10u5+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-subs-filter","fixed_in":["1.14.2-2+deb10u5+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-uploadprogress","fixed_in":["1.14.2-2+deb10u5+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-upstream-fair","fixed_in":["1.14.2-2+deb10u5+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-xslt-filter","fixed_in":["1.14.2-2+deb10u5+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-mail","fixed_in":["1.14.2-2+deb10u5+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-nchan","fixed_in":["1.14.2-2+deb10u5+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-rtmp","fixed_in":["1.14.2-2+deb10u5+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-stream","fixed_in":["1.14.2-2+deb10u5+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"nginx","fixed_in":["1.14.2-2+deb10u5+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"nginx-common","fixed_in":["1.14.2-2+deb10u5+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"nginx-doc","fixed_in":["1.14.2-2+deb10u5+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"nginx-extras","fixed_in":["1.14.2-2+deb10u5+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"nginx-full","fixed_in":["1.14.2-2+deb10u5+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"nginx-light","fixed_in":["1.14.2-2+deb10u5+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-auth-pam","fixed_in":["1.14.0-0ubuntu1.11+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-cache-purge","fixed_in":["1.14.0-0ubuntu1.11+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-dav-ext","fixed_in":["1.14.0-0ubuntu1.11+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-echo","fixed_in":["1.14.0-0ubuntu1.11+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-fancyindex","fixed_in":["1.14.0-0ubuntu1.11+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-geoip","fixed_in":["1.14.0-0ubuntu1.11+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-headers-more-filter","fixed_in":["1.14.0-0ubuntu1.11+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-image-filter","fixed_in":["1.14.0-0ubuntu1.11+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-lua","fixed_in":["1.14.0-0ubuntu1.11+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-ndk","fixed_in":["1.14.0-0ubuntu1.11+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-perl","fixed_in":["1.14.0-0ubuntu1.11+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-subs-filter","fixed_in":["1.14.0-0ubuntu1.11+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-uploadprogress","fixed_in":["1.14.0-0ubuntu1.11+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-upstream-fair","fixed_in":["1.14.0-0ubuntu1.11+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-xslt-filter","fixed_in":["1.14.0-0ubuntu1.11+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-mail","fixed_in":["1.14.0-0ubuntu1.11+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-nchan","fixed_in":["1.14.0-0ubuntu1.11+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-rtmp","fixed_in":["1.14.0-0ubuntu1.11+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-stream","fixed_in":["1.14.0-0ubuntu1.11+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"nginx","fixed_in":["1.14.0-0ubuntu1.11+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"nginx-common","fixed_in":["1.14.0-0ubuntu1.11+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"nginx-core","fixed_in":["1.14.0-0ubuntu1.11+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"nginx-doc","fixed_in":["1.14.0-0ubuntu1.11+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"nginx-extras","fixed_in":["1.14.0-0ubuntu1.11+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"nginx-full","fixed_in":["1.14.0-0ubuntu1.11+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"nginx-light","fixed_in":["1.14.0-0ubuntu1.11+tuxcare.els10"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nginx","fixed_in":["1.26.3-3+deb13u10"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nginx","fixed_in":["1.30.4-8"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"nginx","fixed_in":["1.20.2-r20075","1.20.2-r20076","1.20.2-r20077"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"rootio-nginx","fixed_in":["1.20.2-r20075","1.20.2-r20076","1.20.2-r20077"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.21","package":"nginx","fixed_in":["1.26.3-r30073","1.26.3-r30074"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.21","package":"rootio-nginx","fixed_in":["1.26.3-r30073","1.26.3-r30074"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.23","package":"nginx","fixed_in":["1.28.3-r70071"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.23","package":"rootio-nginx","fixed_in":["1.28.3-r70071"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"nginx","fixed_in":["1.22.1-9+deb12u10.aikido.11"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-nginx","fixed_in":["1.22.1-9+deb12u10.aikido.11"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nginx","fixed_in":["1.4.6-1ubuntu3.9+esm9"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nginx","fixed_in":["1.10.3-0ubuntu0.16.04.5+esm10"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nginx","fixed_in":["1.14.0-0ubuntu1.11+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"nginx","fixed_in":["1.18.0-0ubuntu1.7+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"nginx","fixed_in":["1.18.0-6ubuntu14.22"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"nginx","fixed_in":["1.24.0-2ubuntu7.19"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"nginx","fixed_in":["1.30.4-7ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"nginx","fixed_in":["1.28.3-2ubuntu1.12"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.6-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.22.1-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"nginx-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.3-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.28.0-r3"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"nginx-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.3-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.22.1-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nginx-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.3-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"nginx-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.3-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"nginx-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.3-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"nginx-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.3-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"nginx","ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.29"},{"fixed":"1.30.6"},{"introduced":"1.31.0"},{"fixed":"1.31.7"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"nginx-gateway","ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.29"},{"fixed":"1.30.6"},{"introduced":"1.31.0"},{"fixed":"1.31.7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8+2705+d3744b1b.tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.4.0+2703+1c15d4d0.tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.5.0+2704+f6f6e08b.tuxcare.els17"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-full","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-light","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8+tuxcare.els12"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libnginx-mod-http-auth-pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libnginx-mod-http-cache-purge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libnginx-mod-http-dav-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libnginx-mod-http-echo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libnginx-mod-http-fancyindex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libnginx-mod-http-geoip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libnginx-mod-http-geoip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libnginx-mod-http-headers-more-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libnginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libnginx-mod-http-lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libnginx-mod-http-ndk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libnginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libnginx-mod-http-subs-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libnginx-mod-http-uploadprogress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libnginx-mod-http-upstream-fair","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libnginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libnginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libnginx-mod-nchan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libnginx-mod-rtmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libnginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"nginx-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"nginx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"nginx-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"nginx-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"nginx-full","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"nginx-light","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-10.el7.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-10.el7.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-10.el7.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"nginx-mod-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-10.el7.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-10.el7.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-10.el7.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-10.el7.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-10.el7.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-10.el7.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-10.el7.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-10.el7.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-10.el7.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"nginx-mod-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-10.el7.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-10.el7.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-10.el7.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-10.el7.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-10.el7.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-10.el7.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-10.el7.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-10.el7.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-10.el7.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"nginx-mod-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-10.el7.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-10.el7.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-10.el7.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-10.el7.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-10.el7.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-10.el7.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-auth-pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-2+deb10u5+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-cache-purge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-2+deb10u5+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-dav-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-2+deb10u5+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-echo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-2+deb10u5+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-fancyindex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-2+deb10u5+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-geoip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-2+deb10u5+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-headers-more-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-2+deb10u5+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-2+deb10u5+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-2+deb10u5+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-ndk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-2+deb10u5+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-2+deb10u5+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-subs-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-2+deb10u5+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-uploadprogress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-2+deb10u5+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-upstream-fair","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-2+deb10u5+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-2+deb10u5+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-2+deb10u5+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-nchan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-2+deb10u5+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-rtmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-2+deb10u5+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libnginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-2+deb10u5+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-2+deb10u5+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"nginx-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-2+deb10u5+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"nginx-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-2+deb10u5+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"nginx-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-2+deb10u5+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"nginx-full","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-2+deb10u5+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"nginx-light","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-2+deb10u5+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-auth-pam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-cache-purge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-dav-ext","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-echo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-fancyindex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-geoip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-headers-more-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-ndk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-subs-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-uploadprogress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-upstream-fair","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-nchan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-rtmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libnginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"nginx-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"nginx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"nginx-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"nginx-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"nginx-full","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"nginx-light","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+tuxcare.els10"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.1-9","1.22.1-9+deb12u1","1.22.1-9+deb12u10","1.22.1-9+deb12u2","1.22.1-9+deb12u3","1.22.1-9+deb12u4","1.22.1-9+deb12u5","1.22.1-9+deb12u6","1.22.1-9+deb12u7","1.22.1-9+deb12u8","1.22.1-9+deb12u9","1.24.0-1","1.24.0-1~exp1","1.24.0-2","1.26.0-1","1.26.0-1~exp1","1.26.0-2","1.26.0-3","1.26.2-1","1.26.3-1","1.26.3-2","1.26.3-3","1.28.0-1","1.28.0-2","1.28.0-3","1.28.0-4","1.28.0-5","1.28.0-6","1.28.1-1","1.28.1-2","1.28.1-3","1.28.2-1","1.28.2-2","1.28.2-3","1.28.2-4","1.28.3-1","1.28.3-2","1.30.0-1","1.30.0-2","1.30.0-3","1.30.0-4","1.30.1-1","1.30.1-2","1.30.1-3","1.30.1-4","1.30.1-5","1.30.1-6","1.30.1-7","1.30.4-1","1.30.4-2","1.30.4-3","1.30.4-4","1.30.4-5","1.30.4-6","1.30.4-7","1.30.4-8","1.30.6-1","1.30.6-2"]},{"source":"osv","ecosystem":"Debian:13","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.3-3+deb13u10"}]}],"versions":["1.26.3-3","1.26.3-3+deb13u1","1.26.3-3+deb13u2","1.26.3-3+deb13u3","1.26.3-3+deb13u4","1.26.3-3+deb13u5","1.26.3-3+deb13u6","1.26.3-3+deb13u7","1.26.3-3+deb13u8","1.26.3-3+deb13u9"]},{"source":"osv","ecosystem":"Debian:14","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4-8"}]}],"versions":["1.26.3-3","1.28.0-1","1.28.0-2","1.28.0-3","1.28.0-4","1.28.0-5","1.28.0-6","1.28.1-1","1.28.1-2","1.28.1-3","1.28.2-1","1.28.2-2","1.28.2-3","1.28.2-4","1.28.3-1","1.28.3-2","1.30.0-1","1.30.0-2","1.30.0-3","1.30.0-4","1.30.1-1","1.30.1-2","1.30.1-3","1.30.1-4","1.30.1-5","1.30.1-6","1.30.1-7","1.30.4-1","1.30.4-2","1.30.4-3","1.30.4-4","1.30.4-5","1.30.4-6","1.30.4-7"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-20.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-16.oe2403sp1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-15.oe2403sp3"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-15.oe2403sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-geoip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-stream-geoip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.24.0-3.module+el8.10.0+40298+8ed65491.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.24.0-3.module+el8.10.0+40318+42d32d22.5"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.24.0-3.module+el8.10.0+40144+38158758"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.24.0-3.module+el8.10.0+40187+52bedf24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.24.0-3.module+el8.10.0+40220+e6a4bcb0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.24.0-3.module+el8.10.0+40249+a5ea815d.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.2-r20075"},{"fixed":"1.20.2-r20076"},{"fixed":"1.20.2-r20077"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"rootio-nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.2-r20075"},{"fixed":"1.20.2-r20076"},{"fixed":"1.20.2-r20077"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.21","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.3-r30073"},{"fixed":"1.26.3-r30074"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.21","package":"rootio-nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.3-r30073"},{"fixed":"1.26.3-r30074"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.23","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.3-r70071"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.23","package":"rootio-nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.3-r70071"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.1-9+deb12u10.aikido.11"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.1-9+deb12u10.aikido.11"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-1ubuntu3.9+esm9"}]}],"versions":["1.4.1-3ubuntu1","1.4.3-2ubuntu1","1.4.4-1ubuntu1","1.4.4-2ubuntu1","1.4.4-4ubuntu1","1.4.5-1ubuntu1","1.4.6-1ubuntu2","1.4.6-1ubuntu3","1.4.6-1ubuntu3.1","1.4.6-1ubuntu3.2","1.4.6-1ubuntu3.3","1.4.6-1ubuntu3.4","1.4.6-1ubuntu3.5","1.4.6-1ubuntu3.6","1.4.6-1ubuntu3.7","1.4.6-1ubuntu3.8","1.4.6-1ubuntu3.9","1.4.6-1ubuntu3.9+esm1","1.4.6-1ubuntu3.9+esm2","1.4.6-1ubuntu3.9+esm3","1.4.6-1ubuntu3.9+esm4","1.4.6-1ubuntu3.9+esm5","1.4.6-1ubuntu3.9+esm6","1.4.6-1ubuntu3.9+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.5+esm10"}]}],"versions":["1.9.3-1ubuntu1","1.9.6-2ubuntu1","1.9.6-2ubuntu2","1.9.9-0ubuntu1","1.9.9-1ubuntu1","1.9.10-0ubuntu1","1.9.10-1ubuntu1","1.9.11-0ubuntu1","1.9.11-0ubuntu2","1.9.12-0ubuntu1","1.9.13-0ubuntu1","1.9.14-0ubuntu1","1.9.15-0ubuntu1","1.10.0-0ubuntu0.16.04.1","1.10.0-0ubuntu0.16.04.2","1.10.0-0ubuntu0.16.04.3","1.10.0-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.1","1.10.3-0ubuntu0.16.04.2","1.10.3-0ubuntu0.16.04.3","1.10.3-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.5","1.10.3-0ubuntu0.16.04.5+esm1","1.10.3-0ubuntu0.16.04.5+esm2","1.10.3-0ubuntu0.16.04.5+esm3","1.10.3-0ubuntu0.16.04.5+esm4","1.10.3-0ubuntu0.16.04.5+esm5","1.10.3-0ubuntu0.16.04.5+esm6","1.10.3-0ubuntu0.16.04.5+esm7","1.10.3-0ubuntu0.16.04.5+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+esm5"}]}],"versions":["1.12.1-0ubuntu2","1.13.6-2ubuntu1","1.13.6-2ubuntu2","1.13.10-1ubuntu1","1.13.12-0ubuntu1","1.14.0-0ubuntu1","1.14.0-0ubuntu1.1","1.14.0-0ubuntu1.2","1.14.0-0ubuntu1.3","1.14.0-0ubuntu1.4","1.14.0-0ubuntu1.5","1.14.0-0ubuntu1.6","1.14.0-0ubuntu1.7","1.14.0-0ubuntu1.9","1.14.0-0ubuntu1.10","1.14.0-0ubuntu1.11","1.14.0-0ubuntu1.11+esm1","1.14.0-0ubuntu1.11+esm2","1.14.0-0ubuntu1.11+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+esm4"}]}],"versions":["1.16.1-0ubuntu2","1.16.1-0ubuntu3","1.17.5-0ubuntu1","1.17.6-0ubuntu1","1.17.7-0ubuntu1","1.17.8-0ubuntu1","1.17.8-0ubuntu2","1.17.8-0ubuntu3","1.17.9-0ubuntu1","1.17.9-0ubuntu2","1.17.9-0ubuntu3","1.17.10-0ubuntu1","1.18.0-0ubuntu1","1.18.0-0ubuntu1.2","1.18.0-0ubuntu1.3","1.18.0-0ubuntu1.4","1.18.0-0ubuntu1.5","1.18.0-0ubuntu1.6","1.18.0-0ubuntu1.7","1.18.0-0ubuntu1.7+esm1","1.18.0-0ubuntu1.7+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-6ubuntu14.22"}]}],"versions":["1.18.0-6ubuntu11","1.18.0-6ubuntu12","1.18.0-6ubuntu14","1.18.0-6ubuntu14.1","1.18.0-6ubuntu14.2","1.18.0-6ubuntu14.3","1.18.0-6ubuntu14.4","1.18.0-6ubuntu14.5","1.18.0-6ubuntu14.6","1.18.0-6ubuntu14.7","1.18.0-6ubuntu14.8","1.18.0-6ubuntu14.10","1.18.0-6ubuntu14.11","1.18.0-6ubuntu14.12","1.18.0-6ubuntu14.13","1.18.0-6ubuntu14.14","1.18.0-6ubuntu14.15","1.18.0-6ubuntu14.16","1.18.0-6ubuntu14.17","1.18.0-6ubuntu14.18","1.18.0-6ubuntu14.19","1.18.0-6ubuntu14.20","1.18.0-6ubuntu14.21"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-2ubuntu7.19"}]}],"versions":["1.24.0-1ubuntu1","1.24.0-2ubuntu1","1.24.0-2ubuntu2","1.24.0-2ubuntu3","1.24.0-2ubuntu4","1.24.0-2ubuntu6","1.24.0-2ubuntu7","1.24.0-2ubuntu7.1","1.24.0-2ubuntu7.3","1.24.0-2ubuntu7.4","1.24.0-2ubuntu7.5","1.24.0-2ubuntu7.6","1.24.0-2ubuntu7.7","1.24.0-2ubuntu7.8","1.24.0-2ubuntu7.9","1.24.0-2ubuntu7.10","1.24.0-2ubuntu7.11","1.24.0-2ubuntu7.12","1.24.0-2ubuntu7.13","1.24.0-2ubuntu7.14","1.24.0-2ubuntu7.15","1.24.0-2ubuntu7.16","1.24.0-2ubuntu7.17","1.24.0-2ubuntu7.18"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4-7ubuntu1.1"}]}],"versions":["1.28.3-2ubuntu1","1.30.1-4ubuntu1","1.30.1-6ubuntu1","1.30.4-5ubuntu1","1.30.4-7ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.3-2ubuntu1.12"}]}],"versions":["1.28.0-6ubuntu1","1.28.1-2ubuntu1","1.28.1-3ubuntu1","1.28.2-2ubuntu1","1.28.3-2ubuntu1","1.28.3-2ubuntu1.1","1.28.3-2ubuntu1.2","1.28.3-2ubuntu1.3","1.28.3-2ubuntu1.4","1.28.3-2ubuntu1.5","1.28.3-2ubuntu1.6","1.28.3-2ubuntu1.7","1.28.3-2ubuntu1.8","1.28.3-2ubuntu1.9","1.28.3-2ubuntu1.10","1.28.3-2ubuntu1.11"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-6ubuntu14.22"}]}],"versions":["1.18.0-6ubuntu11","1.18.0-6ubuntu12","1.18.0-6ubuntu14","1.18.0-6ubuntu14.1","1.18.0-6ubuntu14.2","1.18.0-6ubuntu14.3","1.18.0-6ubuntu14.4","1.18.0-6ubuntu14.5","1.18.0-6ubuntu14.6","1.18.0-6ubuntu14.7","1.18.0-6ubuntu14.8","1.18.0-6ubuntu14.10","1.18.0-6ubuntu14.11","1.18.0-6ubuntu14.12","1.18.0-6ubuntu14.13","1.18.0-6ubuntu14.14","1.18.0-6ubuntu14.15","1.18.0-6ubuntu14.16","1.18.0-6ubuntu14.17","1.18.0-6ubuntu14.18","1.18.0-6ubuntu14.19","1.18.0-6ubuntu14.20","1.18.0-6ubuntu14.21"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-2ubuntu7.19"}]}],"versions":["1.24.0-1ubuntu1","1.24.0-2ubuntu1","1.24.0-2ubuntu2","1.24.0-2ubuntu3","1.24.0-2ubuntu4","1.24.0-2ubuntu6","1.24.0-2ubuntu7","1.24.0-2ubuntu7.1","1.24.0-2ubuntu7.3","1.24.0-2ubuntu7.4","1.24.0-2ubuntu7.5","1.24.0-2ubuntu7.6","1.24.0-2ubuntu7.7","1.24.0-2ubuntu7.8","1.24.0-2ubuntu7.9","1.24.0-2ubuntu7.10","1.24.0-2ubuntu7.11","1.24.0-2ubuntu7.12","1.24.0-2ubuntu7.13","1.24.0-2ubuntu7.14","1.24.0-2ubuntu7.15","1.24.0-2ubuntu7.16","1.24.0-2ubuntu7.17","1.24.0-2ubuntu7.18"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4-7ubuntu1.1"}]}],"versions":["1.28.3-2ubuntu1","1.30.1-4ubuntu1","1.30.1-6ubuntu1","1.30.4-5ubuntu1","1.30.4-7ubuntu1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.3-2ubuntu1.12"}]}],"versions":["1.28.0-6ubuntu1","1.28.1-2ubuntu1","1.28.1-3ubuntu1","1.28.2-2ubuntu1","1.28.3-2ubuntu1","1.28.3-2ubuntu1.1","1.28.3-2ubuntu1.2","1.28.3-2ubuntu1.3","1.28.3-2ubuntu1.4","1.28.3-2ubuntu1.5","1.28.3-2ubuntu1.6","1.28.3-2ubuntu1.7","1.28.3-2ubuntu1.8","1.28.3-2ubuntu1.9","1.28.3-2ubuntu1.10","1.28.3-2ubuntu1.11"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-1ubuntu3.9+esm9"}]}],"versions":["1.4.1-3ubuntu1","1.4.3-2ubuntu1","1.4.4-1ubuntu1","1.4.4-2ubuntu1","1.4.4-4ubuntu1","1.4.5-1ubuntu1","1.4.6-1ubuntu2","1.4.6-1ubuntu3","1.4.6-1ubuntu3.1","1.4.6-1ubuntu3.2","1.4.6-1ubuntu3.3","1.4.6-1ubuntu3.4","1.4.6-1ubuntu3.5","1.4.6-1ubuntu3.6","1.4.6-1ubuntu3.7","1.4.6-1ubuntu3.8","1.4.6-1ubuntu3.9","1.4.6-1ubuntu3.9+esm1","1.4.6-1ubuntu3.9+esm2","1.4.6-1ubuntu3.9+esm3","1.4.6-1ubuntu3.9+esm4","1.4.6-1ubuntu3.9+esm5","1.4.6-1ubuntu3.9+esm6","1.4.6-1ubuntu3.9+esm8"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.5+esm10"}]}],"versions":["1.9.3-1ubuntu1","1.9.6-2ubuntu1","1.9.6-2ubuntu2","1.9.9-0ubuntu1","1.9.9-1ubuntu1","1.9.10-0ubuntu1","1.9.10-1ubuntu1","1.9.11-0ubuntu1","1.9.11-0ubuntu2","1.9.12-0ubuntu1","1.9.13-0ubuntu1","1.9.14-0ubuntu1","1.9.15-0ubuntu1","1.10.0-0ubuntu0.16.04.1","1.10.0-0ubuntu0.16.04.2","1.10.0-0ubuntu0.16.04.3","1.10.0-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.1","1.10.3-0ubuntu0.16.04.2","1.10.3-0ubuntu0.16.04.3","1.10.3-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.5","1.10.3-0ubuntu0.16.04.5+esm1","1.10.3-0ubuntu0.16.04.5+esm2","1.10.3-0ubuntu0.16.04.5+esm3","1.10.3-0ubuntu0.16.04.5+esm4","1.10.3-0ubuntu0.16.04.5+esm5","1.10.3-0ubuntu0.16.04.5+esm6","1.10.3-0ubuntu0.16.04.5+esm7","1.10.3-0ubuntu0.16.04.5+esm9"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+esm5"}]}],"versions":["1.12.1-0ubuntu2","1.13.6-2ubuntu1","1.13.6-2ubuntu2","1.13.10-1ubuntu1","1.13.12-0ubuntu1","1.14.0-0ubuntu1","1.14.0-0ubuntu1.1","1.14.0-0ubuntu1.2","1.14.0-0ubuntu1.3","1.14.0-0ubuntu1.4","1.14.0-0ubuntu1.5","1.14.0-0ubuntu1.6","1.14.0-0ubuntu1.7","1.14.0-0ubuntu1.9","1.14.0-0ubuntu1.10","1.14.0-0ubuntu1.11","1.14.0-0ubuntu1.11+esm1","1.14.0-0ubuntu1.11+esm2","1.14.0-0ubuntu1.11+esm4"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+esm4"}]}],"versions":["1.16.1-0ubuntu2","1.16.1-0ubuntu3","1.17.5-0ubuntu1","1.17.6-0ubuntu1","1.17.7-0ubuntu1","1.17.8-0ubuntu1","1.17.8-0ubuntu2","1.17.8-0ubuntu3","1.17.9-0ubuntu1","1.17.9-0ubuntu2","1.17.9-0ubuntu3","1.17.10-0ubuntu1","1.18.0-0ubuntu1","1.18.0-0ubuntu1.2","1.18.0-0ubuntu1.3","1.18.0-0ubuntu1.4","1.18.0-0ubuntu1.5","1.18.0-0ubuntu1.6","1.18.0-0ubuntu1.7","1.18.0-0ubuntu1.7+esm1","1.18.0-0ubuntu1.7+esm3"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.7-1.1"}]}],"bundled":5}],"products":[{"vendor":"f5","product":"nginx open source"},{"vendor":"f5","product":"nginx plus"}],"references":[{"url":"https://my.f5.com/manage/s/article/K000162416","tags":["vendor-advisory","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15176","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-cvv4-j4mx-w8q5"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-15176","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-15176","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1792146840.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1792164102.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1792164686.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1792165116.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792170794.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1792426319.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1792487559.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56434","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1792579760.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792580147.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1792580871.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1792770638.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1792798495.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-15176","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4543","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93479","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97205","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4544","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97629","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4545","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4546","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:83427","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15176","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-97205","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-97629","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-95101","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83427.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2552352","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15176","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2552355","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-95101","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95101","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000162613","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2552359","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97205","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000162608","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2552364","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97629","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000162606","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:98671","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98671","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-15176","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8955-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8955-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-93479","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-95101","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97205","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97629","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-42533","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-95101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97629","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-15176","title":"NGINX ngx_http_core_module vulnerability","description":"A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T14:40:26.374Z","modified":"2026-10-15T10:31:15.809Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T13:47:51.033687Z"}],"euvd":[{"id":"EUVD-2026-101112","description":"A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T14:40:26Z","modified":"2026-10-15T10:31:15Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T17:00:15.076272Z"}],"ghsa":[{"id":"GHSA-cvv4-j4mx-w8q5","title":"A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that...","description":"A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T15:32:28Z","modified":"2026-10-14T15:32:38Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:13:26.117603Z"}],"nvd":[{"id":"CVE-2026-15176","description":"A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T15:17:19.14Z","modified":"2026-10-15T11:17:28.11Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:12:58.99337Z"}],"osv":[{"id":"ALPINE-CVE-2026-15176","description":"A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T15:17:19.14Z","modified":"2026-10-22T11:30:02.51000624Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2026-15176","status":"published","published":"2026-10-17T06:05:41.395901Z","modified":"2026-10-22T08:30:05.999164824Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"DEBIAN-CVE-2026-15176","description":"A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.     Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T15:17:19.14Z","modified":"2026-10-21T17:01:20.356161446Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"updated_at":"2026-11-02T15:45:52.562592Z"},{"id":"OESA-2026-4543","title":"nginx security update","description":"NGINX is a free, open-source, high-performance HTTP server and reverse proxy,  as well as an IMAP/POP3 proxy server.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-15176)\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map\u0026apos;s regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact: \nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-93479)\n\nNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-97205)","status":"published","published":"2026-10-29T09:02:45Z","modified":"2026-10-29T09:15:26.752222537Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4544","title":"nginx security update","description":"NGINX is a free, open-source, high-performance HTTP server and reverse proxy,  as well as an IMAP/POP3 proxy server.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-15176)\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map\u0026apos;s regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact: \nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-93479)\n\nNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-97205)\n\nDescription\nWhen NGINX Plus or NGINX Open Source is configured with ssl_session_cache \n\nshared:name:size\n\nwithout an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions \n\nin a non-deterministic manner that is beyond the attacker\u0026apos;s control. An attacker could leverage this vulnerability to bypass verification of client certificates.\n\nImpact\n\n\nThis vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-97629)","status":"published","published":"2026-10-29T09:02:46Z","modified":"2026-10-29T09:15:26.178757646Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4545","title":"nginx security update","description":"NGINX is a free, open-source, high-performance HTTP server and reverse proxy,  as well as an IMAP/POP3 proxy server.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-15176)\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map\u0026apos;s regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact: \nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-93479)\n\nNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-97205)\n\nDescription\nWhen NGINX Plus or NGINX Open Source is configured with ssl_session_cache \n\nshared:name:size\n\nwithout an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions \n\nin a non-deterministic manner that is beyond the attacker\u0026apos;s control. An attacker could leverage this vulnerability to bypass verification of client certificates.\n\nImpact\n\n\nThis vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-97629)","status":"published","published":"2026-10-29T09:02:46Z","modified":"2026-10-29T09:15:27.099239173Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4546","title":"nginx security update","description":"NGINX is a free, open-source, high-performance HTTP server and reverse proxy,  as well as an IMAP/POP3 proxy server.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-15176)\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map\u0026apos;s regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact: \nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-93479)\n\nNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-97205)\n\nDescription\nWhen NGINX Plus or NGINX Open Source is configured with ssl_session_cache \n\nshared:name:size\n\nwithout an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions \n\nin a non-deterministic manner that is beyond the attacker\u0026apos;s control. An attacker could leverage this vulnerability to bypass verification of client certificates.\n\nImpact\n\n\nThis vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-97629)","status":"published","published":"2026-10-29T09:02:47Z","modified":"2026-10-29T09:15:27.522745084Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"RHSA-2026:83427","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-16T10:27:21Z","modified":"2026-10-20T10:43:38.614397927Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:98671","title":"Important: nginx:1.24 security update","description":"nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. \n\nSecurity Fix(es):\n\n* nginx: nginx: heap-based buffer overflow in ngx_http_core_module via alias with rewrite referencing $request_filename (CVE-2026-15176)\n\n* nginx: NGINX ngx_http_core_module vulnerability (CVE-2026-97205)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-11T12:03:52.252275Z","modified":"2026-11-11T12:45:02.744319926Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"UBUNTU-CVE-2026-15176","description":"A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-15T00:00:00Z","modified":"2026-11-06T01:11:58.735583906Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-06T01:32:47.895286Z"},{"id":"AZL-108446","title":"CVE-2026-15176 affecting package nginx for versions less than 1.30.6-1","description":"A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T15:17:19Z","modified":"2026-11-02T14:16:57.183654716Z","updated_at":"2026-11-02T15:28:01.725816Z"},{"id":"BIT-nginx-2026-15176","title":"NGINX ngx_http_core_module vulnerability","description":"A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-21T08:53:28.604Z","modified":"2026-10-21T12:11:26.637005369Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-nginx-gateway-2026-15176","title":"NGINX ngx_http_core_module vulnerability","description":"A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-21T08:53:42.332Z","modified":"2026-10-21T12:11:26.637005369Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"CLSA-2026-1792146840","title":"nginx: Fix of CVE-2026-15176","description":"- CVE-2026-15176: fix heap buffer overflow in ngx_http_map_uri_to_path()\n  when a location using \"alias\" maps a URI changed by \"rewrite\" before a\n  new location is selected; reject the mapping while r-\u003euri_changed is set","status":"published","published":"2026-10-16T10:34:11Z","modified":"2026-10-26T09:31:36.616302207Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792164102","title":"nginx: Fix of CVE-2026-15176","description":"- CVE-2026-15176: reject \"alias\" URI to path mapping in\n  ngx_http_map_uri_to_path() after a rewrite changed the URI and before\n  a new location is selected, and invalidate the location after a\n  standalone \"break\" following a rewrite, preventing a heap buffer overflow","status":"published","published":"2026-10-16T15:21:53Z","modified":"2026-10-26T09:31:38.580324154Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792164686","title":"nginx: Fix of CVE-2026-15176","description":"- CVE-2026-15176: reject \"alias\" URI to path mapping in\n  ngx_http_map_uri_to_path() after a rewrite changed the URI and before\n  a new location is selected, and invalidate the location after a\n  standalone \"break\" following a rewrite, preventing a heap buffer overflow","status":"published","published":"2026-10-16T15:31:37Z","modified":"2026-10-26T09:31:44.06876911Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792165116","title":"nginx: Fix of CVE-2026-15176","description":"- CVE-2026-15176: reject \"alias\" URI to path mapping in\n  ngx_http_map_uri_to_path() after a rewrite changed the URI and before\n  a new location is selected, and invalidate the location after a\n  standalone \"break\" following a rewrite, preventing a heap buffer overflow","status":"published","published":"2026-10-16T16:56:01Z","modified":"2026-10-26T09:31:51.926256673Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792170794","title":"nginx: Fix of CVE-2026-15176","description":"- CVE-2026-15176: fix heap buffer overflow in ngx_http_map_uri_to_path()\n  when a location using \"alias\" maps a URI changed by \"rewrite\" before a\n  new location is selected; reject the mapping while r-\u003euri_changed is set","status":"published","published":"2026-10-16T17:13:24Z","modified":"2026-10-26T09:30:58.317238409Z","updated_at":"2026-11-02T15:43:51.747192Z"},{"id":"CLSA-2026-1792426319","title":"Fix CVE(s): CVE-2026-15176","description":"   * SECURITY UPDATE: heap buffer overflow via alias with rewrite and $request_filename\n     - debian/patches/CVE-2026-15176-pre.patch: clear r-\u003evalid_location on\n       a standalone \"break\" after the URI was rewritten\n     - debian/patches/CVE-2026-15176.patch: reject URI to path mapping in\n       ngx_http_map_uri_to_path() for an \"alias\" location once rewrite has\n       changed the URI\n     - CVE-2026-15176","status":"published","published":"2026-10-19T16:12:09Z","modified":"2026-10-26T09:32:03.016482685Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792487559","title":"Fix CVE(s): CVE-2026-15176, CVE-2026-56434","description":"   * SECURITY UPDATE: heap buffer overflow when mapping a rewritten URI to a\n     path in a location using alias\n     - debian/patches/CVE-2026-15176.patch: reject URI to path mapping in\n       ngx_http_map_uri_to_path() when r-\u003euri_changed is set, so a rewrite\n       that shortens the URI below the alias location prefix can no longer\n       overflow the path buffer through $request_filename\n     - CVE-2026-15176\n   * SECURITY UPDATE: use-after-free via duplicate subrequest finalization\n     - debian/patches/CVE-2026-56434.patch: skip posting a request in\n       ngx_http_post_request() if it is already posted, and reset the\n       subrequest write event handler during finalization in\n       ngx_http_finalize_request(), so an SSI subrequest double-posted during\n       unbuffered proxying can no longer be finalized twice\n     - CVE-2026-56434","status":"published","published":"2026-10-20T09:12:52Z","modified":"2026-10-26T09:32:05.641055816Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792579760","title":"nginx: Fix of CVE-2026-15176","description":"- CVE-2026-15176: reject URI to path mapping in ngx_http_map_uri_to_path() while\n  a rewrite has changed the URI and no new location has been chosen yet, closing\n  a window that mapped requests in an aliased location to an incorrect path","status":"published","published":"2026-10-21T10:49:31Z","modified":"2026-10-26T09:31:57.113438484Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792580147","title":"nginx: Fix of CVE-2026-15176","description":"- CVE-2026-15176: reject URI to path mapping in ngx_http_map_uri_to_path() while\n  a rewrite has changed the URI and no new location has been chosen yet, closing\n  a window that mapped requests in an aliased location to an incorrect path","status":"published","published":"2026-10-21T10:55:58Z","modified":"2026-10-26T09:31:46.805417645Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792580871","title":"nginx: Fix of CVE-2026-15176","description":"- CVE-2026-15176: reject URI to path mapping in ngx_http_map_uri_to_path() while\n  a rewrite has changed the URI and no new location has been chosen yet, closing\n  a window that mapped requests in an aliased location to an incorrect path","status":"published","published":"2026-10-21T20:42:01Z","modified":"2026-10-26T09:31:43.215565482Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792770638","title":"Fix CVE(s): CVE-2026-15176","description":"   * SECURITY UPDATE: heap buffer overflow in ngx_http_map_uri_to_path() when\n     $request_filename is evaluated after a rewrite inside an \"alias\" location\n     - debian/patches/CVE-2026-15176.patch: reject the URI to path mapping for\n       an \"alias\" location while r-\u003euri_changed is set, and clear\n       r-\u003evalid_location in ngx_http_script_break_code() when the URI was\n       changed, so a rewritten URI shorter than the location prefix is no\n       longer mapped to a path\n     - CVE-2026-15176","status":"published","published":"2026-10-23T15:50:49Z","modified":"2026-10-26T09:31:53.676361603Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792798495","title":"Fix CVE(s): CVE-2026-15176","description":"   * SECURITY UPDATE: heap buffer overflow via post-rewrite URI to path\n     mapping with alias\n     - debian/patches/CVE-2026-15176.patch: in ngx_http_map_uri_to_path(),\n       reject the mapping for a location using \"alias\" when r-\u003euri_changed is\n       set, so a rewritten URI shorter than the location prefix is no longer\n       mapped to a path (e.g. via $request_filename)\n     - debian/patches/CVE-2026-15176-2.patch: in ngx_http_script_break_code(),\n       clear r-\u003evalid_location when the URI was changed, so the alias check\n       also rejects the mapping after a standalone \"break\"\n     - CVE-2026-15176","status":"published","published":"2026-10-23T23:35:05Z","modified":"2026-10-26T09:32:04.927118844Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"openSUSE-SU-2026:12143-1","title":"nginx-1.31.7-1.1 on GA media","description":"These are all security issues fixed in the nginx-1.31.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-15T00:00:00Z","modified":"2026-10-16T17:23:13.464278658Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"ROOT-OS-ALPINE-315-CVE-2026-15176","title":"CVE-2026-15176 in nginx - Patched by Root","description":"Root has patched CVE-2026-15176 in the nginx package for Root:Alpine:3.15. Multiple fixed versions available.","status":"published","published":"2026-11-02T10:27:11Z","modified":"2026-11-02T11:15:04.826157849Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"ROOT-OS-ALPINE-321-CVE-2026-15176","title":"CVE-2026-15176 in nginx - Patched by Root","description":"Root has patched CVE-2026-15176 in the nginx package for Root:Alpine:3.21. Multiple fixed versions available.","status":"published","published":"2026-11-03T14:41:12Z","modified":"2026-11-03T15:15:04.648236144Z","updated_at":"2026-11-03T15:57:39.116496Z"},{"id":"ROOT-OS-ALPINE-323-CVE-2026-15176","title":"CVE-2026-15176 in nginx - Patched by Root","description":"Root has patched CVE-2026-15176 in the nginx package for Root:Alpine:3.23. Multiple fixed versions available.","status":"published","published":"2026-11-03T08:21:49Z","modified":"2026-11-03T09:15:03.087129314Z","updated_at":"2026-11-03T09:26:33.868904Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-15176","title":"CVE-2026-15176 in nginx - Patched by Root","description":"Root has patched CVE-2026-15176 in the nginx package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-20T11:32:19Z","modified":"2026-10-20T12:15:39.4422186Z","updated_at":"2026-11-02T15:53:31.773105Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-15176","title":"CVE-2026-15176 in nginx - Patched by Root","description":"Root has patched CVE-2026-15176 in the nginx package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-10-22T07:10:55Z","modified":"2026-10-23T13:00:05.190204646Z","updated_at":"2026-11-02T15:53:33.153539Z"},{"id":"USN-8955-1","title":"nginx vulnerabilities","description":"It was discovered that nginx incorrectly handled certain configurations\nusing the alias directive together with rewrite rules. A remote attacker\ncould possibly use this issue to cause nginx to crash, resulting in a\ndenial of service, or execute arbitrary code.\n(CVE-2026-15176)\n\nIt was discovered that nginx incorrectly handled map directives using\nregex matching under certain circumstances. A remote attacker could\npossibly use this issue to cause nginx to crash, resulting in a denial\nof service, or execute arbitrary code.\n(CVE-2026-93479)\n\nIt was discovered that nginx incorrectly handled HTTP/3 requests when\nproxy_request_buffering was enabled. This issue only affected\nUbuntu 26.04 LTS and Ubuntu 26.10. A remote attacker could possibly use\nthis issue to inject data into proxied requests.\n(CVE-2026-95101)\n\nIt was discovered that nginx incorrectly handled asynchronous file I/O\nin certain configurations with Server Side Includes pages. A remote\nattacker could possibly use this issue to cause nginx to crash,\nresulting in a denial of service, or execute arbitrary code.\n(CVE-2026-97205)\n\nIt was discovered that nginx incorrectly handled SSL session ticket keys\nwhen configured with a shared session cache but without explicit ticket\nkey rotation. This issue only affected Ubuntu 24.04 LTS, Ubuntu 26.04 LTS,\nand Ubuntu 26.10. A remote attacker\ncould possibly use this issue to forge client SSL sessions and bypass\nclient certificate verification.\n(CVE-2026-97629)","status":"published","published":"2026-10-26T15:34:05Z","modified":"2026-10-26T22:46:19.977872622Z","updated_at":"2026-11-02T16:58:26.907654Z"},{"id":"USN-8955-2","title":"nginx vulnerabilities","description":"USN-8955-1 fixed vulnerabilities in nginx in Ubuntu 26.10, Ubuntu 26.04\nLTS, Ubuntu 24.04 LTS, and Ubuntu 22.04 LTS. This update provides the\ncorresponding update for Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu 16.04\nLTS, and Ubuntu 14.04 LTS.\n\nIn addition, this update fixes CVE-2026-42533 for these releases.\n\nIt was discovered that nginx incorrectly handled certain map directives\nusing regex matching and capture variables. A remote attacker could\npossibly use this issue to crash nginx, resulting in a denial of\nservice, or possibly execute arbitrary code. (CVE-2026-42533)\n\nOriginal advisory details:\n\n It was discovered that nginx incorrectly handled certain configurations\nusing the alias directive together with rewrite rules. A remote attacker\ncould possibly use this issue to cause nginx to crash, resulting in a\ndenial of service, or execute arbitrary code.  (CVE-2026-15176)\n\n It was discovered that nginx incorrectly handled map directives using\nregex matching under certain circumstances. A remote attacker could\npossibly use this issue to cause nginx to crash, resulting in a denial  of\nservice, or execute arbitrary code.  (CVE-2026-93479)\n\n It was discovered that nginx incorrectly handled HTTP/3 requests when\nproxy_request_buffering was enabled. This issue only affected  Ubuntu 26.04\nLTS and Ubuntu 26.10. A remote attacker could possibly use  this issue to\ninject data into proxied requests.  (CVE-2026-95101)\n\n It was discovered that nginx incorrectly handled asynchronous file I/O  in\ncertain configurations with Server Side Includes pages. A remote  attacker\ncould possibly use this issue to cause nginx to crash,  resulting in a\ndenial of service, or execute arbitrary code.  (CVE-2026-97205)\n\n It was discovered that nginx incorrectly handled SSL session ticket keys\nwhen configured with a shared session cache but without explicit ticket\nkey rotation. This issue only affected Ubuntu 24.04 LTS, Ubuntu 26.04 LTS,\nand Ubuntu 26.10. A remote attacker  could possibly use this issue to forge\nclient SSL sessions and bypass  client certificate verification.\n(CVE-2026-97629)","status":"published","published":"2026-11-05T14:40:26Z","modified":"2026-11-06T01:13:08.896367466Z","updated_at":"2026-11-06T01:32:47.895286Z"}]}}