Updated nginx packages fix security vulnerabilities
Publication date: 27 Jul 2026Modification date: 27 Jul 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-42533 , CVE-2026-56434 , CVE-2026-60005
Description
CVE-2026-42533:
Heap buffer overflow might occur in a worker process when using the map
directive with regex matching if the map variable was included in a
string expression after a capture affected by this map; a similar issue
might happen when using a non-cacheable variable in a
string expression.
Thanks to Mufeed VH of Winfunc Research and Maxim Dounin.
.
CVE-2026-60005:
Uninitialized memory access might occur when using unnamed regex
captures with the "slice" directive or background cache update, which
could result in worker process memory disclosure or worker process
termination.
.
CVE-2026-56434:
Use-after-free might occur when processing a specially crafted proxied
backend response with the ngx_http_ssi_filter_module.
Thanks to P4P3R-HAK.
References
- https://bugs.mageia.org/show_bug.cgi?id=35973
- https://my.f5.com/manage/s/article/K000162097
- https://my.f5.com/manage/s/article/K000162100
- https://my.f5.com/manage/s/article/K000162098
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/LIWPH3EULRVLC6TMLBZYPJ5IKQGVF6C2/
- https://www.cve.org/CVERecord?id=CVE-2026-42533
- https://www.cve.org/CVERecord?id=CVE-2026-56434
- https://www.cve.org/CVERecord?id=CVE-2026-60005
SRPMS
10/core
- nginx-1.30.4-1.mga10
9/core
- nginx-1.30.4-1.mga9