rpm package
suse/nginx&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP5
pkg:rpm/suse/nginx&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5
Vulnerabilities (9)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-9256 | Hig | 8.1 | < 1.21.5-150400.3.20.1 | 1.21.5-150400.3.20.1 | May 22, 2026 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replac | |
| CVE-2026-42946 | Med | 6.5 | < 1.21.5-150400.3.20.1 | 1.21.5-150400.3.20.1 | May 13, 2026 | A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control re | |
| CVE-2026-42945 | Hig | 8.1 | < 1.21.5-150400.3.20.1 | 1.21.5-150400.3.20.1 | May 13, 2026 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) | |
| CVE-2026-42934 | Med | 4.8 | < 1.21.5-150400.3.20.1 | 1.21.5-150400.3.20.1 | May 13, 2026 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering ("off") directives are configured, unauthenticated attackers can send requests that with conditions be | |
| CVE-2026-40701 | Med | 4.8 | < 1.21.5-150400.3.20.1 | 1.21.5-150400.3.20.1 | May 13, 2026 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directive is set to "on" or the leaf parameters are configured with a resolver. With this configuration, an | |
| CVE-2026-27651 | — | < 1.21.5-150400.3.20.1 | 1.21.5-150400.3.20.1 | Mar 24, 2026 | When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server permits retry by retu | ||
| CVE-2026-32647 | — | < 1.21.5-150400.3.20.1 | 1.21.5-150400.3.20.1 | Mar 24, 2026 | NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 fil | ||
| CVE-2024-7347 | — | < 1.21.5-150400.3.6.1 | 1.21.5-150400.3.6.1 | Aug 14, 2024 | NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx_http_mp4_mod | ||
| CVE-2023-44487 | Hig | 7.5 | KEV | < 1.21.5-150400.3.6.1 | 1.21.5-150400.3.6.1 | Oct 10, 2023 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. |
- affected < 1.21.5-150400.3.20.1fixed 1.21.5-150400.3.20.1
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replac
- affected < 1.21.5-150400.3.20.1fixed 1.21.5-150400.3.20.1
A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control re
- affected < 1.21.5-150400.3.20.1fixed 1.21.5-150400.3.20.1
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2)
- affected < 1.21.5-150400.3.20.1fixed 1.21.5-150400.3.20.1
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering ("off") directives are configured, unauthenticated attackers can send requests that with conditions be
- affected < 1.21.5-150400.3.20.1fixed 1.21.5-150400.3.20.1
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directive is set to "on" or the leaf parameters are configured with a resolver. With this configuration, an
- CVE-2026-27651Mar 24, 2026affected < 1.21.5-150400.3.20.1fixed 1.21.5-150400.3.20.1
When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server permits retry by retu
- CVE-2026-32647Mar 24, 2026affected < 1.21.5-150400.3.20.1fixed 1.21.5-150400.3.20.1
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 fil
- CVE-2024-7347Aug 14, 2024affected < 1.21.5-150400.3.6.1fixed 1.21.5-150400.3.6.1
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx_http_mp4_mod
- affected < 1.21.5-150400.3.6.1fixed 1.21.5-150400.3.6.1
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.