The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-18063 advisory.

    - Resolves: RHEL-157874 CVE-2026-32647 nginx: NGINX: Denial of Service or       Code Execution via specially crafted MP4 files
    - Resolves: RHEL-159433 CVE-2026-27651 nginx: NGINX: Denial of Service via       undisclosed requests when ngx_mail_auth_http_module is enabled
    - Resolves: RHEL-159525 CVE-2026-27784 nginx: NGINX: Denial of Service due       to memory corruption via crafted MP4 file

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:18063 advisory.

    * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:19372 advisory.

    nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency,     performance, and low memory usage.

    Security Fix(es):

    * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:19371 advisory.

    nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency,     performance, and low memory usage.

    Security Fix(es):

    * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8271-1 advisory.

    It was discovered that the nginx ngx_http_rewrite_module component incorrectly handled certain rewrite     directives. A remote attacker could use this issue to cause nginx to crash, resulting in a denial of     service, or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:18029 advisory.

    * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2050-1 advisory.

    This update for nginx fixes the following issues

    - CVE-2026-27651: denial of service via undisclosed requests when the `ngx_mail_auth_http_module` is     enabled       (bsc#1260415).
    - CVE-2026-32647: NGINX worker memory over-read or over-write via a specially crafted MP4 file     (bsc#1260420).
    - CVE-2026-40701: heap use-after-free in the worker process when the `ssl_verify_client` and the     `ssl_ocsp` directives       are set due to issue in the `ngx_http_ssl_module` module (bsc#1265229).
    - CVE-2026-42934: heap buffer overread in the worker process due to issue in the `ngx_http_charset_module`     module       (bsc#1265231).
    - CVE-2026-42945: heap buffer overflow via crafted HTTP requests due to issue in `ngx_http_rewrite_module`       (bsc#1265232).
    - CVE-2026-42946: excessive memory allocation and data overread due to issue in the `ngx_http_scgi_module`     and       `ngx_http_uwsgi_module` modules (bsc#1265233).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The installed version of nginx is 0.6.27 prior to 1.30.1. It is, therefore, affected by the following issue:

  - NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This     vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an     unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string     that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control     can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in     the NGINX worker process leading to a restart. Additionally, for systems with Address Space Layout     Randomization (ASLR ) disabled, code execution is possible. Note: Software versions which have reached End     of Technical Support (EoTS) are not evaluated. (CVE-2026-42945)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:19374 advisory.

    * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8375-1 advisory.

    It was discovered that the nginx ngx_mail_smtp_module module incorrectly handled certain memory operations     when doing SMTP authentication. This could possibly result in sensitive information being sent to the     authentication server. (CVE-2025-53859)

    It was discovered that nginx incorrectly handled proxying to upstream TLS servers. An attacker could     possibly use this issue to insert plain text data into the response from an upstream proxied server.
    (CVE-2026-1642)

    It was discovered that the nginx ngx_mail_auth_http_module module incorrectly handled certain requests. An     attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service.
    (CVE-2026-27651)

    It was discovered that the nginx ngx_http_dav_module module incorrectly handled certain destination URIs.
    An attacker could use this issue to cause nginx to crash, resulting in a denial of service, or possibly     modify source or destination names outside of the document root. (CVE-2026-27654)

    It was discovered that the nginx ngx_http_mp4_module module incorrectly handled certain MP4 files. An     attacker could use this issue to cause nginx to crash, resulting in a denial of service, or possibly     execute arbitrary code. (CVE-2026-27784, CVE-2026-32647)

    It was discovered that the nginx ngx_mail_smtp_module module incorrectly handled certain CRLF sequences.
    An attacker could possibly use this issue to inject arbitrary SMTP headers. (CVE-2026-28753)

    It was discovered that nginx contained a use-after-free vulnerability in the ngx_http_ssl_module module     when client certificate verification and OCSP validation were enabled. A remote attacker could use this     issue to cause nginx to crash, resulting in a denial of service, or possibly modify data in memory.
    (CVE-2026-40701)

    It was discovered that nginx did not properly handle certain proxied responses in the     ngx_http_charset_module module. A remote attacker could possibly use this issue to obtain sensitive     information or cause nginx to crash, resulting in a denial of service. (CVE-2026-42934)

    It was discovered that the nginx ngx_http_rewrite_module component incorrectly handled certain rewrite     directives. A remote attacker could use this issue to cause nginx to crash, resulting in a denial of     service, or possibly execute arbitrary code. (CVE-2026-42945)

    It was discovered that nginx did not properly process certain SCGI and uWSGI responses. An attacker able     to perform a machine-in-the-middle attack could possibly use this issue to obtain sensitive information or     cause nginx to crash, resulting in a denial of service. (CVE-2026-42946)

    It was discovered that nginx incorrectly handled certain rewrite rules in the ngx_http_rewrite_module     module. A remote attacker could use this issue to cause nginx to crash, resulting in a denial of service,     or possibly execute arbitrary code. (CVE-2026-9256)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1252:01 advisory.

    * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
315429	Oracle Linux 10 : nginx (ELSA-2026-18063)	Nessus	Oracle Linux Local Security Checks	2026/5/19	2026/6/16	critical
315517	AlmaLinux 10 : nginx (ALSA-2026:18063)	Nessus	Alma Linux Local Security Checks	2026/5/19	2026/6/16	critical
315557	RHEL 9 : nginx:1.26 (RHSA-2026:19372)	Nessus	Red Hat Local Security Checks	2026/5/20	2026/6/16	critical
315571	RHEL 9 : nginx:1.24 (RHSA-2026:19371)	Nessus	Red Hat Local Security Checks	2026/5/20	2026/6/16	critical
315741	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : nginx vulnerability (USN-8271-1)	Nessus	Ubuntu Local Security Checks	2026/5/20	2026/6/16	critical
316340	RockyLinux 9 : nginx (RLSA-2026:18029)	Nessus	Rocky Linux Local Security Checks	2026/5/22	2026/6/16	critical
316725	SUSE SLES15 Security Update : nginx (SUSE-SU-2026:2050-1)	Nessus	SuSE Local Security Checks	2026/5/26	2026/6/18	critical
316773	nginx 0.6.27 < 1.30.1 ngx_http_rewrite_module Heap Buffer Overflow	Nessus	Web Servers	2026/5/26	2026/7/17	critical
318045	RockyLinux 9 : nginx (RLSA-2026:19374)	Nessus	Rocky Linux Local Security Checks	2026/5/30	2026/6/15	critical
318631	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS : nginx vulnerabilities (USN-8375-1)	Nessus	Ubuntu Local Security Checks	2026/6/4	2026/6/17	critical
326740	MiracleLinux 9 : nginx:1.26 (AXSA:2026-1252:01)	Nessus	Miracle Linux Local Security Checks	2026/7/14	2026/7/20	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical