SUSE-SU-2026:1761-1
- Source
- https://www.suse.com/support/update/announcement/2026/suse-su-20261761-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1761-1.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/SUSE-SU-2026:1761-1
- Upstream
CVE (4)
- CVE-2026-1642
- CVE-2026-27654
- CVE-2026-27784
- CVE-2026-28753
- Related
- Published
- 2026-05-08T08:58:17Z
- Modified
- 2026-05-09T07:45:27Z
- Summary
- Security update for nginx
- Details
-
This update for nginx fixes the following issues:
- CVE-2026-1642: plain text data injection into the response from an upstream proxied server via MITM attack (bsc#1257675).
- CVE-2026-27654: buffer overflow in the NGINX worker process via the
ngx_http_dav_modulemodule (bsc#1260416). - CVE-2026-27784: NGINX worker memory overread or overwrite via a specially crafted MP4 file (bsc#1260417).
- CVE-2026-28753: arbitrary header injection into SMTP upstream requests via attacker-controlled DNS server (bsc#1260418).
- References
-
- https://www.suse.com/support/update/announcement/2026/suse-su-20261761-1/
- https://bugzilla.suse.com/1257675
- https://bugzilla.suse.com/1260416
- https://bugzilla.suse.com/1260417
- https://bugzilla.suse.com/1260418
- https://www.suse.com/security/cve/CVE-2026-1642
- https://www.suse.com/security/cve/CVE-2026-27654
- https://www.suse.com/security/cve/CVE-2026-27784
- https://www.suse.com/security/cve/CVE-2026-28753