SUSE-SU-2026:1953-1
- Source
- https://www.suse.com/support/update/announcement/2026/suse-su-20261953-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:1953-1.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/SUSE-SU-2026:1953-1
- Upstream
CVE (4)
- CVE-2026-1642
- CVE-2026-27654
- CVE-2026-27784
- CVE-2026-28753
- Related
- Published
- 2026-05-18T07:53:46Z
- Modified
- 2026-05-19T08:45:08Z
- Summary
- Security update for nginx
- Details
-
This update for nginx fixes the following issues
Security issues:
- CVE-2026-1642: plain text data injection into the response from an upstream proxied server (bsc#1257675).
- CVE-2026-27654: buffer overflow in the NGINX worker process via the
ngx_http_dav_modulemodule (bsc#1260416). - CVE-2026-27784: NGINX worker memory over-read or over-write via a specially crafted MP4 file (bsc#1260417).
- CVE-2026-28753: improper handling onf CRLF sequences in DNS responses allows for arbitrary header injection into SMTP upstream requests (bsc#1260418).
Non security issue:
- nginx always runs into 'timed out. Killing' on shutdown when there are long-running processes (bsc#1243502).
- References
-
- https://www.suse.com/support/update/announcement/2026/suse-su-20261953-1/
- https://bugzilla.suse.com/1243502
- https://bugzilla.suse.com/1257675
- https://bugzilla.suse.com/1260416
- https://bugzilla.suse.com/1260417
- https://bugzilla.suse.com/1260418
- https://www.suse.com/security/cve/CVE-2026-1642
- https://www.suse.com/security/cve/CVE-2026-27654
- https://www.suse.com/security/cve/CVE-2026-27784
- https://www.suse.com/security/cve/CVE-2026-28753