nginx (AlmaLinux:8) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the AlmaLinux:8 package nginx, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (11)

• CVE-2026-27654 — CVSS 8.2 (high): NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer…
• CVE-2026-42945 — CVSS 8.1 (high): NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite…
• CVE-2026-32647 — CVSS 7.8 (high): NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer…
• CVE-2026-27784 — CVSS 7.8 (high): The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to…
• CVE-2021-23017 — CVSS 7.7 (high): A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to…
• CVE-2019-9511 — CVSS 7.5 (high): Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a…
• CVE-2019-9513 — CVSS 7.5 (high): Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple…
• CVE-2023-44487 — CVSS 7.5 (high) — actively exploited: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly…
• CVE-2026-27651 — CVSS 7.5 (high): When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to…
• CVE-2019-9516 — CVSS 6.5 (medium): Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of…
• CVE-2026-1642 — CVSS 5.9 (medium): A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker…