Multiple Nginx Vulnerabilities Affect Oracle Linux Versions

Recent advisories detail multiple vulnerabilities in Nginx across Oracle Linux versions 8, 9, and 10, including CVE-2026-60005 and CVE-2026-56434, which could lead to memory disclosure and denial of service. These vulnerabilities are particularly concerning as they allow for remote denial of service attacks via crafted HTTP/2 headers and memory corruption. Oracle Linux 8 and 9 users are advised to update to patched versions to mitigate risks associated with these vulnerabilities. The vulnerabilities were disclosed between March and July 2026, with some having proof-of-concept (PoC) code available. The advisories emphasize the urgency of applying patches due to the potential for exploitation. The affected Nginx versions include 1.24 and 1.26, with specific CVEs linked to each version. Current status indicates that patches are available, but the risk remains high until all users apply these updates.

Key Points: • Critical vulnerabilities in Nginx affect Oracle Linux 8, 9, and 10. • CVE-2026-60005 and CVE-2026-56434 allow for remote denial of service and memory disclosure. • Patches are available, but exploitation risk remains until updates are applied.