Loading story…
Red Hat released Important security updates for nginx on RHEL 8 and RHEL 10 to fix two memory-safety vulnerabilities, CVE-2026-56434 and CVE-2026-60005. The flaws can lead to memory disclosure, denial of service, and, in the case of the heap buffer over-read tracked as CVE-2026-56434, possible memory modification. CVE-2026-60005 affects ngx_http_slice_module. Red Hat shipped updated packages including nginx 1.24.0-3.module+el8.10.0+24644+2676a8ce.4 for RHEL 8 and nginx 1.26.3-6.el10_2.6 for RHEL 10 across major architectures such as x86_64, aarch64, ppc64le, and s390x.
Downstream distributions quickly mirrored the fixes: AlmaLinux 8 and Rocky Linux 8 published notices tied to the same Red Hat advisory stream, and Tenable plugin coverage shows both advisories map to CVE-2026-56434 and CVE-2026-60005, with no known public exploits reported. The vulnerability metadata also links the issues to common weakness classes including CWE-125 and CWE-824, the latter describing access of an uninitialized pointer, a defect type that can contribute to crashes, unintended memory access, and potential code execution in memory-unsafe software.
See real exploitation activity before you spend the cycle.
9 events from the most recent confirmed update back to the earliest known activity.
On 2026-08-25, Red Hat published Important advisory RHSA-2026:59496 for affected nginx:1.26 packages on Red Hat Enterprise Linux 9. The update addresses CVE-2026-56434 and CVE-2026-60005.
On 2026-08-25, Red Hat published Important advisory RHSA-2026:59362 for nginx on Red Hat Enterprise Linux 9. The update remediates CVE-2026-56434 and CVE-2026-60005 in affected nginx packages.
On 2026-08-25, Red Hat published Important advisory RHSA-2026:59490 for nginx 1.24 packages on Red Hat Enterprise Linux 9 and RHEL EUS 9.8. The update addresses CVE-2026-56434 and CVE-2026-60005.
A Tenable plugin for Rocky Linux 8 states that the patch publication date for the nginx notice tied to RLSA-2026:59216 was 2026-08-25. The notice covers nginx packages affected by CVE-2026-56434 and CVE-2026-60005.
On 2026-08-24, Red Hat published RHSA-2026:59220, an Important nginx security advisory for Red Hat Enterprise Linux 10. The update released nginx 1.26.3-6.el10_2.6 packages for multiple architectures to address CVE-2026-56434 and CVE-2026-60005.
On 2026-08-24, Red Hat published RHSA-2026:59216, an Important security advisory for the nginx:1.24 module on Red Hat Enterprise Linux 8. The update released nginx 1.24.0-3.module+el8.10.0+24644+2676a8ce.4 packages to fix CVE-2026-56434 and CVE-2026-60005.
Tenable plugin metadata states that the nginx vulnerabilities CVE-2026-56434 and CVE-2026-60005 had a vulnerability publication date of 2026-07-15. The advisories tie these issues to heap buffer over-read and memory disclosure/denial-of-service conditions.
Red Hat described CVE-2026-60005 as an ngx_http_slice_module flaw triggered by unauthenticated requests when the slice directive uses unnamed regex captures or during a background cache update. The issue can disclose limited memory or restart an NGINX worker; it affects the data plane only and requires the non-default module to be compiled with --with-http_slice_module.
Red Hat described CVE-2026-56434 as an ngx_http_ssi_module heap buffer over-read requiring SSI, proxy_pass, and proxy_buffering off, plus an attacker able to man-in-the-middle and control upstream responses. The issue can cause limited memory modification or an NGINX worker restart and affects the data plane rather than the control plane.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
10 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcetenable.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **RHSA-2026:66000**, an Important-rated update for Red Hat Enterprise Linux 8, fixing seven Linux kernel vulnerabilities in cryptographic request handling, Netfilter conntrack and SYN proxy processing, rhashtable iteration, SMB DFS referrals, NVMe-over-RDMA inline-data handling, and bridge fast-leave behavior. The fixed release, `4.18.0-553.160.1.el8_10`, is available for x86_64, s390x, ppc64le, and aarch64 systems, including applicable Extended Life Cycle and CodeReady Linux Builder repositories. Notable fixes include a stack out-of-bounds write in SIP/SDP NAT processing (**CVE-2026-53002**), a potential use-after-free caused by a stale TCP-header pointer in Netfilter SYN proxy handling (**CVE-2026-64007**), a use-after-free in rhashtable iterator restarts (**CVE-2026-64563**), and insufficient validation of SMB DFS referral `PathConsumed` values (**CVE-2026-68343**). AlmaLinux 8 has issued a corresponding update for the same seven CVEs; no known exploitation was reported in the referenced notices. Administrators should update affected kernel packages and reboot systems to load the patched kernel.
Sep 17, 2026
Red Hat released multiple **Important** kernel security advisories for **RHEL 8, RHEL 9, and RHEL 10**, including standard kernel updates and `kpatch` live patches, to remediate a broad set of Linux kernel vulnerabilities across x86_64, ppc64le, aarch64, s390x, and IBM Z platforms. The updates span base, Extended Update Support, Extended Life Cycle, SAP Solutions, AUS, and real-time offerings, with affected advisories covering RHEL 8 and 10 kernel packages as well as live patch modules for RHEL 8.8, 8.10, 9.2, 9.4, 9.6, 9.8, and 10.2. Several advisories require reboots for standard kernel package updates, while the `kpatch` releases allow remediation without rebooting on supported kernels. The fixes address recurring kernel issues including **CVE-2026-43038** in IPv6 ICMP handling, **CVE-2026-43125** in DLM length validation, **CVE-2026-43329** in netfilter flowtable action checking, **CVE-2026-46244** involving `nft_inner` IPv6 offset desynchronization, and **CVE-2026-64530**, a use-after-free flaw in net scheduler qevent handling. Red Hat also patched **CVE-2026-31692**, a privilege-related flaw in `rtnetlink` where missing `netlink_ns_capable()` checks could let an unprivileged user in a user namespace create paired interfaces such as `veth` in arbitrary network namespaces, including `init_net`; that issue was specifically tied to RHEL 8 and RHEL 10 fixes. Additional CVEs cited across the advisories include **CVE-2025-40237**, **CVE-2026-23110**, **CVE-2026-31641**, **CVE-2026-43116**, **CVE-2026-46099**, **CVE-2026-46150**, **CVE-2026-52973**, **CVE-2026-53059**, **CVE-2026-64561**, and **CVE-2026-64530**.
Aug 25, 2026
Red Hat released multiple **kernel security advisories** for Red Hat Enterprise Linux 8, 9, and 10 channels to address several Linux kernel vulnerabilities, including **CVE-2026-23097**, **CVE-2026-23193**, **CVE-2026-31402**, **CVE-2026-31431**, and **CVE-2026-43077**. The flaws span a hugetlb folio migration deadlock that can trigger system hangs and denial of service, a use-after-free in iSCSI target code, a `qla2xxx` double-free that may enable denial of service or privilege escalation, a heap overflow in the NFSv4.0 LOCK replay cache, and a crypto `algif_aead` buffer-size validation issue that could lead to crashes, memory corruption, memory disclosure, or possible code execution in some contexts. The updates were published through advisories including **RHSA-2026:11313**, **RHSA-2026:13664**, **RHSA-2026:13681**, **RHSA-2026:13887**, and **RHSA-2026:14165**, covering product variants such as RHEL 8.4, 8.6, 8.8, 9.6, and 10.0 support channels. Red Hat rated several of the kernel updates as **Important** and noted that no acceptable mitigation was available for the hugetlb deadlock issue; affected systems require installation of the updated kernel packages and a **reboot** for protections to take effect.
Aug 25, 2026