7.5
High
CVE-2026-27651 When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can…
Description
When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server permits retry by returning the Auth-Wait response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 10) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 8) | Versions not published | |
| Red Hat Enterprise Linux AppStream E4S (v.9.0) | Versions not published | |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Versions not published | |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Versions not published | |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 9) | Versions not published | |
| Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) | Versions not published |
Show the 17 other branches Hide the 17 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat CodeReady Linux Builder EUS (v.9.4) | Versions not published | |
| Red Hat CodeReady Linux Builder EUS (v.9.6) | Versions not published | |
| Red Hat Hardened Images 1.30 | earliest → < 1.30.0-1.hum1 | 1.30.0-1.hum1 |
| Red Hat Update Infrastructure 5 1776868842 | earliest → < 1776868842 | 1776868842 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) | Versions not published | |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) | Versions not published | |
| NGINX Open Source 1.29 | 1.29.0 → < 1.29.7 | 1.29.7 |
| NGINX Open Source 0.5 | 0.5.15 → < 1.28.3 | 1.28.3 |
| NGINX Plus | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 10.0 Extended Update Support | Versions not published | |
| Red Hat Enterprise Linux 8 8100020260401080144.489197 | earliest → < 8100020260401080144.489197e6 | 8100020260401080144.489197e6 |
| Red Hat Enterprise Linux 9 9070020260407080353.9 | earliest → < 9070020260407080353.9 | 9070020260407080353.9 |
| Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | Versions not published | |
| Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | Versions not published | |
| Red Hat Enterprise Linux 9.4 Extended Update Support 9040020260504195322.9 | earliest → < 9040020260504195322.9 | 9040020260504195322.9 |
| Red Hat Enterprise Linux 9.6 Extended Update Support 9060020260504154614.9 | earliest → < 9060020260504154614.9 | 9060020260504154614.9 |
References
- my.f5.com my.f5.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Enterprise Linux AppStream EUS (v. 10.0)
The 269 CVEs of Red Hat Enterprise Linux AppStream EUS (v. 10.0) →
CVE-2026-53016
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - copy IV using skcipher ivsize AF_ALG…
7.8
High
CVE-2026-56208
Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode
7.6
High
CVE-2026-12329
Memory safety bug fixed in Thunderbird ESR 140.12
5.3
Medium
CVE-2026-12328
Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and…
8.1
High