[El-errata] ELSA-2026-29151 Important: Oracle Linux 9 nginx:1.26 security update

[Errata Announcements for Oracle Linux]

Oracle Linux Security Advisory ELSA-2026-29151

http://linux.oracle.com/errata/ELSA-2026-29151.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

x86_64:
nginx-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.x86_64.rpm
nginx-all-modules-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.noarch.rpm
nginx-core-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.x86_64.rpm
nginx-filesystem-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.noarch.rpm
nginx-mod-devel-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.x86_64.rpm
nginx-mod-http-image-filter-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.x86_64.rpm
nginx-mod-http-perl-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.x86_64.rpm
nginx-mod-http-xslt-filter-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.x86_64.rpm
nginx-mod-mail-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.x86_64.rpm
nginx-mod-stream-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.x86_64.rpm

aarch64:
nginx-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.aarch64.rpm
nginx-all-modules-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.noarch.rpm
nginx-core-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.aarch64.rpm
nginx-filesystem-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.noarch.rpm
nginx-mod-devel-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.aarch64.rpm
nginx-mod-http-image-filter-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.aarch64.rpm
nginx-mod-http-perl-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.aarch64.rpm
nginx-mod-http-xslt-filter-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.aarch64.rpm
nginx-mod-mail-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.aarch64.rpm
nginx-mod-stream-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.aarch64.rpm


SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates/nginx-1.26.3-9.0.1.module+el9.8.0+90931+68e8e4c5.1.src.rpm

Related CVEs:

CVE-2026-9256




Description of changes:

[1.26.3-9.0.1.1]
- Require oracle-indexhtml

[2:1.26.3-11]
- nginx:1.26/nginx: HTTP/2: Remote Denial of Service via compression bomb
  and Slowloris-style attack

[2:1.26.3-10]
- nginx: code execution and denial of service (CVE-2026-9256)

[2:1.26.3-9]
- Resolves: RHEL-176218 - nginx:1.26/nginx: NGINX: Arbitrary Code Execution
  Vulnerability (CVE-2026-42945)

[2:1.26.3-8]
- CVE-2026-32647 nginx:1.26/nginx: NGINX: Denial of Service or Code
  Execution via specially crafted MP4 files

[2:1.26.3-7]
- CVE-2026-27651 nginx:1.26/nginx: NGINX: Denial of Service via undisclosed
  requests when ngx_mail_auth_http_module is enabled

[2:1.26.3-6]
- CVE-2026-27784 nginx:1.26/nginx: NGINX: Denial of Service due to memory
  corruption via crafted MP4 file

[2:1.26.3-5]
- CVE-2026-27654 nginx:1.26/nginx: NGINX: Denial of Service or file
  modification via buffer overflow in ngx_http_dav_module

[2:1.26.3-4]
- CVE-2026-1642 nginx: NGINX: Data injection via man-in-the-middle attack
  on TLS proxied connections

[2:1.26.3-3]
- Resolves: RHEL-144454 - Clarify binding behavior of -t option