Red Hat Ships Urgent nginx Fixes For Five Flaws Including Three Code Execution Bugs
Red Hat has published security advisory RHSA-2026:93472, an Important-rated nginx update issued on 2 November 2026 for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions and related long-life channels. The update closes five separate vulnerabilities in the nginx web and proxy server: CVE-2026-9256 in the ngx_http_rewrite_module, described as allowing code execution and denial of service; CVE-2026-42055, a heap-based buffer overflow reachable through crafted HTTP/2 headers that can lead to arbitrary code execution or denial of service; CVE-2026-42533, arbitrary code execution via crafted HTTP requests; CVE-2026-56434, a heap buffer over-read permitting memory modification or denial of service; and CVE-2026-60005, memory disclosure and denial of service in the ngx_http_slice_module. Affected products span Red Hat Enterprise Linux Server AUS 9.2, RHEL for x86_64 and Power LE Update Services for SAP Solutions 9.2, RHEL for ARM 64 and IBM z Systems with four years of updates, and the Extended Life Cycle channels for x86_64, ARM 64, ppc64le and s390x. The fixed package set is nginx-1.20.1-14.el9_2.7, covering the base nginx package, nginx-core, nginx-all-modules, nginx-filesystem and the http-image-filter, http-perl, http-xslt-filter, mail and stream modules. Any organisation running nginx from Red Hat repositories on a 9.2 extended-support or SAP Solutions system is in scope.
Red Hat has not published exploitation details for these issues beyond the component-level summaries in the advisory, and no proof-of-concept code or attack chain is described in the erratum. What the advisory does establish is which parts of the server are at fault, and that detail is enough to judge exposure. Three of the five flaws sit in code paths that handle attacker-supplied request data: HTTP/2 header parsing for CVE-2026-42055, general HTTP request handling for CVE-2026-42533, and URI rewriting for CVE-2026-9256. The remaining two, CVE-2026-56434 and CVE-2026-60005, involve out-of-bounds memory reads that the advisory ties to memory modification, memory disclosure and service crashes, with the slice module issue affecting byte-range request handling. Red Hat directs CVSS base scores and acknowledgements to the individual CVE pages rather than restating them in the erratum, so per-flaw scoring is not carried in the advisory text itself.
The strategic weight here comes from where nginx sits. It is almost always the first process to touch untrusted traffic, frequently terminating TLS and reverse-proxying for application tiers behind it, so memory-corruption bugs in its request parsers translate directly into pre-authentication exposure on the network edge. The affected channels make this worse rather than better: AUS, Extended Life Cycle and Update Services for SAP Solutions are precisely the subscriptions chosen by organisations that cannot move a workload, which in practice means long-lived SAP landscapes, payment front ends and regulated estates where change windows are rare and the same build has been running for years. A successful attack against the HTTP/2 or request-handling flaws would execute code in the context of the nginx worker process, giving a foothold adjacent to TLS private keys, upstream credentials and internal routing configuration, while the over-read and slice-module issues offer a cheaper path to leaked process memory or an outright outage of the front door. On current exploitation data from FIRST EPSS, CVE-2026-9256 carries a 10.9 percent probability of exploitation in the next 30 days, CVE-2026-42055 6.5 percent, CVE-2026-42533 6.3 percent, CVE-2026-60005 0.7 percent and CVE-2026-56434 0.5 percent. Those figures put the rewrite-module and HTTP/2 issues well above the typical background rate for a freshly patched CVE, and because the vulnerable surface is reachable by anyone who can send a request, the window between advisory publication and opportunistic internet-wide scanning for these specific nginx builds is likely to be short.
Attack Surface
Web Application, Server OS, Infrastructure
Tactics
Initial Access, Execution, Impact
Techniques
- T1190 – Exploit Public-Facing Application
- T1499 – Endpoint Denial of Service
- T1499.004 – Application or System Exploitation
SuperPRO's Threat Countermeasures Procedures
- Update nginx to 1.20.1-14.el9_2.7 or later on all RHEL 9.2 AUS, Extended Life Cycle and Update Services for SAP Solutions hosts using 'dnf update nginx nginx-core nginx-all-modules', then restart the service with 'systemctl restart nginx' – the packages are not active until the worker processes are recycled.
- Inventory affected architectures explicitly: the fixed build is published for x86_64, ppc64le, aarch64 and s390x, and the noarch packages nginx-all-modules-1.20.1-14.el9_2.7 and nginx-filesystem-1.20.1-14.el9_2.7 are shared across them. Verify installed versions with 'rpm -q nginx nginx-core' rather than relying on asset-management records.
- Validate downloaded RPMs against the SHA-256 digests in RHSA-2026:93472 before deployment – for example 932b929b55f3b718f5f8f4ae1e2098850010e1d5dc532ff2c90593b3baa118fe for nginx-1.20.1-14.el9_2.7.src.rpm and d7424563d6c95c0ca0f35a2c56c80d2c50fe8e64f332bc5aa50babedaa841808 for the x86_64 binary RPM.
- Where a change window prevents immediate patching of CVE-2026-42055, disable HTTP/2 on internet-facing virtual hosts by removing the 'http2' parameter from the 'listen' directive (or setting 'http2 off;') in /etc/nginx/nginx.conf and conf.d includes, which removes the crafted-HTTP/2-header path until the update lands.
- Review whether ngx_http_slice_module and ngx_http_rewrite_module are actually required: if the slice module is unused, remove the 'slice' directive and any byte-range slicing configuration to reduce the surface associated with CVE-2026-60005, and audit complex 'rewrite' and 'return' rule sets tied to CVE-2026-9256.
- Use Red Hat Lightspeed patch analysis, referenced in the advisory, to enumerate subscribed systems flagged as affected by RHSA-2026:93472 and track remediation to closure across the AUS, ELS and SAP Solutions channels.
- Add detection for abnormal nginx worker behaviour on patched and unpatched hosts alike: alert on repeated 'worker process exited on signal 11' entries in /var/log/nginx/error.log or the systemd journal, and on nginx worker processes spawning child shells, both of which are consistent with memory-corruption exploitation attempts.
