Red Hat Issues Important nginx Update For Two Core Module Flaws On Enterprise Linux 8
Red Hat has published security advisory RHSA-2026:98671, an update for the nginx:1.24 module on Red Hat Enterprise Linux 8, issued on 11 November 2026 and rated Important by Red Hat Product Security. The update addresses two vulnerabilities in nginx, the high-concurrency web and proxy server widely deployed as a public-facing HTTP front end, reverse proxy and load balancer. The first, CVE-2026-15176, is described as a heap-based buffer overflow in ngx_http_core_module reached through an alias directive combined with a rewrite that references the $request_filename variable. The second, CVE-2026-97205, is recorded only as an NGINX ngx_http_core_module vulnerability, with no further mechanism given in the errata. Affected platforms span Red Hat Enterprise Linux for x86_64, IBM z Systems, Power little endian and ARM 64 on version 8, as well as the Extended Life Cycle Support streams for 8.10 on all four architectures.
The advisory itself is a packaging and remediation notice rather than a technical write-up, and Red Hat has not published exploitation details for either issue in the errata text. What is stated is the component and the configuration pattern involved in CVE-2026-15176: the ngx_http_core_module code path that resolves a request to a filesystem location when an alias directive is in play and a rewrite rule references $request_filename. That places the weakness in request handling, which is the part of nginx exposed to whatever traffic reaches the server, though whether a given deployment is reachable depends on whether that alias and rewrite combination exists in the running configuration. CVE-2026-97205 is attributed to the same module but carries no description beyond that, and Red Hat points readers to the individual CVE pages for CVSS base scores, impact statements and acknowledgements. Both issues are tracked internally under Bugzilla 2552352 and 2552359 respectively, and both are resolved in nginx-1.24.0-3.module+el8.10.0+25265+69171071.6, shipped as source and binary RPMs for every listed architecture along with the nginx-mod-stream, nginx-mod-mail, nginx-mod-http-perl, nginx-mod-http-image-filter and nginx-mod-http-xslt-filter subpackages.
The significance here is positional rather than dramatic. nginx typically sits at the network edge, terminating TLS and fronting application servers, so memory-corruption defects in its core request-processing module land on hosts that are deliberately exposed and often shared across many internal services. A heap-based buffer overflow in that position carries the usual spread of worst-case outcomes, from a crashed worker process and loss of service availability through to corruption of in-process memory, which is why Red Hat applied an Important rating rather than Moderate. The Extended Life Cycle Support listing is worth noting on its own, since it signals that organisations still running RHEL 8.10 under extended coverage carry the same exposure as those on the mainstream stream. On current exploitation status, the evidence is measured: FIRST EPSS puts CVE-2026-15176 at a 1.0 percent probability of exploitation within the next 30 days and CVE-2026-97205 at 0.8 percent, and neither CVE appears in any confirmed in-the-wild activity referenced by the advisory. Fixed packages were available at the time of publication, so the practical window of concern is the gap between release and rollout across estates where nginx instances are numerous, automated and easy to lose track of.
Attack Surface
Web Application, Server OS, Infrastructure
Tactics
Initial Access, Impact
Techniques
- T1190 – Exploit Public-Facing Application
- T1499 – Endpoint Denial of Service
- T1499.004 – Application or System Exploitation
SuperPRO's Threat Countermeasures Procedures
- Update the nginx:1.24 module on Red Hat Enterprise Linux 8 to nginx-1.24.0-3.module+el8.10.0+25265+69171071.6 or later, which resolves CVE-2026-15176 and CVE-2026-97205; run 'dnf module update nginx:1.24' and verify with 'rpm -q nginx'.
- Include the subpackages shipped in RHSA-2026:98671 in the same change window, specifically nginx-all-modules, nginx-filesystem, nginx-mod-stream, nginx-mod-mail, nginx-mod-http-perl, nginx-mod-http-image-filter and nginx-mod-http-xslt-filter, so no module binary remains at the vulnerable build level.
- Cover Extended Life Cycle Support estates explicitly – RHEL 8.10 ELS on x86_64, aarch64, ppc64le and s390x is listed as affected, and these hosts are frequently excluded from standard patch automation.
- Audit nginx configuration under /etc/nginx/nginx.conf and /etc/nginx/conf.d/ for 'alias' directives used together with 'rewrite' rules referencing $request_filename, the specific pattern named in CVE-2026-15176, and prioritise those virtual hosts for the update.
- Restart the nginx service after package installation with 'systemctl restart nginx', since running worker processes continue to execute the pre-update binary and will otherwise remain vulnerable until the next reload.
- Use Red Hat Lightspeed patch analysis against the RHSA-2026:98671 advisory ID to enumerate affected systems in the estate, rather than relying on a manual inventory of nginx hosts.
- Alert on repeated nginx worker process crashes in /var/log/messages and journald ('worker process … exited on signal 11') and on abnormal 500 response spikes on alias-backed URI paths, as these are the observable symptoms of a failed heap overflow attempt against ngx_http_core_module.
