Medium [CVE-2026-56434] Heap buffer over-read allows memory modification or denial of service
This medium-severity Red Hat Linux advisory covers CVE-2026-56434 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured.
With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a use-after-free in the NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX worker process.
There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
A vulnerability in NGINX's ngx_http_ssi_module allows an unauthenticated MITM attacker to trigger a heap buffer over-read by manipulating upstream server responses. This requires SSI, proxy_pass, and proxy_buffering off to be configured, and can result in memory modification or a Denial of Service (DoS).
This Moderate severity vulnerability in NGINX affects configurations utilizing the `ngx_http_ssi_module` alongside `proxy_pass` and `proxy_buffering off`. The specific combination of directives and an active MITM position limits the overall impact.
Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H). Weakness: CWE-125.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 11 days ago·verify at source
- nginx-2:1.26.3-6.el10_2.6
- nginx:1.24-8100020260809162034.489197e6
- nginx-2:1.20.1-28.el9_8.5
- nginx:1.24-9080020260804072754.9
- nginx:1.26-9080020260803214158.9
- discovery/discovery-ui-rhel9:1788206196
- nginx-main-1.30.4-2.hum1
- RHSA-2026:59220
- RHSA-2026:59216
- RHSA-2026:59362
- RHSA-2026:59490
- RHSA-2026:59496
- RHSA-2026:61783
- RHSA-2026:46012
Official advisory · high-confidence parse· fetched 11 days ago·verify at source
Mitigation checklist
- To prevent exploitation, avoid configuring NGINX with `ngx_http_ssi_module` when `proxy_pass` and `proxy_buffering off` are simultaneously active. If Server-Side Includes (SSI) are not essential, disable the `ngx_http_ssi_module` by removing or commenting out the `ssi on;` directive. Alternatively, ensure `proxy_buffering` is explicitly enabled (`proxy_buffering on;`) when `proxy_pass` is used with SSI. A reload or restart of the NGINX service is necessary for configuration changes to apply, which may cause a brief service interruption.
Official advisory · high-confidence parse· fetched 11 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.