Skip to content
VulniPulse
Sign in
Advisory severityMedium6.5Red Hat Linux

Medium [CVE-2026-56434] Heap buffer over-read allows memory modification or denial of service

This medium-severity Red Hat Linux advisory covers CVE-2026-56434 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-56434 Source published Source updated

VulniPulse record published Record updated

CVE-2026-56434
Affected products & platforms
Red Hat LinuxWeb Servers & Proxies
Open source advisory

Summary

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured.

With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a use-after-free in the NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX worker process.

There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

A vulnerability in NGINX's ngx_http_ssi_module allows an unauthenticated MITM attacker to trigger a heap buffer over-read by manipulating upstream server responses. This requires SSI, proxy_pass, and proxy_buffering off to be configured, and can result in memory modification or a Denial of Service (DoS).

This Moderate severity vulnerability in NGINX affects configurations utilizing the `ngx_http_ssi_module` alongside `proxy_pass` and `proxy_buffering off`. The specific combination of directives and an active MITM position limits the overall impact.

Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H). Weakness: CWE-125.

Is CVE-2026-56434 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-56434 is not in the CISA KEV catalog (checked ) and this advisory does not report exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-56434?

Upgrade to a fixed release named by Red Hat:

  • nginx-2:1.26.3-6.el10_2.6
  • nginx:1.24-8100020260809162034.489197e6
  • nginx-2:1.20.1-28.el9_8.5
  • nginx:1.24-9080020260804072754.9
  • nginx:1.26-9080020260803214158.9
  • discovery/discovery-ui-rhel9:1788206196
  • nginx-main-1.30.4-2.hum1
  • rhui5/cds-kubernetes-rhel9:1788880445
  • rhui5/cds-rhel9:1788880464
  • rhui5/rhua-rhel9:1788880581
  • RHSA-2026:59220
  • RHSA-2026:59216

6 more fixed releases are listed below.

Confirm against the vendor advisory before you patch.

Affected versions

No affected-version range was extracted from the source record. The vendor advisory is authoritative. Check it before change work.

Official advisory · high-confidence parse· fetched 1 month ago·verify at source

Fixed versions
  • nginx-2:1.26.3-6.el10_2.6
  • nginx:1.24-8100020260809162034.489197e6
  • nginx-2:1.20.1-28.el9_8.5
  • nginx:1.24-9080020260804072754.9
  • nginx:1.26-9080020260803214158.9
  • discovery/discovery-ui-rhel9:1788206196
  • nginx-main-1.30.4-2.hum1
  • rhui5/cds-kubernetes-rhel9:1788880445
  • rhui5/cds-rhel9:1788880464
  • rhui5/rhua-rhel9:1788880581
  • RHSA-2026:59220
  • RHSA-2026:59216
  • RHSA-2026:59362
  • RHSA-2026:59490
  • RHSA-2026:59496
  • RHSA-2026:61783
  • RHSA-2026:46012
  • RHSA-2026:66018

Official advisory · high-confidence parse· fetched 1 month ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • To prevent exploitation, avoid configuring NGINX with `ngx_http_ssi_module` when `proxy_pass` and `proxy_buffering off` are simultaneously active. If Server-Side Includes (SSI) are not essential, disable the `ngx_http_ssi_module` by removing or commenting out the `ssi on;` directive. Alternatively, ensure `proxy_buffering` is explicitly enabled (`proxy_buffering on;`) when `proxy_pass` is used with SSI. A reload or restart of the NGINX service is necessary for configuration changes to apply, which may cause a brief service interruption.

Official advisory · high-confidence parse· fetched 1 month ago·verify at source

Get an email when Red Hat Web Servers & Proxies publishes the next one.

See Red Hat Web Servers & Proxies's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Red Hat Web Servers & Proxies

More Red Hat Linux advisories

All Red Hat Linux advisories

iPhone and Android apps · New on the App Store

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Download on the App StoreGet CVE alerts on AndroidSee app features

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.