{"id":"openSUSE-SU-2026:20784-1","summary":"Security update for nginx","details":"This update for nginx fixes the following issues:\n\n- CVE-2026-1642: plain text data injection into the response from an upstream proxied server (bsc#1257675).\n- CVE-2026-27654: buffer overflow in the NGINX worker process via the `ngx_http_dav_module module` (bsc#1260416).\n- CVE-2026-27784: NGINX worker memory over-read or over-write via a specially crafted MP4 file (bsc#1260417).\n- CVE-2026-28753: improper handling onf CRLF sequences in CRLF responses allows for arbitrary header injection into SMTP\n  upstream requests (bsc#1260418).\n- CVE-2026-28755: TLS handshakes can succeed with revoked certificates due to improper handling of such certificates by\n  the `ngx_stream_ssl_module` module (bsc#1260419).\n","modified":"2026-05-26T18:24:19.467621909Z","published":"2026-05-19T17:20:53Z","related":["CVE-2026-1642","CVE-2026-27654","CVE-2026-27784","CVE-2026-28753","CVE-2026-28755"],"upstream":["CVE-2026-1642","CVE-2026-27654","CVE-2026-27784","CVE-2026-28753","CVE-2026-28755"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1257675"},{"type":"REPORT","url":"https://bugzilla.suse.com/1260416"},{"type":"REPORT","url":"https://bugzilla.suse.com/1260417"},{"type":"REPORT","url":"https://bugzilla.suse.com/1260418"},{"type":"REPORT","url":"https://bugzilla.suse.com/1260419"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-1642"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-27654"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-27784"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-28753"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-28755"}],"schema_version":"1.7.5"}