{ "document": { "aggregate_severity": { "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "* SECURITY UPDATE: improper neutralization of CRLF sequences via resolved\n SMTP client host name used in auth_http and smtp proxy\n - debian/patches/CVE-2026-28753.patch: validate that the host name\n resolved from the client address contains only characters permitted\n by RFC 1034 Section 3.5, rejecting it as [TEMPUNAVAIL] otherwise\n - CVE-2026-28753", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1783591916", "url": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1783591916" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_docker/debian13/advisories/2026/clsa-2026_1783591916.json" } ], "tracking": { "current_release_date": "2026-07-09T10:12:47Z", "generator": { "date": "2026-07-09T10:12:47Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1783591916", "initial_release_date": "2026-07-09T10:12:47Z", "revision_history": [ { "date": "2026-07-09T10:12:47Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "Fix CVE(s): CVE-2025-53859, CVE-2026-28753, CVE-2026-42934" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian 13", "product": { "name": "Debian 13", "product_id": "Debian-13", "product_identification_helper": { "cpe": "cpe:2.3:o:debian:debian_linux:13:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Debian" } ], "category": "vendor", "name": "Software in the Public Interest, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.amd64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.amd64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els12?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.amd64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.amd64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els9?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.amd64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.amd64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els8?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.amd64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.amd64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els6?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.amd64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.amd64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els5?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.amd64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.amd64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els3?arch=amd64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els2.amd64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els2.amd64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els2.amd64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els2?arch=amd64&os_name=debian&os_version=13" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.arm64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.arm64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els12?arch=arm64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.arm64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.arm64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els9?arch=arm64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.arm64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.arm64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els8?arch=arm64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.arm64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.arm64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els6?arch=arm64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.arm64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.arm64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els5?arch=arm64&os_name=debian&os_version=13" } } }, { "category": "product_version", "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.arm64", "product": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.arm64", "product_id": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.arm64", "product_identification_helper": { "purl": "pkg:deb/tuxcare/nginx1.23@1.23.4-1~trixie%2Btuxcare.els3?arch=arm64&os_name=debian&os_version=13" } } } ], "category": "architecture", "name": "arm64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.amd64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.amd64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.arm64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.arm64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.arm64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.amd64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.amd64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.arm64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.arm64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.arm64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.amd64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.amd64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.arm64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.arm64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.arm64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.arm64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.arm64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.arm64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.amd64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.amd64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.amd64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.amd64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.arm64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.arm64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.arm64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.amd64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.amd64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.amd64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.arm64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.arm64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.arm64", "relates_to_product_reference": "Debian-13" }, { "category": "default_component_of", "full_product_name": { "name": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els2.amd64 as a component of Debian 13", "product_id": "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els2.amd64" }, "product_reference": "nginx1.23-0:1.23.4-1~trixie+tuxcare.els2.amd64", "relates_to_product_reference": "Debian-13" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-53859", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method \"none,\" and (3) the authentication server returns the \"Auth-Wait\" response header.\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.arm64" ], "known_affected": [ "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.arm64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-docker/cve/CVE-2025-53859" } ], "release_date": "2025-08-13T14:46:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-07-09T10:12:00.126227Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1783591916", "product_ids": [ "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.arm64" ], "url": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1783591916" }, { "category": "none_available", "date": "2025-08-13T14:46:00Z", "details": "Affected", "product_ids": [ "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.arm64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.arm64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ] }, { "cve": "CVE-2026-28753", "cwe": { "id": "CWE-93", "name": "Improper Neutralization of CRLF Sequences ('CRLF Injection')" }, "notes": [ { "category": "description", "text": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.arm64" ], "known_affected": [ "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.arm64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-docker/cve/CVE-2026-28753" }, { "category": "external", "summary": "https://my.f5.com/manage/s/article/K000160367", "url": "https://my.f5.com/manage/s/article/K000160367" } ], "release_date": "2026-03-24T15:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-07-09T10:12:00.126227Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1783591916", "product_ids": [ "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.arm64" ], "url": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1783591916" }, { "category": "none_available", "date": "2026-03-24T15:16:00Z", "details": "Affected", "product_ids": [ "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.arm64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.arm64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ] }, { "cve": "CVE-2026-42934", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering (\"off\") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.\n\n\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.arm64" ], "known_affected": [ "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.arm64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-docker/cve/CVE-2026-42934" }, { "category": "external", "summary": "https://my.f5.com/manage/s/article/K000161028", "url": "https://my.f5.com/manage/s/article/K000161028" } ], "release_date": "2026-05-13T16:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-07-09T10:12:00.126227Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1783591916", "product_ids": [ "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.arm64" ], "url": "https://cve.tuxcare.com/els-docker/releases/CLSA-2026:1783591916" }, { "category": "none_available", "date": "2026-05-13T16:16:00Z", "details": "Affected", "product_ids": [ "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els2.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els3.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els5.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els6.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els8.arm64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els9.arm64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1" }, "products": [ "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.amd64", "Debian-13:nginx1.23-0:1.23.4-1~trixie+tuxcare.els12.arm64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }