{
  "threat_severity" : "Moderate",
  "public_date" : "2026-07-15T14:33:46Z",
  "bugzilla" : {
    "description" : "nginx: NGINX: Heap buffer over-read allows memory modification or denial of service",
    "id" : "2500960",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2500960"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-125",
  "details" : [ "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssi_module module. This vulnerability may exist when the Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to cause a use-after-free in the NGINX worker process. This issue may lead to limited modification of memory or a restart of the NGINX worker process.\nImpact:\nThis vulnerability may allow remote attackers to have limited control to modify memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only.\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "A vulnerability in NGINX's ngx_http_ssi_module allows an unauthenticated MITM attacker to trigger a heap buffer over-read by manipulating upstream server responses. This requires SSI, proxy_pass, and proxy_buffering off to be configured, and can result in memory modification or a Denial of Service (DoS)." ],
  "statement" : "This Moderate severity vulnerability in NGINX affects configurations utilizing the `ngx_http_ssi_module` alongside `proxy_pass` and `proxy_buffering off`. Exploitation requires an unauthenticated man-in-the-middle attacker to control upstream server responses, leading to limited memory modification or a worker process restart. The specific combination of directives and an active MITM position limits the overall impact.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-08-24T00:00:00Z",
    "advisory" : "RHSA-2026:59220",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "nginx-2:1.26.3-6.el10_2.6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-08-24T00:00:00Z",
    "advisory" : "RHSA-2026:59216",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "nginx:1.24-8100020260809162034.489197e6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-08-25T00:00:00Z",
    "advisory" : "RHSA-2026:59362",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "nginx-2:1.20.1-28.el9_8.5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-08-25T00:00:00Z",
    "advisory" : "RHSA-2026:59490",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "nginx:1.24-9080020260804072754.9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-08-25T00:00:00Z",
    "advisory" : "RHSA-2026:59496",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "nginx:1.26-9080020260803214158.9"
  }, {
    "product_name" : "Red Hat Discovery 2",
    "release_date" : "2026-08-31T00:00:00Z",
    "advisory" : "RHSA-2026:61783",
    "cpe" : "cpe:/a:redhat:discovery:2::el9",
    "package" : "discovery/discovery-ui-rhel9:1788206196"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-07-26T00:00:00Z",
    "advisory" : "RHSA-2026:46012",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "nginx-main-1.30.4-2.hum1",
    "impact" : "moderate"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Hardened Images",
    "fix_state" : "Not affected",
    "package_name" : "php",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat Lightspeed proxy 1",
    "fix_state" : "Affected",
    "package_name" : "insights-proxy/insights-proxy-container-rhel9",
    "cpe" : "cpe:/a:redhat:insights_proxy:1"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-56434\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-56434\nhttps://my.f5.com/manage/s/article/K000162098" ],
  "name" : "CVE-2026-56434",
  "mitigation" : {
    "value" : "To prevent exploitation, avoid configuring NGINX with `ngx_http_ssi_module` when `proxy_pass` and `proxy_buffering off` are simultaneously active. If Server-Side Includes (SSI) are not essential, disable the `ngx_http_ssi_module` by removing or commenting out the `ssi on;` directive. Alternatively, ensure `proxy_buffering` is explicitly enabled (`proxy_buffering on;`) when `proxy_pass` is used with SSI. A reload or restart of the NGINX service is necessary for configuration changes to apply, which may cause a brief service interruption.",
    "lang" : "en:us"
  },
  "csaw" : false
}