MGASA-2026-0301: nginx Mageia
Vulnerability summary
MGASA-2026-0301 is a vulnerability in nginx Mageia with no CVSS score yet.
Advisory lineage
Upstream 3 · Downstream 0Timeline
- 27-07-2026PublishedVulnerability first disclosed.
- 27-07-2026Last modifiedVulnerability information updated.
Description
Updated nginx packages fix security vulnerabilities CVE-2026-42533: Heap buffer overflow might occur in a worker process when using the map directive with regex matching if the map variable was included in a string expression after a capture affected by this map; a similar issue might happen when using a non-cacheable variable in a string expression. Thanks to Mufeed VH of Winfunc Research and Maxim Dounin. . CVE-2026-60005: Uninitialized memory access might occur when using unnamed regex captures with the "slice" directive or background cache update, which could result in worker process memory disclosure or worker process termination. . CVE-2026-56434: Use-after-free might occur when processing a specially crafted proxied backend response with the ngx_http_ssi_filter_module. Thanks to P4P3R-HAK.
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Mageia2 products
- nginx< 1.30.4-1.mga10
- nginx< 1.30.4-1.mga9
1 vendor · 2 products