{"schema":"vulnpedia.research/1","cve":"CVE-2026-42533","references":[{"url":"https://my.f5.com/manage/s/article/K000162097","tags":["vendor-advisory","patch","Vendor Advisory","vendor-reference"],"source":"mitre","sourceId":"f5","modified":"2026-07-15T21:20:26.156Z","origins":[{"source":"mitre","sourceId":"f5","modified":"2026-07-15T21:20:26.156Z","url":"https://my.f5.com/manage/s/article/K000162097"},{"source":"nvd","sourceId":"CVE-2026-42533","modified":"2026-08-10T15:28:01.940","url":"https://my.f5.com/manage/s/article/K000162097"},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://my.f5.com/manage/s/article/K000162097"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42533","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-42533"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500967","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500967"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42533","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-42533"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42533","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42533"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:67314","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:67314"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:67315","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:67315"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:66542","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:66542"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:67308","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:67308"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:67283","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:67283"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:46012","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:46012"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:79357","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://access.redhat.com/errata/RHSA-2026:79357"}]},{"source":"euvd","sourceId":"EUVD-2026-44683","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44683","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-44683","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44683"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/0xCyberstan/CVE-2026-42533-Config-Scanner","source":"poc-in-github","sourceId":"CVE-2026-42533","description":"Static config scanner that flags nginx configs vulnerable to the complex_value two-pass capture-clobbering bug (regex map + regex capture → heap overflow / info leak).","modified":"2026-10-22T00:55:09Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-42533","url":"https://github.com/0xCyberstan/CVE-2026-42533-Config-Scanner"},{"source":"poc-in-github","sourceId":"CVE-2026-42533","modified":"2026-10-22T00:55:09Z","url":"https://github.com/0xCyberstan/CVE-2026-42533-Config-Scanner"}],"tags":[]},{"url":"https://github.com/srkyn/nginx-map-risk-audit","source":"poc-in-github","sourceId":"CVE-2026-42533","description":"Defensive NGINX CVE-2026-42533 map regex risk audit with config scanner, Splunk/Defender notes, and lab evidence.","modified":"2026-07-20T01:45:05Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-42533","url":"https://github.com/srkyn/nginx-map-risk-audit"},{"source":"poc-in-github","sourceId":"CVE-2026-42533","modified":"2026-07-20T01:45:05Z","url":"https://github.com/srkyn/nginx-map-risk-audit"}],"tags":[]},{"url":"https://github.com/Daniyal48/ghostlock-vagrant-box","source":"poc-in-github","sourceId":"CVE-2026-42533","description":"An isolated Vagrant testbed designed to simulate a complete attack chain: Initial access via the Nginx heap buffer overflow (CVE-2026-42533) followed by root privilege escalation using the Ghostlock kernel vulnerability (CVE-2026-43449).","modified":"2026-08-05T12:47:31Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-42533","url":"https://github.com/Daniyal48/ghostlock-vagrant-box"},{"source":"poc-in-github","sourceId":"CVE-2026-42533","modified":"2026-08-05T12:47:31Z","url":"https://github.com/Daniyal48/ghostlock-vagrant-box"}],"tags":[]},{"url":"https://github.com/suominen/CVE-2026-42533","source":"poc-in-github","sourceId":"CVE-2026-42533","description":"Tracking the nginx CVE-2026-42533 map/regex capture-clobbering heap overflow","modified":"2026-10-12T07:19:27Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-42533","url":"https://github.com/suominen/CVE-2026-42533"},{"source":"poc-in-github","sourceId":"CVE-2026-42533","modified":"2026-10-12T07:19:27Z","url":"https://github.com/suominen/CVE-2026-42533"}],"tags":[]},{"url":"https://github.com/seguridadentrerios/CVE-2026-42533","source":"poc-in-github","sourceId":"CVE-2026-42533","description":"Vulnerabilidad en NGINX","modified":"2026-07-23T06:07:56Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-42533","url":"https://github.com/seguridadentrerios/CVE-2026-42533"},{"source":"poc-in-github","sourceId":"CVE-2026-42533","modified":"2026-07-23T06:07:56Z","url":"https://github.com/seguridadentrerios/CVE-2026-42533"}],"tags":[]},{"url":"https://github.com/gagaltotal/CVE-2026-42533-nginx","source":"poc-in-github","sourceId":"CVE-2026-42533","description":"CVE-2026-42533 Nginx","modified":"2026-07-23T10:25:20Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-42533","url":"https://github.com/gagaltotal/CVE-2026-42533-nginx"},{"source":"poc-in-github","sourceId":"CVE-2026-42533","modified":"2026-07-23T10:25:20Z","url":"https://github.com/gagaltotal/CVE-2026-42533-nginx"}],"tags":[]},{"url":"https://github.com/jelasin/CVE-2026-42533","source":"poc-in-github","sourceId":"CVE-2026-42533","modified":"2026-07-29T11:51:08Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-42533","url":"https://github.com/jelasin/CVE-2026-42533"},{"source":"poc-in-github","sourceId":"CVE-2026-42533","modified":"2026-07-29T11:51:08Z","url":"https://github.com/jelasin/CVE-2026-42533"}],"tags":[]},{"url":"https://github.com/imbas007/CVE-2026-42533","source":"poc-in-github","sourceId":"CVE-2026-42533","description":"nginx heap buffer overflow PoC — CVE-2026-42533 pre-auth RCE via two-pass capture clobbering. Crash confirmed on Ubuntu 24.04.","modified":"2026-08-26T13:19:17Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-42533","url":"https://github.com/imbas007/CVE-2026-42533"},{"source":"poc-in-github","sourceId":"CVE-2026-42533","modified":"2026-08-26T13:19:17Z","url":"https://github.com/imbas007/CVE-2026-42533"}],"tags":[]},{"url":"https://github.com/0xCyberstan/CVE-2026-42533-POC","source":"poc-in-github","sourceId":"CVE-2026-42533","description":"CVE-2026-42533: pre-auth nginx heap overflow and info leak from PCRE capture clobbering in the map/script engine, chained to RCE.","modified":"2026-08-17T08:41:26Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-42533","url":"https://github.com/0xCyberstan/CVE-2026-42533-POC"},{"source":"poc-in-github","sourceId":"CVE-2026-42533","modified":"2026-08-17T08:41:26Z","url":"https://github.com/0xCyberstan/CVE-2026-42533-POC"}],"tags":[]},{"url":"https://github.com/Leeyoonjoo/CVE-2026-42533","source":"poc-in-github","sourceId":"CVE-2026-42533","modified":"2026-08-17T10:30:32Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-42533","url":"https://github.com/Leeyoonjoo/CVE-2026-42533"},{"source":"poc-in-github","sourceId":"CVE-2026-42533","modified":"2026-08-17T10:30:32Z","url":"https://github.com/Leeyoonjoo/CVE-2026-42533"}],"tags":[]},{"url":"https://github.com/FranklinF25/cve-2026-42533","source":"poc-in-github","sourceId":"CVE-2026-42533","description":"CVE-2026-42533 — NGINX pre-auth heap overflow: analysis, safe detector, in-lab RCE","modified":"2026-10-22T00:41:45Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-42533","url":"https://github.com/FranklinF25/cve-2026-42533"},{"source":"poc-in-github","sourceId":"CVE-2026-42533","modified":"2026-10-22T00:41:45Z","url":"https://github.com/FranklinF25/cve-2026-42533"}],"tags":[]},{"url":"https://github.com/ivanesk315/CVE-2026-42533","source":"poc-in-github","sourceId":"CVE-2026-42533","modified":"2026-09-10T07:14:54Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-42533","url":"https://github.com/ivanesk315/CVE-2026-42533"},{"source":"poc-in-github","sourceId":"CVE-2026-42533","modified":"2026-09-10T07:14:54Z","url":"https://github.com/ivanesk315/CVE-2026-42533"}],"tags":[]}],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"AppStream-10.2.Z:nginx-2:1.26.3-6.el10_2.7.aarch64","product":"nginx-2:1.26.3-6.el10_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:67314"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx@1.26.3-6.el10_2.7?arch=aarch64&epoch=2","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"AppStream-10.2.Z:nginx-debuginfo-2:1.26.3-6.el10_2.7.aarch64","product":"nginx-debuginfo-2:1.26.3-6.el10_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:67314"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-debuginfo@1.26.3-6.el10_2.7?arch=aarch64&epoch=2","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"AppStream-10.2.Z:nginx-mod-http-image-filter-debuginfo-2:1.26.3-6.el10_2.7.s390x","product":"nginx-mod-http-image-filter-debuginfo-2:1.26.3-6.el10_2.7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:67314"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-mod-http-image-filter-debuginfo@1.26.3-6.el10_2.7?arch=s390x&epoch=2","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"AppStream-10.2.Z:nginx-mod-http-xslt-filter-debuginfo-2:1.26.3-6.el10_2.7.aarch64","product":"nginx-mod-http-xslt-filter-debuginfo-2:1.26.3-6.el10_2.7.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:67314"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-mod-http-xslt-filter-debuginfo@1.26.3-6.el10_2.7?arch=aarch64&epoch=2","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"AppStream-10.2.Z:nginx-mod-stream-2:1.26.3-6.el10_2.7.s390x","product":"nginx-mod-stream-2:1.26.3-6.el10_2.7.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:67314"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-mod-stream@1.26.3-6.el10_2.7?arch=s390x&epoch=2","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"AppStream-8.10.0.Z.MAIN.EUS:nginx-debuginfo-1:1.24.0-3.module+el8.10.0+24848+0300f002.5.x86_64::nginx:1.24","product":"nginx-debuginfo-1:1.24.0-3.module+el8.10.0+24848+0300f002.5.x86_64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:67315"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-debuginfo@1.24.0-3.module%2Bel8.10.0%2B24848%2B0300f002.5?arch=x86_64&epoch=1&rpmmod=nginx:1.24:8100020260908154808:489197e6","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"AppStream-8.10.0.Z.MAIN.EUS:nginx-mod-http-image-filter-debuginfo-1:1.24.0-3.module+el8.10.0+24848+0300f002.5.aarch64::nginx:1.24","product":"nginx-mod-http-image-filter-debuginfo-1:1.24.0-3.module+el8.10.0+24848+0300f002.5.aarch64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:67315"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-mod-http-image-filter-debuginfo@1.24.0-3.module%2Bel8.10.0%2B24848%2B0300f002.5?arch=aarch64&epoch=1&rpmmod=nginx:1.24:8100020260908154808:489197e6","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"AppStream-8.10.0.Z.MAIN.EUS:nginx-mod-http-xslt-filter-1:1.24.0-3.module+el8.10.0+24848+0300f002.5.s390x::nginx:1.24","product":"nginx-mod-http-xslt-filter-1:1.24.0-3.module+el8.10.0+24848+0300f002.5.s390x (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:67315"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-mod-http-xslt-filter@1.24.0-3.module%2Bel8.10.0%2B24848%2B0300f002.5?arch=s390x&epoch=1&rpmmod=nginx:1.24:8100020260908154808:489197e6","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"AppStream-8.10.0.Z.MAIN.EUS:nginx-mod-stream-1:1.24.0-3.module+el8.10.0+24848+0300f002.5.ppc64le::nginx:1.24","product":"nginx-mod-stream-1:1.24.0-3.module+el8.10.0+24848+0300f002.5.ppc64le (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 8)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:67315"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-mod-stream@1.24.0-3.module%2Bel8.10.0%2B24848%2B0300f002.5?arch=ppc64le&epoch=1&rpmmod=nginx:1.24:8100020260908154808:489197e6","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"AppStream-9.8.0.Z.MAIN.EUS:nginx-2:1.20.1-28.el9_8.6.s390x","product":"nginx-2:1.20.1-28.el9_8.6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:66542"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx@1.20.1-28.el9_8.6?arch=s390x&epoch=2","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"AppStream-9.8.0.Z.MAIN.EUS:nginx-core-1:1.24.0-7.module+el9.8.0+24846+e7eec568.5.x86_64::nginx:1.24","product":"nginx-core-1:1.24.0-7.module+el9.8.0+24846+e7eec568.5.x86_64 (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:67308"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-core@1.24.0-7.module%2Bel9.8.0%2B24846%2Be7eec568.5?arch=x86_64&epoch=1&rpmmod=nginx:1.24:9080020260908110425:9","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"AppStream-9.8.0.Z.MAIN.EUS:nginx-core-debuginfo-2:1.20.1-28.el9_8.6.s390x","product":"nginx-core-debuginfo-2:1.20.1-28.el9_8.6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:66542"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-core-debuginfo@1.20.1-28.el9_8.6?arch=s390x&epoch=2","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"AppStream-9.8.0.Z.MAIN.EUS:nginx-debuginfo-2:1.26.3-9.module+el9.8.0+24845+a897661e.4.aarch64::nginx:1.26","product":"nginx-debuginfo-2:1.26.3-9.module+el9.8.0+24845+a897661e.4.aarch64 (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:67283"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-debuginfo@1.26.3-9.module%2Bel9.8.0%2B24845%2Ba897661e.4?arch=aarch64&epoch=2&rpmmod=nginx:1.26:9080020260908105507:9","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"AppStream-9.8.0.Z.MAIN.EUS:nginx-debugsource-2:1.26.3-9.module+el9.8.0+24845+a897661e.4.s390x::nginx:1.26","product":"nginx-debugsource-2:1.26.3-9.module+el9.8.0+24845+a897661e.4.s390x (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:67283"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-debugsource@1.26.3-9.module%2Bel9.8.0%2B24845%2Ba897661e.4?arch=s390x&epoch=2&rpmmod=nginx:1.26:9080020260908105507:9","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"AppStream-9.8.0.Z.MAIN.EUS:nginx-mod-http-image-filter-1:1.24.0-7.module+el9.8.0+24846+e7eec568.5.s390x::nginx:1.24","product":"nginx-mod-http-image-filter-1:1.24.0-7.module+el9.8.0+24846+e7eec568.5.s390x (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:67308"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-mod-http-image-filter@1.24.0-7.module%2Bel9.8.0%2B24846%2Be7eec568.5?arch=s390x&epoch=1&rpmmod=nginx:1.24:9080020260908110425:9","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"AppStream-9.8.0.Z.MAIN.EUS:nginx-mod-http-image-filter-debuginfo-2:1.20.1-28.el9_8.6.aarch64","product":"nginx-mod-http-image-filter-debuginfo-2:1.20.1-28.el9_8.6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:66542"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-mod-http-image-filter-debuginfo@1.20.1-28.el9_8.6?arch=aarch64&epoch=2","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"AppStream-9.8.0.Z.MAIN.EUS:nginx-mod-http-perl-2:1.20.1-28.el9_8.6.x86_64","product":"nginx-mod-http-perl-2:1.20.1-28.el9_8.6.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:66542"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-mod-http-perl@1.20.1-28.el9_8.6?arch=x86_64&epoch=2","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"AppStream-9.8.0.Z.MAIN.EUS:nginx-mod-http-perl-debuginfo-2:1.26.3-9.module+el9.8.0+24845+a897661e.4.ppc64le::nginx:1.26","product":"nginx-mod-http-perl-debuginfo-2:1.26.3-9.module+el9.8.0+24845+a897661e.4.ppc64le (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:67283"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-mod-http-perl-debuginfo@1.26.3-9.module%2Bel9.8.0%2B24845%2Ba897661e.4?arch=ppc64le&epoch=2&rpmmod=nginx:1.26:9080020260908105507:9","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"AppStream-9.8.0.Z.MAIN.EUS:nginx-mod-http-xslt-filter-2:1.26.3-9.module+el9.8.0+24845+a897661e.4.x86_64::nginx:1.26","product":"nginx-mod-http-xslt-filter-2:1.26.3-9.module+el9.8.0+24845+a897661e.4.x86_64 (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:67283"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-mod-http-xslt-filter@1.26.3-9.module%2Bel9.8.0%2B24845%2Ba897661e.4?arch=x86_64&epoch=2&rpmmod=nginx:1.26:9080020260908105507:9","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"AppStream-9.8.0.Z.MAIN.EUS:nginx-mod-mail-1:1.24.0-7.module+el9.8.0+24846+e7eec568.5.s390x::nginx:1.24","product":"nginx-mod-mail-1:1.24.0-7.module+el9.8.0+24846+e7eec568.5.s390x (nginx:1.24) as a component of Red Hat Enterprise Linux AppStream (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:67308"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-mod-mail@1.24.0-7.module%2Bel9.8.0%2B24846%2Be7eec568.5?arch=s390x&epoch=1&rpmmod=nginx:1.24:9080020260908110425:9","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"AppStream-9.8.0.Z.MAIN.EUS:nginx-mod-mail-debuginfo-2:1.20.1-28.el9_8.6.aarch64","product":"nginx-mod-mail-debuginfo-2:1.20.1-28.el9_8.6.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:66542"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-mod-mail-debuginfo@1.20.1-28.el9_8.6?arch=aarch64&epoch=2","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"AppStream-9.8.0.Z.MAIN.EUS:nginx-mod-stream-2:1.20.1-28.el9_8.6.s390x","product":"nginx-mod-stream-2:1.20.1-28.el9_8.6.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:66542"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-mod-stream@1.20.1-28.el9_8.6?arch=s390x&epoch=2","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"AppStream-9.8.0.Z.MAIN.EUS:nginx-mod-stream-debuginfo-2:1.26.3-9.module+el9.8.0+24845+a897661e.4.ppc64le::nginx:1.26","product":"nginx-mod-stream-debuginfo-2:1.26.3-9.module+el9.8.0+24845+a897661e.4.ppc64le (nginx:1.26) as a component of Red Hat Enterprise Linux AppStream (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:67283"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-mod-stream-debuginfo@1.26.3-9.module%2Bel9.8.0%2B24845%2Ba897661e.4?arch=ppc64le&epoch=2&rpmmod=nginx:1.26:9080020260908105507:9","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"CRB-10.2.Z:nginx-debugsource-2:1.26.3-6.el10_2.7.x86_64","product":"nginx-debugsource-2:1.26.3-6.el10_2.7.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:67314"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-debugsource@1.26.3-6.el10_2.7?arch=x86_64&epoch=2","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"CRB-10.2.Z:nginx-mod-http-xslt-filter-debuginfo-2:1.26.3-6.el10_2.7.ppc64le","product":"nginx-mod-http-xslt-filter-debuginfo-2:1.26.3-6.el10_2.7.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:67314"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-mod-http-xslt-filter-debuginfo@1.26.3-6.el10_2.7?arch=ppc64le&epoch=2","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"CRB-9.8.0.Z.MAIN.EUS:nginx-debuginfo-2:1.20.1-28.el9_8.6.aarch64","product":"nginx-debuginfo-2:1.20.1-28.el9_8.6.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:66542"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-debuginfo@1.20.1-28.el9_8.6?arch=aarch64&epoch=2","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"CRB-9.8.0.Z.MAIN.EUS:nginx-mod-http-image-filter-debuginfo-2:1.20.1-28.el9_8.6.s390x","product":"nginx-mod-http-image-filter-debuginfo-2:1.20.1-28.el9_8.6.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:66542"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-mod-http-image-filter-debuginfo@1.20.1-28.el9_8.6?arch=s390x&epoch=2","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"CRB-9.8.0.Z.MAIN.EUS:nginx-mod-stream-debuginfo-2:1.20.1-28.el9_8.6.aarch64","product":"nginx-mod-stream-debuginfo-2:1.20.1-28.el9_8.6.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258","url":"https://access.redhat.com/errata/RHSA-2026:66542"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-mod-stream-debuginfo@1.20.1-28.el9_8.6?arch=aarch64&epoch=2","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"Red Hat Hardened Images:nginx-mod-devel-0:1.30.4-2.hum1@x86_64","product":"nginx-mod-devel-0:1.30.4-2.hum1@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:46012"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-mod-devel@1.30.4-2.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"Red Hat Hardened Images:nginx-mod-stream-geoip-0:1.30.4-2.hum1@x86_64","product":"nginx-mod-stream-geoip-0:1.30.4-2.hum1@x86_64 as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:46012"},{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."}],"purl":"pkg:rpm/redhat/nginx-mod-stream-geoip@1.30.4-2.hum1?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"red_hat_lightspeed_proxy_1:insights-proxy/insights-proxy-container-rhel9","product":"insights-proxy/insights-proxy-container-rhel9 as a component of Red Hat Lightspeed proxy 1","status":"known_affected","remediations":[{"category":"workaround","details":"To mitigate this vulnerability, do not use unnamed captures. Use named captures instead and only use them in the same block with the regex match.\nRed Hat recommends updating nginx to the latest version when a fix is available."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/insights-proxy-container-rhel9?repository_url=registry.redhat.io/insights-proxy/insights-proxy-container-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]},{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json","productId":"red_hat_hardened_images:php.src","product":"php.src as a component of Red Hat Hardened Images","status":"known_not_affected","remediations":[],"justification":"component_not_present","purl":"pkg:rpm/redhat/php@8.5.8-2.hum1?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-42533","modified":"2026-10-09T00:47:44+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42533.json"}]}],"vendorCoverage":{"total":419,"shown":32,"omitted":387,"source":"redhat"}}