Amazon Linux 2023 Security Advisory: ALAS2023-2026-1773
Advisory Released Date: 2026-06-08
Advisory Updated Date: 2026-06-08
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. (CVE-2026-9256)
Affected Packages:
nginx
Issue Correction:
Run dnf update nginx --releasever 2023.12.20260608 or dnf update --advisory ALAS2023-2026-1773 --releasever 2023.12.20260608 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
aarch64:
nginx-debuginfo-1.30.2-1.amzn2023.0.1.aarch64
nginx-mod-http-xslt-filter-debuginfo-1.30.2-1.amzn2023.0.1.aarch64
nginx-mod-stream-debuginfo-1.30.2-1.amzn2023.0.1.aarch64
nginx-mod-http-xslt-filter-1.30.2-1.amzn2023.0.1.aarch64
nginx-core-debuginfo-1.30.2-1.amzn2023.0.1.aarch64
nginx-debugsource-1.30.2-1.amzn2023.0.1.aarch64
nginx-mod-mail-debuginfo-1.30.2-1.amzn2023.0.1.aarch64
nginx-mod-http-image-filter-debuginfo-1.30.2-1.amzn2023.0.1.aarch64
nginx-mod-http-perl-debuginfo-1.30.2-1.amzn2023.0.1.aarch64
nginx-core-1.30.2-1.amzn2023.0.1.aarch64
nginx-mod-mail-1.30.2-1.amzn2023.0.1.aarch64
nginx-mod-http-image-filter-1.30.2-1.amzn2023.0.1.aarch64
nginx-1.30.2-1.amzn2023.0.1.aarch64
nginx-mod-http-perl-1.30.2-1.amzn2023.0.1.aarch64
nginx-mod-stream-1.30.2-1.amzn2023.0.1.aarch64
nginx-mod-devel-1.30.2-1.amzn2023.0.1.aarch64
noarch:
nginx-filesystem-1.30.2-1.amzn2023.0.1.noarch
nginx-all-modules-1.30.2-1.amzn2023.0.1.noarch
src:
nginx-1.30.2-1.amzn2023.0.1.src
x86_64:
nginx-mod-mail-debuginfo-1.30.2-1.amzn2023.0.1.x86_64
nginx-mod-stream-debuginfo-1.30.2-1.amzn2023.0.1.x86_64
nginx-mod-http-xslt-filter-debuginfo-1.30.2-1.amzn2023.0.1.x86_64
nginx-mod-http-perl-debuginfo-1.30.2-1.amzn2023.0.1.x86_64
nginx-debugsource-1.30.2-1.amzn2023.0.1.x86_64
nginx-core-debuginfo-1.30.2-1.amzn2023.0.1.x86_64
nginx-mod-devel-1.30.2-1.amzn2023.0.1.x86_64
nginx-mod-http-image-filter-debuginfo-1.30.2-1.amzn2023.0.1.x86_64
nginx-core-1.30.2-1.amzn2023.0.1.x86_64
nginx-debuginfo-1.30.2-1.amzn2023.0.1.x86_64
nginx-mod-http-image-filter-1.30.2-1.amzn2023.0.1.x86_64
nginx-mod-stream-1.30.2-1.amzn2023.0.1.x86_64
nginx-mod-mail-1.30.2-1.amzn2023.0.1.x86_64
nginx-1.30.2-1.amzn2023.0.1.x86_64
nginx-mod-http-perl-1.30.2-1.amzn2023.0.1.x86_64
nginx-mod-http-xslt-filter-1.30.2-1.amzn2023.0.1.x86_64