Nginx and CVE-2026-49975

Rocky Linux Help & Support
1

Hello,

We are running Rocky Linux 9 where is nginx 1.26.3 as default version. Today I’m reading about a Hidden HTTP/2 Bomb that should be fixed in nginx 1.29.8+

Please could some of the maintainers check patch for supported nginx 1.26.3 if it can be applied? For the time I have to disable http2.

Source:

https://blog.calif.io/p/codex-discovered-a-hidden-http2-bomb

Thank You.

J.

2

Since Rocky is based on RHEL, then RHEL will be the ones who check and backport a fix if it’s needed. Only at that point will it be in Rocky.