Is CVE-2026-27654 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27654 being exploited in the wild.

How severe is CVE-2026-27654?

High severity, with a CVSS score of 8.2, published 24 March 2026.

Which products and versions are affected?

Red Hat Enterprise Linux AppStream 8, 9, 10.

Is there a fix for CVE-2026-27654?

A patch was published on 2026-05-05: Red Hat released security updates for RHEL 10.0 EUS Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27654 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-27654?

Check whether you run F5 Nginx Plus or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27654: NGINX buffer overflow in ngx_http_dav_module

CVE-2026-27654 · Severity: high · CVSS 8.2 · Published 2026-03-24

NGINX Open Source and NGINX Plus are widely used web servers and load balancers. A vulnerability in the module responsible for WebDAV file management could allow a remote attacker to crash the server's worker processes or potentially modify file names outside of the intended directory. While the impact is somewhat limited by the low privileges of the NGINX process, an exploit could still lead to service outages or unauthorized file manipulation.

Technologies: F5 Nginx Plus, Red Hat Enterprise Linux AppStream. Vendors: F5, Red Hat.

Quick answers

Is CVE-2026-27654 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27654 being exploited in the wild.
How severe is CVE-2026-27654?: High severity, with a CVSS score of 8.2, published 24 March 2026.
Which products and versions are affected?: Red Hat Enterprise Linux AppStream 8, 9, 10.
Is there a fix for CVE-2026-27654?: A patch was published on 2026-05-05: Red Hat released security updates for RHEL 10.0 EUS Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27654 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-27654?: Check whether you run F5 Nginx Plus or Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A buffer overflow vulnerability exists in the ngx_http_dav_module of NGINX Open Source and NGINX Plus. The flaw is triggered when the configuration utilizes the DAV module's MOVE or COPY methods in conjunction with prefix locations (non-regular expression) and the 'alias' directive. A remote, unauthenticated attacker can exploit this to cause a heap-based buffer overflow in the NGINX worker process. Successful exploitation can result in the termination of the worker process (Denial of Service) or the modification of source/destination file names outside the configured document root. Integrity impact is mitigated by the fact that NGINX worker processes typically run with low-privileged user accounts. Patches are available through vendor updates, including Red Hat Enterprise Linux errata.

Affected products

F5 NGINX NGINX Open Source
F5 NGINX NGINX Plus
Red Hat Enterprise Linux AppStream 8, 9, 10
Red Hat Update Infrastructure (RHUI) 5.1

Timeline

2026-03-24: disclosed
2026-03-24: advisory: Initial NVD publication
2026-05-05: patched: Red Hat released security updates for RHEL 10.0 EUS

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.