Issue [BUG] sw-nginx 1.30.1 (CVE-2026-42945 patch) crashes with SIGABRT on AlmaLinux 9.7 + OpenSSL 3.5.1

[thilo72]

Server operating system version

AlmaLinux 9.7

Plesk version and microupdate number

18.0.77 #2

Hi,

I'd like to report a reproducible crash of sw-nginx 1.30.1 that was introduced as part of the CVE-2026-42945 security patch rollout via Plesk.

Environment at time of crash:
- Plesk Obsidian 18.0.77.2
- AlmaLinux 9.7
- OpenSSL 3.5.1 (installed via dnf automatic updates)
- sw-nginx 1.30.1-2.redhat.9+p18.0.77.2+t260415.1740

Current state:
- Upgraded to Plesk 18.0.78.1, AlmaLinux 9.8, OpenSSL 3.5.5
- sw-nginx still pinned to 1.28.3 (see below)
- Available in repo: sw-nginx 1.30.1-2.redhat.9+p18.0.78.1+t260514.1639 (new build, untested)

What happened:

After dnf automatic updated OpenSSL to 3.5.1 on AlmaLinux 9.7, Plesk pushed sw-nginx 1.30.1 as a security update (CVE-2026-42945). Within minutes of sw-nginx 1.30.1 starting, all nginx worker processes crashed repeatedly with SIGABRT and heap corruption errors. The server returned 525 errors via Cloudflare (connection timed out at origin). Downgrading to sw-nginx 1.28.3 immediately resolved the issue.

Symptoms:
- nginx worker processes crash with SIGABRT
- journalctl shows heap corruption in sw-nginx worker
- All domains return 525 (Cloudflare) / connection refused
- sw-nginx master process keeps trying to restart workers, which immediately crash again

Current workaround:
- sw-nginx pinned to 1.28.3 via excludepkgs=sw-nginx* in dnf.conf
- Additional lock via Plesk UI to prevent pum from upgrading (pum ignores dnf.conf excludes)
- RPM backup stored at /usr/local/sbin/ for emergency rollback

The problem this creates:

Staying on sw-nginx 1.28.3 means remaining vulnerable to CVE-2026-42945. This is not acceptable long-term. However, upgrading to 1.30.1 crashes the server. I am stuck between a security vulnerability and a stability issue.

A new build of sw-nginx 1.30.1 is now available for Plesk 18.0.78.1 (built 2026-05-14), but I cannot safely test it on a production server. I do not know whether the new build resolves the OpenSSL 3.5 incompatibility.

Questions:
1. Is the sw-nginx 1.30.1 build shipped with Plesk 18.0.78.1 known to be compatible with OpenSSL 3.5.x on AlmaLinux 9?
2. If not, is a fixed build in progress?
3. Is there a safe way to verify the new build before fully committing to the upgrade?

Has anyone else hit this combination? Any input appreciated.

 

[pleskpanel]

Did you report this here?

 

[alapshin]

Hello @thilo72 thank you for the reporting.
Please refer to the article Vulnerability: CVE-2026-42945: DoS and RCE in nginx before 1.31.1/1.30.1 for mitigation steps.

 

[thilo72]

Did you report this here?

No, bcs I am blocked for posting there since I am a new member here.

 

[Kaspar]

Has anyone else hit this combination? Any input appreciated.

For what it's worth, I am currently running nginx 1.30.2 (from Plesk 18.0.78#2) with OpenSSL 3.5.5 on AlmaLinux 9.8 on production servers without any issues.

 

[thilo72]

For what it's worth, I am currently running nginx 1.30.2 (from Plesk 18.0.78#2) with OpenSSL 3.5.5 on AlmaLinux 9.8 on production servers without any issues.

Thank you. Reassuring. I guess you meant 1.30.1.2 at least I don't see a newer version. Trying it out now.

 

[Kaspar]

Thank you. Reassuring. I guess you meant 1.30.1.2 at least I don't see a newer version. Trying it out now.

No, nginx got updated to 1.30.2 (after yet another vulnerability), this update gets distributed with the Plesk 18.0.78 #2 (and 18.0.77 #4) updates. See Plesk change log for released updates. It might be worth updating your Plesk installation to the latest update (18.0.78 #2 or 18.0.77 #4) and upgrade Alma to 9.8 afterwards, so you to run the latest available openSSL version.