Patching nginx, Apache httpd and OpenSSL

Updated November 2026

Web servers face the internet, so patch them first. Update the package, test the configuration, then restart the service. A plain reload does not load a new binary or a new OpenSSL library. After an OpenSSL update, restart every service that uses it, not just the web server.

Check what you are running

Start by finding the exact version and where it came from. The version number alone can mislead you. Distributions backport security fixes into older versions, so a distro build of nginx 1.24 can be fully patched.

nginx -V                 # version, build options, OpenSSL it was built with
apachectl -v             # Apache httpd (on RHEL-family systems also: httpd -v)
openssl version -a       # OpenSSL command-line tool and library version

nginx -V prints a line such as "built with OpenSSL …". If the library loaded at run time differs, nginx adds "(running with OpenSSL …)". On Debian and Ubuntu the Apache tool is also available as apache2ctl.

Then ask the package manager which package and repository supplied the file. Compare that with the distribution's security advisory, not with the upstream version number:

# Debian / Ubuntu
apt policy nginx apache2 openssl
apt changelog nginx | head -n 30

# RHEL, Rocky, AlmaLinux, Fedora
rpm -q nginx httpd openssl openssl-libs
rpm -q --changelog openssl-libs | head -n 30

On Debian 13 and Ubuntu 24.04 and later the OpenSSL library package may be named libssl3t64. Use apt list --installed 'libssl*' to see the real name. More methods are on checking installed versions.

Distro packages or upstream repo

You have two sources for nginx, and the choice decides who ships your fixes.

Distribution packages

The distribution's security team backports fixes into the version it shipped. You patch with your normal update command. This is the simplest path for Apache httpd and OpenSSL, and for most nginx servers.

nginx.org packages

The nginx project runs its own repositories with a stable line (the default) and a mainline line. As of November 2026 the download page lists stable 1.30.6 and mainline 1.31.8. Recent advisories were fixed in pairs, for example in 1.31.7 and 1.30.6. Older "legacy" lines such as 1.28 do not appear in those fixes. If you use this repo, you get new upstream versions, not backports.

The nginx.org repo supports RHEL 8, 9 and 10 and derivatives, Debian 12 and 13, Ubuntu 22.04, 24.04 and 26.04, SLES, Alpine and Amazon Linux 2023. On Debian and Ubuntu, nginx.org tells you to add an APT pin with priority 900, so its packages win over the distribution's. Before you accept the signing key, check that its fingerprint is 573B FD6B 3D8F BC64 1079 A6AB ABF5 BD82 7BD9 BF62, as the nginx.org packages page says. Don't mix the two sources by accident. Run apt policy nginx or dnf info nginx and look at the repository line.

Apache httpd's latest upstream release is 2.4.69, from October 1, 2026. That release fixed 20 CVEs, rated moderate or low. The 2.2 branch is end-of-life. Use your distribution's httpd package unless you build from source on purpose.

Apply the update

# Debian / Ubuntu: refresh, then upgrade just these packages
sudo apt update
sudo apt install --only-upgrade nginx apache2 openssl libssl3t64   # libssl3 on Debian 12 / Ubuntu 22.04

# RHEL family
sudo dnf upgrade --refresh nginx httpd openssl openssl-libs

Leave out package names that don't exist on your system, or the command stops with an error. To patch everything in one pass, see patching fast.

Test the config, then restart

Always test the configuration before you reload or restart. If the test fails, the service keeps running on the old config. You can then fix the error without an outage.

sudo nginx -t
sudo apachectl configtest      # same check as: sudo apachectl -t

Reload and restart do different things:

After a package or OpenSSL update you need the restart. This command restarts the service, so expect a short break:

sudo nginx -t && sudo systemctl restart nginx
sudo apachectl configtest && sudo systemctl restart apache2   # httpd on RHEL family

nginx can also swap its binary without dropping connections. Send USR2 to the master process, then WINCH and QUIT to the old master. The nginx control documentation describes the steps and how to roll back. Some packages restart the service for you when they install and some don't. Check afterwards anyway.

OpenSSL supported branches

Upstream OpenSSL support as of November 3, 2026, from the OpenSSL release strategy and downloads pages:

Long-term support (LTS) releases get at least 5 years, with only security fixes in the final year. Non-LTS releases after 3.5 get 13 months. If you build OpenSSL yourself, move to 3.5, 4.0 or 4.1 now. The OpenSSL project announced its latest fixes on September 29, 2026. They shipped in 4.0.3 and 3.5.9, with some fixes also in older branches.

Restart everything that uses OpenSSL

Updating the library on disk does not change running programs. Each process keeps the old libssl and libcrypto in memory until it restarts. Typical users are web servers, PHP-FPM, mail servers (Postfix, Dovecot), sshd, database servers, VPN daemons and your own applications.

This command lists processes that still map a deleted (old) copy of the library:

for f in $(sudo grep -lE '(libssl|libcrypto).*\(deleted\)' /proc/[0-9]*/maps 2>/dev/null); do
  pid=${f#/proc/}; pid=${pid%/maps}
  ps -o pid=,comm= -p "$pid"
done

Tools such as needrestart on Debian and Ubuntu, and dnf needs-restarting -s on the RHEL family, do the same check by service name. Restart each service it shows. For sshd, keep your current session open and test a new login before you log out. Rebooting is the simplest option when many services are affected. See restarting after an update.

Checklist

• Confirm the version and package source with nginx -V, apachectl -v, openssl version and your package manager.
• Check the distro advisory (or nginx.org / httpd.apache.org if you use upstream builds).
• Update the packages.
• Run nginx -t or apachectl configtest.
• Restart, not reload, after binary or library updates.
• Find and restart every other process still using the old OpenSSL.
• Verify again with nginx -V, or with curl -I against the site.

Sources

• nginx security advisories, nginx.org
• nginx: Linux packages, nginx.org
• nginx: download, nginx.org
• Controlling nginx, nginx.org
• Apache HTTP Server 2.4 vulnerabilities, Apache Software Foundation
• Apache HTTP Server Project, Apache Software Foundation
• Stopping and Restarting Apache HTTP Server, Apache Software Foundation
• Release strategy, OpenSSL Library
• Downloads, OpenSSL Library
• Vulnerabilities, OpenSSL Library