Vulnerability-Lookup

RHSA-2026:36639

Vulnerability from csaf_opensuse - Published: 2026-07-08 00:00 - Updated: 2026-09-16 18:35

Summary

security update for nginx

Severity

Important

Notes

Title of the patch: security update for nginx

Description of the patch: This security update provides a functional equivalent of RHSA-2026:36639. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2026:36639.

Patchnames: RHSA-2026:36639

CVE-2026-42055

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 10 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 9:nginx-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:nginx-all-modules-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:nginx-core-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:nginx-filesystem-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:nginx-mod-devel-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:nginx-mod-http-image-filter-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:nginx-mod-http-perl-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:nginx-mod-http-xslt-filter-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:nginx-mod-mail-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 9:nginx-mod-stream-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64	—	Vendor Fix

Threats

Impact important

References

7 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/r…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://www.suse.com/security/cve/CVE-2026-42055/	self
https://www.suse.com/security/cve/CVE-2026-42055	external
https://bugzilla.suse.com/1268492	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for nginx",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2026:36639.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2026:36639.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2026:36639",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_36639.json"
      },
      {
        "category": "self",
        "summary": "URL for RHSA-2026:36639",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-July/006913.html"
      },
      {
        "category": "self",
        "summary": "E-Mail link for RHSA-2026:36639",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-July/006913.html"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-42055 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-42055/"
      }
    ],
    "title": "security update for nginx",
    "tracking": {
      "current_release_date": "2026-09-16T18:35:42Z",
      "generator": {
        "date": "2026-07-08T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2026:36639",
      "initial_release_date": "2026-07-08T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-07-08T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T17:55:17Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T18:35:42Z",
          "number": "3",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-all-modules-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.noarch",
                "product": {
                  "name": "nginx-all-modules-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.noarch",
                  "product_id": "nginx-all-modules-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/nginx-all-modules@1.26.3-9.module+el9.8.0+24501+a1e882cd.2?arch=noarch\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nginx-filesystem-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.noarch",
                "product": {
                  "name": "nginx-filesystem-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.noarch",
                  "product_id": "nginx-filesystem-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/nginx-filesystem@1.26.3-9.module+el9.8.0+24501+a1e882cd.2?arch=noarch\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nginx-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
                "product": {
                  "name": "nginx-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
                  "product_id": "nginx-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:f5:nginx:2:1.26.3:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/nginx@1.26.3-9.module+el9.8.0+24501+a1e882cd.2?arch=x86_64\u0026epoch=2\u0026upstream=nginx-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nginx-core-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
                "product": {
                  "name": "nginx-core-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
                  "product_id": "nginx-core-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/nginx-core@1.26.3-9.module+el9.8.0+24501+a1e882cd.2?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nginx-mod-devel-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
                "product": {
                  "name": "nginx-mod-devel-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
                  "product_id": "nginx-mod-devel-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/nginx-mod-devel@1.26.3-9.module+el9.8.0+24501+a1e882cd.2?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nginx-mod-http-image-filter-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
                "product": {
                  "name": "nginx-mod-http-image-filter-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
                  "product_id": "nginx-mod-http-image-filter-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/nginx-mod-http-image-filter@1.26.3-9.module+el9.8.0+24501+a1e882cd.2?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nginx-mod-http-perl-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
                "product": {
                  "name": "nginx-mod-http-perl-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
                  "product_id": "nginx-mod-http-perl-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/nginx-mod-http-perl@1.26.3-9.module+el9.8.0+24501+a1e882cd.2?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nginx-mod-http-xslt-filter-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
                "product": {
                  "name": "nginx-mod-http-xslt-filter-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
                  "product_id": "nginx-mod-http-xslt-filter-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/nginx-mod-http-xslt-filter@1.26.3-9.module+el9.8.0+24501+a1e882cd.2?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nginx-mod-mail-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
                "product": {
                  "name": "nginx-mod-mail-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
                  "product_id": "nginx-mod-mail-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/nginx-mod-mail@1.26.3-9.module+el9.8.0+24501+a1e882cd.2?arch=x86_64\u0026epoch=2"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nginx-mod-stream-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
                "product": {
                  "name": "nginx-mod-stream-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
                  "product_id": "nginx-mod-stream-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/nginx-mod-stream@1.26.3-9.module+el9.8.0+24501+a1e882cd.2?arch=x86_64\u0026epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 9",
                "product": {
                  "name": "SUSE Liberty Linux 9",
                  "product_id": "SUSE Liberty Linux 9",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:nginx-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64"
        },
        "product_reference": "nginx-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-all-modules-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.noarch as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:nginx-all-modules-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.noarch"
        },
        "product_reference": "nginx-all-modules-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-core-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:nginx-core-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64"
        },
        "product_reference": "nginx-core-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-filesystem-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.noarch as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:nginx-filesystem-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.noarch"
        },
        "product_reference": "nginx-filesystem-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-mod-devel-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:nginx-mod-devel-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64"
        },
        "product_reference": "nginx-mod-devel-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-mod-http-image-filter-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:nginx-mod-http-image-filter-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64"
        },
        "product_reference": "nginx-mod-http-image-filter-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-mod-http-perl-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:nginx-mod-http-perl-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64"
        },
        "product_reference": "nginx-mod-http-perl-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-mod-http-xslt-filter-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:nginx-mod-http-xslt-filter-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64"
        },
        "product_reference": "nginx-mod-http-xslt-filter-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-mod-mail-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:nginx-mod-mail-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64"
        },
        "product_reference": "nginx-mod-mail-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nginx-mod-stream-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64 as component of SUSE Liberty Linux 9",
          "product_id": "SUSE Liberty Linux 9:nginx-mod-stream-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64"
        },
        "product_reference": "nginx-mod-stream-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 9"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-42055",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-42055"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module  and ngx_http_grpc_module  modules. This vulnerability exists when the proxy_http_version to 2  or grpc_pass  directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers  directive is set to off, and the large_client_header_buffers  directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 9:nginx-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
          "SUSE Liberty Linux 9:nginx-all-modules-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.noarch",
          "SUSE Liberty Linux 9:nginx-core-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
          "SUSE Liberty Linux 9:nginx-filesystem-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.noarch",
          "SUSE Liberty Linux 9:nginx-mod-devel-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
          "SUSE Liberty Linux 9:nginx-mod-http-image-filter-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
          "SUSE Liberty Linux 9:nginx-mod-http-perl-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
          "SUSE Liberty Linux 9:nginx-mod-http-xslt-filter-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
          "SUSE Liberty Linux 9:nginx-mod-mail-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
          "SUSE Liberty Linux 9:nginx-mod-stream-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-42055",
          "url": "https://www.suse.com/security/cve/CVE-2026-42055"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1268492 for CVE-2026-42055",
          "url": "https://bugzilla.suse.com/1268492"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 9:nginx-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
            "SUSE Liberty Linux 9:nginx-all-modules-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.noarch",
            "SUSE Liberty Linux 9:nginx-core-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
            "SUSE Liberty Linux 9:nginx-filesystem-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.noarch",
            "SUSE Liberty Linux 9:nginx-mod-devel-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
            "SUSE Liberty Linux 9:nginx-mod-http-image-filter-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
            "SUSE Liberty Linux 9:nginx-mod-http-perl-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
            "SUSE Liberty Linux 9:nginx-mod-http-xslt-filter-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
            "SUSE Liberty Linux 9:nginx-mod-mail-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
            "SUSE Liberty Linux 9:nginx-mod-stream-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 9:nginx-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
            "SUSE Liberty Linux 9:nginx-all-modules-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.noarch",
            "SUSE Liberty Linux 9:nginx-core-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
            "SUSE Liberty Linux 9:nginx-filesystem-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.noarch",
            "SUSE Liberty Linux 9:nginx-mod-devel-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
            "SUSE Liberty Linux 9:nginx-mod-http-image-filter-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
            "SUSE Liberty Linux 9:nginx-mod-http-perl-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
            "SUSE Liberty Linux 9:nginx-mod-http-xslt-filter-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
            "SUSE Liberty Linux 9:nginx-mod-mail-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64",
            "SUSE Liberty Linux 9:nginx-mod-stream-2:1.26.3-9.module+el9.8.0+24501+a1e882cd.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-07-08T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-42055"
    }
  ]
}

CVE-2026-42055 (GCVE-0-2026-42055)

Vulnerability from cvelistv5 – Published: 2026-06-17 14:04 – Updated: 2026-09-14 12:04 X_F5

Title

NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability

Summary

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-17 00:00 UTC

CWE

CWE-122 - Heap-based Buffer Overflow
CWE-131 - Incorrect Calculation of Buffer Size

Assigner

f5 mitre root

References

13 references

URL	Tags
https://my.f5.com/manage/s/article/K000161584	vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-42055	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2489866	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:36364	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:38847	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36618	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36331	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36639	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:46836	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27197	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44481	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:58981	vendor-advisoryx_refsource_REDHAT

Impacted products

15 products

Vendor	Product	Version
F5	NGINX Open Source	Affected: 1.13.10 , < 1.31.2 (custom) Affected: 1.30.2 , < 1.30.3 (custom)
F5	NGINX Plus	Affected: 37.0 , < 37.0.2.1 (custom) Affected: R36 , < R36 P6 (custom)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 2:1.26.3-6.el10_2.5 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260707171317.489197e6 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 2:1.20.1-28.el9_8.4 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9080020260707164406.9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9080020260707110000.9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Discovery 2	Unaffected: 1784821750 , < * (rpm) cpe:/a:redhat:discovery:2::el9
Red Hat	Red Hat Hardened Images	Unaffected: 1.30.3-2.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1784794818 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1784794778 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1784795076 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1787241211 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1787241260 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Openshift Data Foundation 4	cpe:/a:redhat:openshift_data_foundation:4

Date Public

2026-06-17 14:00

Credits

"F5 acknowledges Mufeed VH of Winfunc Research, Trung Nguyen (@everping) of CyStack, Feng Xue and XGPT of ThreatBook, Hcamael and 章鱼哥 of aipyapp, and Zhen Yan (AntAISecurityLab) for bringing this issue to our attention and following the highest standards of coordinated disclosure."

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42055",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-17T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-18T03:57:46.697Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "nginx",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "2:1.26.3-6.el10_2.5",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "nginx:1.24",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260707171317.489197e6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "nginx",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "2:1.20.1-28.el9_8.4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "nginx:1.24",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9080020260707164406.9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "nginx:1.26",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9080020260707110000.9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:discovery:2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "discovery/discovery-ui-rhel9",
            "product": "Red Hat Discovery 2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784821750",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "nginx-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1.30.3-2.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/cds-kubernetes-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784794818",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/cds-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784794778",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/rhua-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784795076",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/cds-kubernetes-tp-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787241211",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/rhua-tp-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787241260",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "odf4/ocs-client-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "odf4/odf-multicluster-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-17T14:04:32.520Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in NGINX. When NGINX is configured to proxy HTTP/2 traffic using the ngx_http_proxy_v2_module or ngx_http_grpc_module with specific settings, a remote, unauthenticated attacker can send specially crafted large headers. This can trigger a heap-based buffer overflow, leading to a restart of the NGINX worker process and a Denial of Service (DoS). Under certain conditions, such as when Address Space Layout Randomization (ASLR) is disabled or bypassed, this vulnerability could also allow for arbitrary code execution."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-131",
                "description": "Incorrect Calculation of Buffer Size",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T12:04:28.530Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-42055"
          },
          {
            "name": "RHBZ#2489866",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489866"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42055.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36364"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:38847"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36618"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36331"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36639"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:46836"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27197"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44481"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:58981"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:36364: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:38847: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36618: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36331: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36639: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:46836: Red Hat Discovery 2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27197: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44481: Red Hat Update Infrastructure 5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:58981: Red Hat Update Infrastructure 5"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-17T16:01:41.848Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-17T14:04:32.520Z",
            "value": "Made public."
          }
        ],
        "title": "nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this vulnerability, ensure that the `ignore_invalid_headers` directive is set to `on` in your NGINX configuration, or reduce the size specified by the `large_client_header_buffers` directive to 2 megabytes or less. These changes require an NGINX service reload or restart to take effect. Reloading the NGINX service is generally safe, but a restart will briefly interrupt service."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "ngx_http_proxy_v2_module",
            "ngx_http_grpc_module"
          ],
          "product": "NGINX Open Source",
          "vendor": "F5",
          "versions": [
            {
              "lessThan": "1.31.2",
              "status": "affected",
              "version": "1.13.10",
              "versionType": "custom"
            },
            {
              "lessThan": "1.30.3",
              "status": "affected",
              "version": "1.30.2",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "modules": [
            "ngx_http_proxy_v2_module",
            "ngx_http_grpc_module"
          ],
          "product": "NGINX Plus",
          "vendor": "F5",
          "versions": [
            {
              "lessThan": "37.0.2.1",
              "status": "affected",
              "version": "37.0",
              "versionType": "custom"
            },
            {
              "lessThan": "R36 P6",
              "status": "affected",
              "version": "R36",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "\"F5 acknowledges Mufeed VH of Winfunc Research, Trung Nguyen (@everping) of CyStack, Feng Xue and XGPT of ThreatBook, Hcamael and \u7ae0\u9c7c\u54e5 of aipyapp, and Zhen Yan (AntAISecurityLab) for bringing this issue to our attention and following the highest standards of coordinated disclosure.\""
        }
      ],
      "datePublic": "2026-06-17T14:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eNGINX Plus and NGINX Open Source have a vulnerability in the \u003c/span\u003e\u003cstrong\u003engx_http_proxy_v2_module\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;and \u003c/span\u003e\u003cstrong\u003engx_http_grpc_module\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;modules. This vulnerability exists when the \u003c/span\u003e\u003cstrong\u003eproxy_http_version to 2\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;or \u003c/span\u003e\u003cstrong\u003egrpc_pass\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;directives are used to proxy HTTP/2 traffic, the \u003c/span\u003e\u003cstrong\u003eignore_invalid_headers\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;directive is set to off, and the \u003c/span\u003e\u003cstrong\u003elarge_client_header_buffers\u003c/strong\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\u003c/span\u003e \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
            }
          ],
          "value": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module\u00a0and ngx_http_grpc_module\u00a0modules. This vulnerability exists when the proxy_http_version to 2\u00a0or grpc_pass\u00a0directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers\u00a0directive is set to off, and the large_client_header_buffers\u00a0directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122 Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-17T14:04:32.520Z",
        "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
        "shortName": "f5"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://my.f5.com/manage/s/article/K000161584"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_F5"
      ],
      "title": "NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability",
      "x_generator": {
        "engine": "F5 SIRTBot v1.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
    "assignerShortName": "f5",
    "cveId": "CVE-2026-42055",
    "datePublished": "2026-06-17T14:04:32.520Z",
    "dateReserved": "2026-06-02T21:45:04.818Z",
    "dateUpdated": "2026-09-14T12:04:28.530Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.