SB2026081734 - Gentoo update for nginx

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081734

SB2026081734 - Gentoo update for nginx

Published: August 17, 2026 Updated: August 21, 2026

Security Bulletin ID SB2026081734
CSH Severity
Critical
Patch available
YES
Number of vulnerabilities 20
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Critical 10% High 30% Medium 50% Low 10%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 20 vulnerabilities.


1) Use-after-free (CVE-ID: CVE-2026-40701)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service or modify data in a limited manner.

The vulnerability exists due to use-after-free in ngx_http_ssl_module when handling requests with client certificate verification and OCSP checking enabled. A remote attacker can send requests that trigger the flaw to cause a denial of service or modify data in a limited manner.

This issue affects the data plane only. Exploitation requires the ssl_verify_client directive to be set to "on" or "optional," and the ssl_ocsp directive to be set to "on" or configured with the leaf parameter and a resolver.


2) Use of uninitialized resource (CVE-ID: CVE-2026-60005)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose limited memory contents or cause a denial of service.

The vulnerability exists due to use of an uninitialized resource in ngx_http_slice_module when handling requests with the slice directive and unnamed regex captures configured or during a background cache update. A remote attacker can send crafted requests to disclose limited memory contents or cause a denial of service.

The issue affects the NGINX worker process and is limited to the data plane. The module is not enabled by default and must be built with the --with-http_slice_module configuration parameter.


3) Use-after-free (CVE-ID: CVE-2026-56434)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service or modify memory contents.

The vulnerability exists due to use-after-free in the ngx_http_ssi_module module when processing responses from an upstream server with SSI enabled, proxy_pass configured, and proxy_buffering disabled. A remote attacker can control responses from an upstream server to cause a denial of service or modify memory contents.

Exploitation requires man-in-the-middle ability over upstream server responses. This is a data plane issue only.


4) Out-of-bounds read (CVE-ID: CVE-2026-48142)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose limited memory contents or cause a worker process restart.

The vulnerability exists due to out-of-bounds read in ngx_http_charset_module when serving or proxying content through a location block configured with both source_charset utf-8 and a charset directive. A remote attacker can send crafted requests to disclose limited memory contents or cause a worker process restart.

This is a data plane issue only, and exploitation also depends on conditions beyond the attacker's control.


5) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-42946)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose memory contents of the NGINX worker process or cause a denial of service.

The vulnerability exists due to memory allocation with excessive size value and use of out-of-range pointer offset in the ngx_http_scgi_module and ngx_http_uwsgi_module modules when processing responses from an upstream server via scgi_pass or uwsgi_pass. A remote attacker can control responses from an upstream server to disclose memory contents of the NGINX worker process or cause a denial of service.

Exploitation requires man-in-the-middle ability to control responses from an upstream server. There is no control plane exposure; this is a data plane issue only.


6) Heap-based buffer overflow (CVE-ID: CVE-2026-42945) Exploited

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service or execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in ngx_http_rewrite_module when processing crafted HTTP requests that reach configurations where a rewrite directive is followed by a rewrite, if, or set directive and unnamed PCRE captures are used with a replacement string containing a question mark. A remote attacker can send crafted HTTP requests to cause a denial of service or execute arbitrary code.

Code execution is possible on systems with address space layout randomization disabled. There is no control plane exposure; this is a data plane issue only.


7) Out-of-bounds read (CVE-ID: CVE-2026-42934)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose limited memory contents or cause a denial of service.

The vulnerability exists due to out-of-bounds read in ngx_http_charset_module when processing requests with charset, source_charset, charset_map, and proxy_pass configured with buffering disabled. A remote attacker can send crafted requests to disclose limited memory contents or cause a denial of service.

This issue affects the data plane only and requires the specific configuration to be enabled.


8) Heap-based buffer overflow (CVE-ID: CVE-2026-42533)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code or cause a denial of service.

The vulnerability exists due to heap-based buffer overflow in the map directive with regex matching when processing crafted HTTP requests that trigger regex capture variable references before the map output variable. A remote attacker can send crafted HTTP requests to execute arbitrary code or cause a denial of service.

Code execution is possible on systems with ASLR disabled or when ASLR can be bypassed. This is a data plane issue only.


9) Use-after-free (CVE-ID: CVE-2026-42530)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code or cause a denial of service.

The vulnerability exists due to use-after-free in the ngx_http_v3_module when processing a specially crafted HTTP/3 session that reopens a QPACK encoder stream. A remote attacker can send a specially crafted HTTP/3 session to execute arbitrary code or cause a denial of service.

Exploitation requires NGINX Open Source to be configured to use the HTTP/3 QUIC module. Code execution is possible on systems with ASLR disabled or when ASLR can be bypassed. There is no control plane exposure; this is a data plane issue only.


10) Heap-based buffer overflow (CVE-ID: CVE-2026-42055)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code or cause a denial of service.

The vulnerability exists due to heap-based buffer overflow in ngx_http_proxy_v2_module and ngx_http_grpc_module when proxying HTTP/2 traffic with large headers while creating an upstream request. A remote attacker can send large headers to execute arbitrary code or cause a denial of service.

Exploitation requires a non-default configuration in which proxy_http_version is set to 2 or grpc_pass is used, ignore_invalid_headers is set to off, and the large_client_header_buffers per-buffer size is larger than 2 megabytes. This is a data plane issue only.


11) Improper authentication (CVE-ID: CVE-2025-23419)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an TLS session resumption when handling client certificate authentication. A remote attacker can bypass authentication process and gain unauthorized access to the application.

Successful exploitation of the vulnerability requires that name-based virtual hosts are configured to share the same IP address and port combination and have TLS 1.3 and OpenSSL. This vulnerability arises when TLS session tickets are used and/or the SSL session cache is used in the default virtual server and the default virtual server is performing client certificate authentication.


12) Out-of-bounds write (CVE-ID: CVE-2026-32647)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error in the ngx_http_mp4_module module. A remote attacker can supply a specially crafted MP4 file to the server, trigger an out-of-bounds write and execute arbitrary code on the target system.


13) Incorrect authorization (CVE-ID: CVE-2026-28755)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improper handling of revoked certificates in the ngx_stream_ssl_module module when configured with the ssl_verify_client on and ssl_ocsp on directives. A remote attacker can bypass authorization checks and access application data with a revoked certificate. 


14) CRLF injection (CVE-ID: CVE-2026-28753)

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N]


The vulnerability allows a remote attacker to inject arbitrary data in server response.

The vulnerability exists due to insufficient validation of attacker-supplied data in the ngx_mail_smtp_module module when handling DNS responses. A remote attacker can inject arbitrary headers into SMTP upstream requests and manipulate data.


15) Integer overflow (CVE-ID: CVE-2026-27784)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the ngx_http_mp4_module module. A remote attacker can supply specially crafted MP4 data to the server, trigger an integer overflow and execute arbitrary code on the target system.

Note, the vulnerability affects only 32-bit NGINX Open Source deployments. 


16) Heap-based buffer overflow (CVE-ID: CVE-2026-27654)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a boundary error in the ngx_http_dav_module module. A remote attacker can send specially crafted request to the server, trigger a heap-based buffer overflow and perform a denial of service attack or modify source or destination file names outside the document root. 


17) NULL pointer dereference (CVE-ID: CVE-2026-27651)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the ngx_mail_auth_http_module module. A remote attacker can send specially crafted request to the server and perform a denial of service (DoS) attack.

Successful exploitation of the vulnerability requires that the CRAM-MD5 or APOP authentication is enabled, and the authentication server permits retry by returning the Auth-Wait response header.


18) Heap-based buffer overflow (CVE-ID: CVE-2026-9256)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to heap-based buffer overflow in ngx_http_rewrite_module when processing crafted HTTP requests that trigger rewrite directives using overlapping PCRE captures and multiple capture references in a redirect or arguments context. A remote attacker can send crafted HTTP requests to execute arbitrary code or crash the web server.

There is no control plane exposure; this is a data plane issue only. Code execution is possible on systems with ASLR disabled or when ASLR can be bypassed.


19) Acceptance of extraneous untrusted data with trusted data (CVE-ID: CVE-2026-1642)

CWE-ID: CWE-349 - Acceptance of Extraneous Untrusted Data With Trusted Data

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N]


The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect handling of trusted and untrusted data when configured to proxy to upstream Transport Layer Security (TLS) servers. A remote unauthenticated attacker with an MITM position on the upstream server side can inject plain text data into the responses from an upstream proxied server and send them to clients. 


20) Out-of-bounds read (CVE-ID: CVE-2025-53859)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a boundary condition in the ngx_mail_smtp_module. A remote attacker can force the server to leak arbitrary bytes sent in a request to the authentication server.

This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method "none," and (3) the authentication server returns the "Auth-Wait" response header.


Remediation

Install update from vendor's website.

References