SB2026101477 - Multiple vulnerabilities in nginx

Description

This security bulletin contains information about 5 vulnerabilities.

1) Heap-based buffer overflow (CVE-ID: CVE-2026-15176)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in ngx_http_core_module when handling HTTP requests. A remote attacker can send specially crafted HTTP requests to cause a denial of service or execute arbitrary code.

Exploitation requires a location configured with the alias and rewrite directives together with a set or return directive referencing $request_filename; alternatively, $request_filename can be used in an access log_format directive. Code execution requires ASLR to be disabled or bypassed. Only the data plane is exposed; the control plane is not affected.

2) Use of uninitialized resource (CVE-ID: CVE-2026-97629)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass client certificate verification and access sensitive information.

The vulnerability exists due to use of an uninitialized resource in ngx_http_ssl_module when automatically rotating SSL session ticket keys. A remote attacker can forge client SSL sessions to bypass client certificate verification and access sensitive information.

Exploitation requires a shared SSL session cache configured without an explicit ssl_session_ticket_key file directive. Session forgery is non-deterministic and beyond the exploiter's control. Only the data plane is exposed; the control plane is not affected.

3) Encoding Error (CVE-ID: CVE-2026-95101)

CWE-ID: CWE-172 - Encoding Error

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to inject data into proxied requests.

The vulnerability exists due to an encoding error in the ngx_http_v3_module module when handling HTTP/3 requests with proxy_request_buffering enabled. A remote attacker can send an HTTP/3 request to inject data into proxied requests.

This is a data plane issue only; there is no control plane exposure.

4) Heap-based buffer overflow (CVE-ID: CVE-2026-93479)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in the NGINX worker process's map directive with regex matching when processing HTTP requests under configurations where the root directive or access log format references the map's regex capture variables before referencing the map output variable. A remote attacker can send crafted HTTP requests to cause a denial of service or execute arbitrary code.

The same condition can also arise when a non-cacheable variable is used in a string expression under certain conditions. Exploitation depends on conditions beyond the sender's control. Code execution requires Address Space Layout Randomization (ASLR) to be disabled or bypassed. The issue is confined to the data plane, with no control plane exposure.

5) Use-after-free (CVE-ID: CVE-2026-97205)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service, corrupt memory, or potentially execute arbitrary code.

The vulnerability exists due to use-after-free in ngx_http_core_module when processing server side includes (SSI) pages containing include virtual commands. A remote attacker can trigger processing of such pages to cause a denial of service, corrupt memory, or potentially execute arbitrary code.

Exploitation requires asynchronous file I/O (AIO) to be enabled in certain configurations. Code execution requires address space layout randomization (ASLR) to be disabled or bypassed. The issue affects only the data plane; there is no control plane exposure.

Remediation

Install update from vendor's website.

References

• https://my.f5.com/manage/s/article/K000162416
• https://my.f5.com/manage/s/article/K000162606
• https://my.f5.com/manage/s/article/K000162613
• https://my.f5.com/manage/s/article/K000162607
• https://my.f5.com/manage/s/article/K000162608