Known vulnerabilities in nginx (Debian package)

Vendor: Debian
Software CPE: cpe:2.3:o:debian:nginx_debian_package:*:*:*:*:*:debian_linux:*:*
Total vulnerabilities: 19
Public exploits: 3
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.2

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting nginx (Debian package) nginx (Debian package) is affected by 19 known vulnerabilities: 2 critical, 4 high, 13 medium Critical High Medium Low

Vulnerabilities (19)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU137847 - Heap-based Buffer Overflow
CVE-2026-42533
CWE-122 High
No
No
1.26.3-3+deb13u8 16.07.2026 SB2026071606
SB20260721112
SB20260721113
and 10 more
#VU137846 - Use of Uninitialized Resource
CVE-2026-60005
CWE-908 High
No
No
1.26.3-3+deb13u8 16.07.2026 SB2026071606
SB20260721112
SB20260721113
and 10 more
#VU137845 - Use After Free
CVE-2026-56434
CWE-416 Medium
No
No
1.26.3-3+deb13u8 16.07.2026 SB2026071606
SB20260721112
SB20260721113
and 10 more
#VU134864 - Out-of-bounds read
CVE-2026-48142
CWE-125 Medium
No
No
1.26.3-3+deb13u7 18.06.2026 SB2026061844
SB2026061845
SB2026061846
and 10 more
#VU134861 - Heap-based Buffer Overflow
CVE-2026-42055
CWE-122 High
No
No
1.26.3-3+deb13u7 18.06.2026 SB2026061844
SB2026061845
SB2026061846
and 13 more
#VU132220 - Heap-based Buffer Overflow
CVE-2026-9256
CWE-122 Critical
Available
No
1.22.1-9+deb12u8, 1.26.3-3+deb13u6 25.05.2026 SB2026052502
SB2026052504
SB2026052505
and 12 more
#VU131379 - Use After Free
CVE-2026-40701
CWE-416 Medium
No
No
1.22.1-9+deb12u7, 1.26.3-3+deb13u5 14.05.2026 SB2026051401
SB2026051497
SB2026051498
and 12 more
#VU131378 - Authentication Bypass by Spoofing
CVE-2026-40460
CWE-290 Medium
No
No
1.22.1-9+deb12u7, 1.26.3-3+deb13u5 14.05.2026 SB2026051401
SB2026051497
SB2026051498
and 4 more
#VU131377 - Heap-based Buffer Overflow
CVE-2026-42945
CWE-122 Critical
Available
Exploited
1.22.1-9+deb12u7, 1.26.3-3+deb13u5 14.05.2026 SB2026051401
SB2026051497
SB2026051498
and 27 more
#VU131375 - Uncontrolled Memory Allocation
CVE-2026-42946
CWE-789 Medium
No
No
1.22.1-9+deb12u7, 1.22.1-9+deb12u8, 1.26.3-3+deb13u5, 1.26.3-3+deb13u6 14.05.2026 SB2026051401
SB2026051497
SB2026051498
and 14 more
#VU131374 - Out-of-bounds read
CVE-2026-42934
CWE-125 Medium
No
No
1.22.1-9+deb12u7, 1.26.3-3+deb13u5 14.05.2026 SB2026051401
SB2026051497
SB2026051498
and 12 more
#VU122335 - Acceptance of Extraneous Untrusted Data With Trusted Data
CVE-2026-1642
CWE-349 Medium
No
No
1.22.1-9+deb12u4, 1.26.3-3+deb13u2 05.02.2026 SB2026020501
SB2026020505
SB2026020511
and 22 more
#VU68495 - Out-of-bounds read
CVE-2022-41742
CWE-125 Medium
No
No
1.18.0-6.1+deb11u3 19.10.2022 SB2022101941
SB2022111503
SB2022111601
and 34 more
#VU68494 - Out-of-bounds read
CVE-2022-41741
CWE-125 Medium
No
No
1.18.0-6.1+deb11u3 19.10.2022 SB2022101941
SB2022111503
SB2022111601
and 32 more
#VU53543 - Off-by-one Error
CVE-2021-23017
CWE-193 High
Available
No
1.14.2-2+deb10u4 25.05.2021 SB2021052543
SB2021052713
SB2021052901
and 48 more
#VU46107 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2020-11724
CWE-444 Medium
No
No
1.14.2-2+deb10u3 27.08.2020 SB2020041208
SB2020082719
SB2022041422
and 3 more
#VU20198 - Resource exhaustion
CVE-2019-9516
CWE-400 Medium
No
No
1.10.3-1+deb9u3 13.08.2019 SB2019081323
SB2019081602
SB2019081606
and 41 more
#VU20197 - Resource exhaustion
CVE-2019-9513
CWE-400 Medium
No
No
1.10.3-1+deb9u3 13.08.2019 SB2019081323
SB2019081326
SB2019081602
and 51 more
#VU20196 - Resource exhaustion
CVE-2019-9511
CWE-400 Medium
No
No
1.10.3-1+deb9u3 13.08.2019 SB2019081323
SB2019081326
SB2019081602
and 55 more