Описание
When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
A flaw was found in NGINX Open Source. When NGINX is configured to proxy HTTP/2 traffic and uses proxy_set_body, a remote attacker may be able to inject malicious data into the upstream peer. This could lead to unintended data manipulation or bypass of security controls.
Отчет
A moderate severity flaw was found in NGINX Open Source, which is shipped in Red Hat Enterprise Linux 8, 9, and 10 (including the nginx:1.24 and nginx:1.26 module streams) and Red Hat In-Vehicle OS 2.0. When NGINX is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2 and also uses the proxy_set_body directive, a remote attacker may be able to inject HTTP/2 frame headers and payload bytes to the upstream peer, potentially leading to unintended data manipulation or bypass of security controls. Exploitation requires this specific configuration combination, which limits exposure to deployments that use both directives together. For the affected Red Hat Enterprise Linux and Red Hat In-Vehicle OS streams, fixes are currently deferred, so no update is scheduled at this time and the residual risk remains for deployments using the affected configuration; several Red Hat Enterprise Linux streams are out of support scope and will not receive a fix. Red Hat Hardened Images and Fedora are also affected, with fixes pursued through those channels. Red Hat and upstream both rate this flaw as moderate severity (Red Hat CVSS 5.8, upstream CVSS 6.3).
Меры по смягчению последствий
To mitigate this issue, avoid configuring NGINX to proxy HTTP/2 traffic with the proxy_http_version 2 directive in conjunction with proxy_set_body. If HTTP/2 proxying is essential, ensure that all proxied content is thoroughly validated to prevent malicious data injection. Modifying NGINX configuration files typically requires a service reload or restart for changes to take effect.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | nginx | Fix deferred | ||
| Red Hat Enterprise Linux 8 | nginx:1.24/nginx | Fix deferred | ||
| Red Hat Enterprise Linux 9 | nginx | Fix deferred | ||
| Red Hat Enterprise Linux 9 | nginx:1.24/nginx | Fix deferred | ||
| Red Hat Enterprise Linux 9 | nginx:1.26/nginx | Fix deferred | ||
| Red Hat Hardened Images | nginx-main-1.30.2-1.hum1 | Fixed | RHSA-2026:20351 | 23.05.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.8 Medium
CVSS3
Связанные уязвимости
When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
When NGINX Open Source is configured to proxy HTTP/2 traffic by settin ...
When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Уязвимость модуля ngx_http_proxy_v2_module веб-серверов NGINX Open Source, позволяющая нарушителю оказать воздействие на целостность защищаемой информации
EPSS
5.8 Medium
CVSS3