Количество 19
Количество 19
BDU:2026-08881
Уязвимость модулей ngx_http_proxy_v2_module и ngx_http_grpc_module веб-серверов NGINX Plus и NGINX Open Source, позволяющая нарушитлю выполнить произвольный код или вызвать отказ в обслуживании
ROS-20260714-73-0059
Уязвимость angie
CVE-2026-42055
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-42055
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-42055
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-42055
NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability
CVE-2026-42055
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ ...
RLSA-2026:38847
Important: nginx:1.24 security, bug fix, and enhancement update
RLSA-2026:36639
Important: nginx:1.26 security, bug fix, and enhancement update
RLSA-2026:36618
Important: nginx:1.24 security, bug fix, and enhancement update
RLSA-2026:36364
Important: nginx security, bug fix, and enhancement update
GHSA-78jw-ww3g-9wp7
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
ELSA-2026-38847
ELSA-2026-38847: nginx:1.24 security, bug fix, and enhancement update (IMPORTANT)
ELSA-2026-36639
ELSA-2026-36639: nginx:1.26 security, bug fix, and enhancement update (IMPORTANT)
ELSA-2026-36618
ELSA-2026-36618: nginx:1.24 security, bug fix, and enhancement update (IMPORTANT)
ELSA-2026-36364
ELSA-2026-36364: nginx security, bug fix, and enhancement update (IMPORTANT)
ELSA-2026-36331
ELSA-2026-36331: nginx security, bug fix, and enhancement update (IMPORTANT)
SUSE-SU-2026:3329-1
Security update for nginx
openSUSE-SU-2026:21439-1
Security update for nginx
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | BDU:2026-08881 Уязвимость модулей ngx_http_proxy_v2_module и ngx_http_grpc_module веб-серверов NGINX Plus и NGINX Open Source, позволяющая нарушитлю выполнить произвольный код или вызвать отказ в обслуживании | CVSS3: 8.1 | 4% Низкий | около 1 месяца назад |
 | ROS-20260714-73-0059 Уязвимость angie | CVSS3: 8.1 | 4% Низкий | 17 дней назад |
 | CVE-2026-42055 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | CVSS3: 8.1 | 4% Низкий | около 1 месяца назад |
 | CVE-2026-42055 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | CVSS3: 8.1 | 4% Низкий | около 1 месяца назад |
 | CVE-2026-42055 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | CVSS3: 8.1 | 4% Низкий | около 1 месяца назад |
 | CVE-2026-42055 NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability | CVSS3: 8.1 | 4% Низкий | 30 дней назад |
| CVE-2026-42055 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ ... | CVSS3: 8.1 | 4% Низкий | около 1 месяца назад |
 | RLSA-2026:38847 Important: nginx:1.24 security, bug fix, and enhancement update | 4% Низкий | 18 дней назад | |
| RLSA-2026:36639 Important: nginx:1.26 security, bug fix, and enhancement update | 4% Низкий | 22 дня назад | |
| RLSA-2026:36618 Important: nginx:1.24 security, bug fix, and enhancement update | 4% Низкий | 23 дня назад | |
| RLSA-2026:36364 Important: nginx security, bug fix, and enhancement update | 4% Низкий | 23 дня назад | |
| GHSA-78jw-ww3g-9wp7 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | CVSS3: 8.1 | 4% Низкий | около 1 месяца назад |
| ELSA-2026-38847 ELSA-2026-38847: nginx:1.24 security, bug fix, and enhancement update (IMPORTANT) | 17 дней назад | ||
| ELSA-2026-36639 ELSA-2026-36639: nginx:1.26 security, bug fix, and enhancement update (IMPORTANT) | 22 дня назад | ||
| ELSA-2026-36618 ELSA-2026-36618: nginx:1.24 security, bug fix, and enhancement update (IMPORTANT) | 22 дня назад | ||
| ELSA-2026-36364 ELSA-2026-36364: nginx security, bug fix, and enhancement update (IMPORTANT) | 15 дней назад | ||
| ELSA-2026-36331 ELSA-2026-36331: nginx security, bug fix, and enhancement update (IMPORTANT) | 18 дней назад | ||
 | SUSE-SU-2026:3329-1 Security update for nginx | 3 дня назад | ||
| openSUSE-SU-2026:21439-1 Security update for nginx | 7 дней назад |
Уязвимостей на страницу