CVE-2026-42530

highPriorität · verfolgen · 12EPSS 0.065 · 94. PerzentilExploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

3 exploits · PoC

Likely / severe?

6.45% (94th) EPSS

CVSS 8.1 · high

Is it mine?

31 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-27

NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.2

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 8.1–9.2

v3.18.1highAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · f5sirt@f5.comAusnutzbarkeit 2.2 · Auswirkung 5.9

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HsecondaryAusnutzbarkeit 2.2 · Auswirkung 5.9

v4.09.2criticalCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:Nsecondary · ENISA EU

v4.09.2criticalCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · f5sirt@f5.com

v4.08.2highCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-416USCWE-416US

Exploits (3)

Öffentlicher Proof-of-Concept- und Exploit-Code.

0xBlackash/CVE-2026-42530CVE-2026-42530PoC · poc_in_github
HORKimhab/CVE-2026-42530CVE-2026-42530 - DraftPoC · poc_in_github
v4ltonn/CVE-2026-42530Scanner PoC for CVE-2026-42530 -- nginx 1.31.0-1.31.1 HTTP/3 QPACK encoder stream Use-After-Free (CVSS 9.2)PoC · poc_in_github

betroffene Produkte (31)

Betroffene Produkte und Versionsbereiche.

Amazon Linux 2alle Versionencert_bundDEcpe:/o:amazon:linux_2:-
Debian Linuxalle Versionencert_bundDEcpe:/o:debian:debian_linux:-
Gentoo Linuxalle Versionencert_bundDEcpe:/o:gentoo:linux:-
NGINX NGINX Ingress Controlleralle Versionencert_bundDEcpe:/a:nginx:nginx:ingress_controller
NGINX NGINX Instance Manageralle Versionencert_bundDEcpe:/a:nginx:nginx:instance_manager
Oracle Linuxalle Versionencert_bundDEcpe:/o:oracle:linux:-
RESF Rocky Linuxalle Versionencert_bundDEcpe:/o:resf:rocky_linux:-
Red Hat Enterprise Linuxalle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:-
SUSE Linuxalle Versionencert_bundDEcpe:/o:suse:suse_linux:-
SUSE openSUSEalle Versionencert_bundDEcpe:/o:suse:opensuse:-
Nginx Nginx≤ Gateway Fabric <2.6.4cert_bundDE
Nginx Nginx≤ Open Source <1.31.2cert_bundDE
F5 NGINX Open Source1.31.0 → 1.31.2enisa_euvdEU
NGINX Inc. NGINX Gateway Fabric1.3.0 → 1.6.2fstec_bduRU
NGINX Inc. NGINX Gateway Fabric2.0.0 → 2.6.4fstec_bduRU
NGINX Inc. NGINX Ingress Controller3.5.0 → 3.7.2fstec_bduRU
NGINX Inc. NGINX Ingress Controller4.0.0 → 4.0.1fstec_bduRU
NGINX Inc. NGINX Ingress Controller5.0.0 → 5.5.1fstec_bduRU
NGINX Inc. NGINX Instance Manager2.17.0 → 2.22.0fstec_bduRU
NGINX Inc. NGINX Open Source1.31.0 → 1.31.2fstec_bduRU

20 von 31 angezeigt

Advisories (3)

Hersteller- und Ökosystem-Meldungen dazu.

WID-SEC-W-2026-1995NGINX und NGINX Plus: Mehrere SchwachstellenDeutsch2026-06-17csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in NGINX und NGINX NGINX Plus ausnutzen, um Daten zu manipulieren, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.
BIT-nginx-2026-42530NGINX Open-Source ngx_http_v3_module vulnerability2026-06-22vendor · osvUS
NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
BIT-nginx-gateway-2026-42530NGINX Open-Source ngx_http_v3_module vulnerability2026-06-22vendor · osvUS
NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

auch bekannt als (6)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu osv cert_bund NVD CVE.org MITRE

veröffentlicht 2026-06-17geändert 2026-10-26

Referenzen (7)

Externe Belege — Patches, Meldungen, Analysen.

https://my.f5.com/manage/s/article/K000161616 cnnvd
https://my.f5.com/manage/s/article/K000161616 enisa_euvd
https://access.redhat.com/errata/RHSA-2026:20351 nvd
https://access.redhat.com/security/cve/CVE-2026-42530Third Party Advisorynvd
https://bugzilla.redhat.com/show_bug.cgi?id=2489872Third Party Advisorynvd
https://my.f5.com/manage/s/article/K000161616Vendor Advisorynvd
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42530.jsonThird Party Advisorynvd

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan