NGINX Open Source and NGINX Plus: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 6

• High 8.1
  CVE-2026-42945 Public exploit EPSS 68%

  NGINX ngx_http_rewrite_module vulnerability

  NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (…

  F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  May 13, 2026
• Medium 6.5
  CVE-2026-40460

  NGINX ngx_quic_module vulnerability

  When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note: Software versions which have reached End of Tec…

  F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  May 13, 2026
• Medium 6.5
  CVE-2026-42946

  NGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerability

  A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) …

  F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  May 13, 2026
• Medium 5.8
  CVE-2026-42926 Public exploit

  NGINX ngx_http_proxy_v2_module vulnerability

  When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker may be able to inject frame headers and payload bytes to the upstream peer.  Note: Software versions which have reached …

  F5 NGINX Open Source nginx nginx-mainline Network devices Debian Wolfi
  May 13, 2026
• Medium 4.8
  CVE-2026-40701 Public exploit

  NGINX ngx_http_ssl_module vulnerability

  NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directive is set to "on" or the leaf parameters are configured with a resolver. With th…

  F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  May 13, 2026
• Medium 4.8
  CVE-2026-42934

  NGINX ngx_http_charset_module vulnerability

  NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering ("off") directives are configured, unauthenticated attackers can send requests th…

  F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine Wolfi
  May 13, 2026

Revision history

1. 2026-09-16 #36

   Neue Updates von Oracle Linux aufgenommen

2. 2026-09-15 #35

   Neue Updates von Oracle Linux aufgenommen

3. 2026-09-13 #34

   Neue Updates von Oracle Linux aufgenommen

4. 2026-09-09 #33

   Neue Updates von Oracle Linux aufgenommen

5. 2026-09-02 #32

   Neue Updates von Oracle Linux aufgenommen

6. 2026-08-26 #31

   Neue Updates von Oracle Linux aufgenommen

7. 2026-08-25 #30

   Neue Updates von Oracle Linux aufgenommen

8. 2026-08-24 #29

   Neue Updates von Oracle Linux aufgenommen

9. 2026-08-16 #28

   Neue Updates von Gentoo aufgenommen

10. 2026-07-28 #27

    Neue Updates von SUSE aufgenommen

11. 2026-07-26 #26

    Neue Updates von openSUSE aufgenommen

12. 2026-07-23 #25

    Neue Updates von Oracle Linux aufgenommen

13. 2026-07-22 #24

    Neue Updates von Oracle Linux aufgenommen

14. 2026-07-21 #23

    Neue Updates von Oracle Linux aufgenommen

15. 2026-07-13 #22

    Neue Updates von Oracle Linux aufgenommen

16. 2026-07-09 #21

    Neue Updates von Oracle Linux aufgenommen

17. 2026-06-30 #20

    Neue Updates von Oracle Linux aufgenommen

18. 2026-06-29 #19

    Neue Updates von Oracle Linux aufgenommen

19. 2026-06-28 #18

    Neue Updates von Oracle Linux aufgenommen

20. 2026-06-25 #17

    Neue Updates von Oracle Linux aufgenommen

21. 2026-06-24 #16

    Neue Updates von Oracle Linux aufgenommen

22. 2026-06-23 #15

    Neue Updates von Red Hat und Oracle Linux aufgenommen

23. 2026-06-11 #14

    Neue Updates von SUSE aufgenommen

24. 2026-06-07 #13

    Neue Updates von Debian aufgenommen

25. 2026-06-04 #12

    Neue Updates von Ubuntu aufgenommen

References

• GitHub Security Advisory GHSA-GCGV-V5GF-C543 vom 2026-05-13
  https://github.com/advisories/GHSA-GCGV-V5GF-C543
• GitHub Security Advisory GHSA-H7RQ-F9GQ-MC8R vom 2026-05-13
  https://github.com/advisories/GHSA-H7RQ-F9GQ-MC8R
• GitHub Security Advisory GHSA-X88Q-X2R7-VG3G vom 2026-05-13
  https://github.com/advisories/GHSA-X88Q-X2R7-VG3G
• GitHub Security Advisory GHSA-V43F-895R-CHHH vom 2026-05-13
  https://github.com/advisories/GHSA-V43F-895R-CHHH
• GitHub Security Advisory GHSA-6VMC-2WH4-77QP vom 2026-05-13
  https://github.com/advisories/GHSA-6VMC-2WH4-77QP
• GitHub Security Advisory GHSA-FM65-XRRR-C358 vom 2026-05-13
  https://github.com/advisories/GHSA-FM65-XRRR-C358
• PoC CVE-2026-42945 vom 2026-05-13
  https://github.com/p3Nt3st3r-sTAr/CVE-2026-42945-POC
• F5 Security Advisory K000161019 vom 2026-05-13
  https://my.f5.com/manage/s/article/K000161019
• F5 Security Advisory K000161021 vom 2026-05-13
  https://my.f5.com/manage/s/article/K000161021
• F5 Security Advisory K000161068 vom 2026-05-13
  https://my.f5.com/manage/s/article/K000161068
• F5 Security Advisory K000161131 vom 2026-05-13
  https://my.f5.com/manage/s/article/K000161131
• F5 Security Advisory K000161027 vom 2026-05-13
  https://my.f5.com/manage/s/article/K000161027
• F5 Security Advisory K000161028 vom 2026-05-13
  https://my.f5.com/manage/s/article/K000161028
• Fedora Security Advisory FEDORA-2026-094EB13BB1 vom 2026-05-14
  https://bodhi.fedoraproject.org/updates/FEDORA-2026-094eb13bb1
• Ubuntu Security Notice USN-8271-1 vom 2026-05-14
  https://ubuntu.com/security/notices/USN-8271-1
• Fedora Security Advisory FEDORA-2026-FB53CB4D67 vom 2026-05-14
  https://bodhi.fedoraproject.org/updates/FEDORA-2026-fb53cb4d67
• Fedora Security Advisory FEDORA-2026-38623B4FED vom 2026-05-14
  https://bodhi.fedoraproject.org/updates/FEDORA-2026-38623b4fed
• Red Hat Security Advisory RHSA-2026:17751 vom 2026-05-15
  https://access.redhat.com/errata/RHSA-2026:17751
• Red Hat Security Advisory RHSA-2026:17753 vom 2026-05-15
  https://access.redhat.com/errata/RHSA-2026:17753
• Red Hat Security Advisory RHSA-2026:17752 vom 2026-05-15
  https://access.redhat.com/errata/RHSA-2026:17752
• Red Hat Security Advisory RHSA-2026:18029 vom 2026-05-18
  https://access.redhat.com/errata/RHSA-2026:18029
• Red Hat Security Advisory RHSA-2026:17790 vom 2026-05-15
  https://access.redhat.com/errata/RHSA-2026:17790
• Red Hat Security Advisory RHSA-2026:17791 vom 2026-05-15
  https://access.redhat.com/errata/RHSA-2026:17791
• Red Hat Security Advisory RHSA-2026:17792 vom 2026-05-16
  https://access.redhat.com/errata/RHSA-2026:17792
• Red Hat Security Advisory RHSA-2026:17793 vom 2026-05-15
  https://access.redhat.com/errata/RHSA-2026:17793
• Red Hat Security Advisory RHSA-2026:17794 vom 2026-05-16
  https://access.redhat.com/errata/RHSA-2026:17794
• Red Hat Security Advisory RHSA-2026:18063 vom 2026-05-18
  https://access.redhat.com/errata/RHSA-2026:18063
• Red Hat Security Advisory RHSA-2026:18041 vom 2026-05-18
  https://access.redhat.com/errata/RHSA-2026:18041
• Debian Security Advisory DLA-4589 vom 2026-05-18
  https://lists.debian.org/debian-lts-announce/2026/05/msg00033.html
• openSUSE Security Update OPENSUSE-SU-2026:10796-1 vom 2026-05-18
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EVUBHQ3CZLOXLHHOL5Y3BXTI4PSUI2YD/
• Rocky Linux Security Advisory RLSA-2026:18041 vom 2026-05-18
  https://errata.build.resf.org/RLSA-2026:18041
• Debian Security Advisory DSA-6278 vom 2026-05-19
  https://security-tracker.debian.org/tracker/DSA-6278-1
• Red Hat Security Advisory RHSA-2026:19371 vom 2026-05-19
  https://access.redhat.com/errata/RHSA-2026:19371
• Oracle Linux Security Advisory ELSA-2026-18063 vom 2026-05-19
  https://linux.oracle.com/errata/ELSA-2026-18063.html
• Red Hat Security Advisory RHSA-2026:19372 vom 2026-05-19
  https://access.redhat.com/errata/RHSA-2026:19372
• Red Hat Security Advisory RHSA-2026:19159 vom 2026-05-19
  https://access.redhat.com/errata/RHSA-2026:19159
• Oracle Linux Security Advisory ELSA-2026-18041 vom 2026-05-19
  https://linux.oracle.com/errata/ELSA-2026-18041.html
• Red Hat Security Advisory RHSA-2026:19374 vom 2026-05-20
  https://access.redhat.com/errata/RHSA-2026:19374
• Rocky Linux Security Advisory RLSA-2026:18063 vom 2026-05-19
  https://errata.build.resf.org/RLSA-2026:18063
• Oracle Linux Security Advisory ELSA-2026-18029 vom 2026-05-20
  https://linux.oracle.com/errata/ELSA-2026-18029.html
• Rocky Linux Security Advisory RLSA-2026:18029 vom 2026-05-21
  https://errata.build.resf.org/RLSA-2026:18029
• SUSE Security Update SUSE-SU-2026:2050-1 vom 2026-05-25
  https://lists.suse.com/pipermail/sle-security-updates/2026-May/026275.html
• Red Hat Security Advisory RHSA-2026:20444 vom 2026-05-25
  https://access.redhat.com/errata/RHSA-2026:20444
• Red Hat Security Advisory RHSA-2026:20442 vom 2026-05-25
  https://access.redhat.com/errata/RHSA-2026:20442
• Amazon Linux Security Advisory ALAS2NGINX1-2026-012 vom 2026-05-26
  https://alas.aws.amazon.com/AL2/ALAS2NGINX1-2026-012.html
• openSUSE Security Update OPENSUSE-SU-2026:20796-1 vom 2026-05-27
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WKSJMWD6JX2UGTFO6R5SU56Z5VNHLFBU/
• SUSE Security Update SUSE-SU-2026:21832-1 vom 2026-05-27
  https://lists.suse.com/pipermail/sle-security-updates/2026-May/026319.html
• Red Hat Security Advisory RHSA-2026:21275 vom 2026-05-27
  https://access.redhat.com/errata/RHSA-2026:21275
• Rocky Linux Security Advisory RLSA-2026:19374 vom 2026-05-30
  https://errata.build.resf.org/RLSA-2026:19374
• Ubuntu Security Notice USN-8354-1 vom 2026-06-01
  https://ubuntu.com/security/notices/USN-8354-1
• Ubuntu Security Notice USN-8375-1 vom 2026-06-03
  https://ubuntu.com/security/notices/USN-8375-1
• Debian Security Advisory DSA-6326 vom 2026-06-07
  https://security-tracker.debian.org/tracker/DSA-6326-1
• SUSE Security Update SUSE-SU-2026:2370-1 vom 2026-06-11
  https://lists.suse.com/pipermail/sle-security-updates/2026-June/026712.html
• Red Hat Security Advisory RHSA-2026:22394 vom 2026-06-23
  https://access.redhat.com/errata/RHSA-2026:22394
• Oracle Linux Security Advisory ELSA-2026-19374 vom 2026-06-24
  https://linux.oracle.com/errata/ELSA-2026-19374.html
• Red Hat Security Advisory RHSA-2026:22396 vom 2026-06-23
  https://access.redhat.com/errata/RHSA-2026:22396
• Red Hat Security Advisory RHSA-2026:22393 vom 2026-06-23
  https://access.redhat.com/errata/RHSA-2026:22393
• Red Hat Security Advisory RHSA-2026:22390 vom 2026-06-23
  https://access.redhat.com/errata/RHSA-2026:22390
• Red Hat Security Advisory RHSA-2026:22389 vom 2026-06-23
  https://access.redhat.com/errata/RHSA-2026:22389
• Red Hat Security Advisory RHSA-2026:22388 vom 2026-06-23
  https://access.redhat.com/errata/RHSA-2026:22388
• Red Hat Security Advisory RHSA-2026:22383 vom 2026-06-23
  https://access.redhat.com/errata/RHSA-2026:22383
• Red Hat Security Advisory RHSA-2026:22382 vom 2026-06-23
  https://access.redhat.com/errata/RHSA-2026:22382
• Oracle Linux Security Advisory ELSA-2026-28921 vom 2026-06-24
  https://linux.oracle.com/errata/ELSA-2026-28921.html
• Oracle Linux Security Advisory ELSA-2026-19371 vom 2026-06-24
  https://linux.oracle.com/errata/ELSA-2026-19371.html
• Oracle Linux Security Advisory ELSA-2026-29151 vom 2026-06-26
  https://linux.oracle.com/errata/ELSA-2026-29151.html
• Oracle Linux Security Advisory ELSA-2026-19372 vom 2026-06-27
  http://linux.oracle.com/errata/ELSA-2026-19372.html
• Oracle Linux Security Advisory ELSA-2026-28212 vom 2026-06-30
  https://linux.oracle.com/errata/ELSA-2026-28212.html
• Oracle Linux Security Advisory ELSA-2026-28973 vom 2026-07-01
  https://linux.oracle.com/errata/ELSA-2026-28973.html
• Oracle Linux Security Advisory ELSA-2026-36639 vom 2026-07-09
  https://linux.oracle.com/errata/ELSA-2026-36639.html
• Oracle Linux Security Advisory ELSA-2026-36618 vom 2026-07-09
  https://linux.oracle.com/errata/ELSA-2026-36618.html
• Oracle Linux Security Advisory ELSA-2026-36331 vom 2026-07-14
  https://linux.oracle.com/errata/ELSA-2026-36331.html
• Oracle Linux Security Advisory ELSA-2026-19159 vom 2026-07-22
  https://linux.oracle.com/errata/ELSA-2026-19159.html
• Oracle Linux Security Advisory ELSA-2026-36364 vom 2026-07-22
  https://oss.oracle.com/pipermail/el-errata/2026-July/021224.html
• Oracle Linux Security Advisory ELSA-2026-29874 vom 2026-07-23
  https://linux.oracle.com/errata/ELSA-2026-29874.html
• openSUSE Security Update OPENSUSE-SU-2026:21439-1 vom 2026-07-26
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2IYCUTC27GP4U3SX5TZZSSQSM23JOKTU/
• SUSE Security Update SUSE-SU-2026:22951-1 vom 2026-07-28
  https://lists.suse.com/pipermail/sle-security-updates/2026-July/027997.html
• SUSE Security Update SUSE-SU-2026:22943-1 vom 2026-07-28
  https://lists.suse.com/pipermail/sle-security-updates/2026-July/028007.html
• Gentoo Linux Security Advisory GLSA-202608-16 vom 2026-08-17
  https://security.gentoo.org/glsa/202608-16
• Oracle Linux Security Advisory ELSA-2026-59220 vom 2026-08-25
  https://linux.oracle.com/errata/ELSA-2026-59220.html
• Oracle Linux Security Advisory ELSA-2026-59216 vom 2026-08-26
  https://linux.oracle.com/errata/ELSA-2026-59216.html