IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
5.3Medium

CVE-2026-95101NGINX ngx_http_v3_module vulnerability

F5 NGINX Plus; F5 NGINX Open Source Published: (19 days ago)

Description

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject data in the proxied request.  There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Weakness (CWE): CWE-172

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
F5 NGINX Open Source 1.31.0 – < 1.31.7, 1.30.0 – < 1.30.6, 1.25.0
F5 NGINX Plus 37.1.0 – < 37.2.0.1, 37.0.0 – < 37.0.7.1, R36, R35, R34, R33

Ubuntu fixes

  • USN-8955-1 nginx vulnerabilities Ubuntu 26.10, 26.04, 24.04, 22.04 · 26.10.2026 · nginx

References and patches

Recent CVEs in the same product — Ubuntu 22.04 LTS

7.8High
CVE-2026-114148

ASP.NET Core Elevation of Privilege Vulnerability

Microsoft .NET 10.0 installed on Linux; Microsoft .NET 10.0 installed on Mac OS; Microsoft .NET 10.0 installed on Windows; Microsoft .NET 11.0 installed on Linux

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.

9.2Critical
CVE-2026-111497 KEV

Out-of-Bounds Write in Google Brotli Decoder

Google Brotli; Siemens Heliox Dual Port 60kW; Siemens Heliox Flex Pro; Siemens SICHARGE FLEX

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

83%EPSS
9.2Critical
CVE-2026-109619 KEV

RCE via stale global state

PHP Group PHP; Siemens AX4; Siemens CADRA; Siemens Capital

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subs…

100%EPSS
9.2Critical
CVE-2026-109618 KEV

RCE via OOM corruption

PHP Group PHP; Siemens AX4; Siemens CADRA; Siemens Capital

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The s…

100%EPSS
5.3Medium
CVE-2026-92707

MessagePack: Nested arrays can blow past buffer length limits

MessagePack-CSharp MessagePack-CSharp

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] …

8.1High
CVE-2026-93479

NGINX map directive and regex matching vulnerability

F5 NGINX Plus; F5 NGINX Open Source

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same re…

1.2%EPSS