IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
5.9Orta

CVE-2026-1642NGINX vulnerability

F5 NGINX Open Source; F5 NGINX Plus Yayım: (9 ay önce)

Açıklama

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Zayıflık türü (CWE): CWE-349CWE-345

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
f5 nginx gateway fabric 1.2.0 – ≤ 1.6.2
f5 nginx ingress controller 3.4.0 – ≤ 3.7.2
f5 nginx instance manager 2.15.1 – ≤ 2.21.0
F5 NGINX Open Source 1.3.0 – < 1.29.5
F5 NGINX Plus R36 – < R36 P2, R35 – < R35 P1, R34, R33, R32 – < R32 P4

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (21)
  • cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:* ≥ 1.2.0 ≤ 1.6.2
  • cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:* ≥ 2.0.0 < 2.4.1
  • cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:* ≥ 3.4.0 ≤ 3.7.2
  • cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:* ≥ 4.0.0 ≤ 4.0.1
  • cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:* ≥ 5.0.0 < 5.3.3
  • cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:* ≥ 2.15.1 ≤ 2.21.0
  • cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:* ≥ 1.3.0 < 1.28.2
  • cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:* ≥ 1.29.0 < 1.29.5
  • cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:* ≥ r33 < r35
  • cpe:2.3:a:f5:nginx_plus:r32:-:*:*:*:*:*:*
  • cpe:2.3:a:f5:nginx_plus:r32:p1:*:*:*:*:*:*
  • cpe:2.3:a:f5:nginx_plus:r32:p2:*:*:*:*:*:*
  • cpe:2.3:a:f5:nginx_plus:r32:p3:*:*:*:*:*:*
  • cpe:2.3:a:f5:nginx_plus:r33:p1:*:*:*:*:*:*
  • cpe:2.3:a:f5:nginx_plus:r33:p2:*:*:*:*:*:*
  • cpe:2.3:a:f5:nginx_plus:r33:p3:*:*:*:*:*:*
  • cpe:2.3:a:f5:nginx_plus:r34:p1:*:*:*:*:*:*
  • cpe:2.3:a:f5:nginx_plus:r34:p2:*:*:*:*:*:*
  • cpe:2.3:a:f5:nginx_plus:r35:-:*:*:*:*:*:*
  • cpe:2.3:a:f5:nginx_plus:r36:-:*:*:*:*:*:*
  • cpe:2.3:a:f5:nginx_plus:r36:p1:*:*:*:*:*:*

Aynı üründe son açıklar — nginx

5.3Orta
CVE-2026-95101

NGINX ngx_http_v3_module vulnerability

F5 NGINX Plus; F5 NGINX Open Source

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vu…

8.1Yüksek
CVE-2026-93479

NGINX map directive and regex matching vulnerability

F5 NGINX Plus; F5 NGINX Open Source

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same re…

1.2%EPSS
8.1Yüksek
CVE-2026-97205

NGINX ngx_http_core_module vulnerability

F5 NGINX Plus; F5 NGINX Open Source

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a U…

8.1Yüksek
CVE-2026-15176

NGINX ngx_http_core_module vulnerability

F5 NGINX Plus; F5 NGINX Open Source

A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achi…

6.5Orta
CVE-2026-97629

NGINX ngx_http_ssl_module vulnerability

F5 NGINX Plus; F5 NGINX Open Source

Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to …

6.5Orta
CVE-2026-90439

NGINX ngx_http_v3_module vulnerability

F5 NGINX Plus; F5 NGINX Open Source

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This c…