CVE
CVE-2026-42055
F5 · Dos; F5 · Nginx gateway fabric; +9 more
- First Reported
- Jun 18, 2026
- Latest Reported
- Jun 18, 2026
CVE Enrichment
- CVSS
- 9.2 CRITICAL
- EPSS
- 6.54%
- EPSS Percentile
- 93.79%
- CISA KEV
- Not listed
Description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Technical Details
- CVSS Version
- 4.0
- CNA / NVD Source
- [email protected]
- Published
- 17-Jun-2026 22:16
- Last Modified
- 14-Sep-2026 20:18
- EPSS Date
- 2026-10-30
- CWE
- CWE-122, CWE-787, CWE-131
CVSS Vector
CVSS:4.0 AV:N /
AC:H /
AT:P /
PR:N /
UI:N /
VC:H /
VI:H /
VA:H /
SC:N /
SI:N /
SA:N /
E:X /
CR:X /
IR:X /
AR:X /
MAV:X /
MAC:X /
MAT:X /
MPR:X /
MUI:X /
MVC:X /
MVI:X /
MVA:X /
MSC:X /
MSI:X /
MSA:X /
S:X /
AU:X /
R:X /
V:X /
RE:X /
U:X
Affected Products / Versions
- f5 / dos
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 4.3.0 · through (inclusive) 4.7.0
cpe:2.3:a:f5:dos:*:*:*:*:*:nginx:*:* - f5 / dos
Source: NVD CPE · affected
Version / affected range: 4.9.0
cpe:2.3:a:f5:dos:4.9.0:*:*:*:*:nginx:*:* - f5 / nginx_gateway_fabric
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 1.3.0 · through (inclusive) 1.6.2
cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:* - f5 / nginx_gateway_fabric
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 2.0.0 · through (inclusive) 2.6.3
cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:* - f5 / nginx_ingress_controller
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 3.5.0 · through (inclusive) 3.7.2
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:continuous_releases:*:*:* - f5 / nginx_ingress_controller
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 4.0.0 · through (inclusive) 4.0.1
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:continuous_releases:*:*:* - f5 / nginx_ingress_controller
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 5.0.0 · through (inclusive) 5.5.0
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:continuous_releases:*:*:* - f5 / nginx_instance_manager
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 2.17.0 · through (inclusive) 2.22.0
cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:* - f5 / nginx_open_source
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 1.0.0 · through (inclusive) 1.30.2
cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:* - f5 / nginx_open_source
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 1.31.0 · through (inclusive) 1.31.1
cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:* - f5 / nginx_plus
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 37.0.0.1 · before (exclusive) 37.0.2.1
cpe:2.3:a:f5:nginx_plus:*:*:*:*:long-term_support:*:*:* - f5 / nginx_plus
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) r33 · before (exclusive) r36
cpe:2.3:a:f5:nginx_plus:*:*:*:*:continuous_releases:*:*:* - f5 / nginx_plus
Source: NVD CPE · affected
Version / affected range: r36
cpe:2.3:a:f5:nginx_plus:r36:-:*:*:continuous_releases:*:*:* - f5 / nginx_plus
Source: NVD CPE · affected
Version / affected range: r36
cpe:2.3:a:f5:nginx_plus:r36:p1:*:*:continuous_releases:*:*:* - f5 / nginx_plus
Source: NVD CPE · affected
Version / affected range: r36
cpe:2.3:a:f5:nginx_plus:r36:p2:*:*:continuous_releases:*:*:* - f5 / nginx_plus
Source: NVD CPE · affected
Version / affected range: r36
cpe:2.3:a:f5:nginx_plus:r36:p3:*:*:continuous_releases:*:*:* - f5 / nginx_plus
Source: NVD CPE · affected
Version / affected range: r36
cpe:2.3:a:f5:nginx_plus:r36:p4:*:*:continuous_releases:*:*:* - f5 / nginx_plus
Source: NVD CPE · affected
Version / affected range: r36
cpe:2.3:a:f5:nginx_plus:r36:p5:*:*:continuous_releases:*:*:* - f5 / waf
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 4.10.0 · through (inclusive) 4.16.0
cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:* - f5 / waf
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 5.2.0 · through (inclusive) 5.8.0
cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:* - f5 / waf
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 5.9.0 · through (inclusive) 5.13.1
cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:* - redhat / discovery
Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:a:redhat:discovery:-:*:*:*:*:*:*:* - redhat / hardened_images
Source: NVD CPE · affected
Version / affected range: -
cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:* - redhat / update_infrastructure
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 5.0 · before (exclusive) 5.2
cpe:2.3:a:redhat:update_infrastructure:*:*:*:*:*:*:*:* - redhat / enterprise_linux
Source: NVD CPE · affected
Version / affected range: 8.0
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* - redhat / enterprise_linux
Source: NVD CPE · affected
Version / affected range: 9.0
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* - redhat / enterprise_linux
Source: NVD CPE · affected
Version / affected range: 10.0
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
References
- [email protected]
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
- 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Reported Context (2)
- F5 has released patches for two critical NGINX Open Source vulnerabilities, CVE-2026-42530 and CVE-2026-42055, that could allow remote unauthenticated attackers to execute code under certain configurations. F5 Patches Two Critical NGINX Flaws That Could Enable Remote Code Execution
- #NGINX F5 Issues Out-of-Band Patches for Critical NGINX Vulnerabilities
CVE (4)
MITRE ATT&CK (1)
Vendors (1)
Products (10)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.