{"id":"CVE-2026-42530","aliases":["BIT-nginx-2026-42530","BIT-nginx-gateway-2026-42530","DEBIAN-CVE-2026-42530","EUVD-2026-37717","GHSA-5mcp-3252-f5vr","RHSA-2026:20351","UBUNTU-CVE-2026-42530","openSUSE-SU-2026:11066-1"],"status":"published","title":"NGINX Open-Source ngx_http_v3_module vulnerability","description":"NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","severity":{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.06218,"percentile":0.93587,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-416"],"published":"2026-05-26T10:07:21Z","modified":"2026-10-28T02:30:41Z","exploits":[{"source":"pocgithub","id":"HORKimhab/CVE-2026-42530","title":"HORKimhab/CVE-2026-42530","date":"2026-06-19","url":"https://github.com/HORKimhab/CVE-2026-42530"},{"source":"pocgithub","id":"ashrafzaryouh/CVE-2026-42530","title":"ashrafzaryouh/CVE-2026-42530","date":"2026-06-19","url":"https://github.com/ashrafzaryouh/CVE-2026-42530"},{"source":"pocgithub","id":"v4ltonn/CVE-2026-42530","title":"v4ltonn/CVE-2026-42530","date":"2026-06-19","url":"https://github.com/v4ltonn/CVE-2026-42530"}],"fixes":[{"ecosystem":"Bitnami","package":"nginx","fixed_in":["1.31.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"nginx-gateway","fixed_in":["1.31.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"nginx","ranges":[{"type":"SEMVER","events":[{"introduced":"1.31.0"},{"fixed":"1.31.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"nginx-gateway","ranges":[{"type":"SEMVER","events":[{"introduced":"1.31.0"},{"fixed":"1.31.2"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-geoip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-stream-geoip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.2-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.2-1.1"}]}],"bundled":3}],"products":[{"vendor":"f5","product":"nginx open source"},{"vendor":"f5","product":"nginx_gateway_fabric"},{"vendor":"f5","product":"nginx_ingress_controller"},{"vendor":"f5","product":"nginx_instance_manager"},{"vendor":"f5","product":"nginx_open_source"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat lightspeed proxy 1"}],"references":[{"url":"https://my.f5.com/manage/s/article/K000161616","tags":["vendor-advisory","Vendor Advisory","advisory","article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42530","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489872","tags":["issue-tracking","x_refsource_REDHAT","Third Party Advisory","advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42530.json","tags":["x_sadp-csaf-vex","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20351","tags":["vendor-advisory","x_refsource_REDHAT","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42530","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-5mcp-3252-f5vr"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-42530","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-40460","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42926","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9256","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20351.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480746","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9256","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9256","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000161377","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477113","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40460","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40460","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000161068","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42530","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477068","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42926","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42926","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000161131","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-42530","tags":["report"]},{"url":"https://github.com/nginx/nginx/commit/ceccdbd2ee799d020a371b9420bdacb9cf273aa7","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48142","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-42530","title":"NGINX Open-Source ngx_http_v3_module vulnerability","description":"NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-06-17T14:04:32.173Z","modified":"2026-07-16T12:04:40.146Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-416","CWE-416"],"updated_at":"2026-11-02T13:40:35.004553Z"}],"euvd":[{"id":"EUVD-2026-37717","description":"NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-06-17T14:04:32Z","modified":"2026-07-16T12:04:40Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T18:19:52.35951Z"}],"ghsa":[{"id":"GHSA-5mcp-3252-f5vr","title":"NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is...","description":"NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-06-17T18:35:56Z","modified":"2026-07-16T12:33:31Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:09:33.90316Z"}],"nvd":[{"id":"CVE-2026-42530","description":"NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-06-17T15:16:50.63Z","modified":"2026-10-26T12:10:00.13Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:12:24.544761Z"}],"osv":[{"id":"CVE-2026-42530","description":"NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-06-17T15:16:50.63Z","modified":"2026-10-28T02:30:41.881199424Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"updated_at":"2026-11-02T15:45:04.117819Z"},{"id":"DEBIAN-CVE-2026-42530","description":"NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.     Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"withdrawn","published":"2026-06-17T15:16:50.63Z","modified":"2026-06-19T08:00:44.576702501Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"updated_at":"2026-11-02T15:45:55.251751Z"},{"id":"RHSA-2026:20351","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-05-26T10:07:21Z","modified":"2026-10-17T10:10:38Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"BIT-nginx-2026-42530","title":"NGINX Open-Source ngx_http_v3_module vulnerability","description":"NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-06-22T05:47:01.707Z","modified":"2026-09-08T08:48:16.829444531Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-nginx-gateway-2026-42530","title":"NGINX Open-Source ngx_http_v3_module vulnerability","description":"NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-06-22T05:47:03.772Z","modified":"2026-09-08T08:48:16.847337621Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"openSUSE-SU-2026:11066-1","title":"nginx-1.31.2-1.1 on GA media","description":"These are all security issues fixed in the nginx-1.31.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-19T00:00:00Z","modified":"2026-06-20T08:45:08.6769413Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"UBUNTU-CVE-2026-42530","description":"(NGINX Open Source has a vulnerability in the ngx_http_v3_modulemodule. ...)","status":"withdrawn","published":"2026-06-19T00:00:00Z","modified":"2026-06-19T18:00:08.161157497Z","updated_at":"2026-11-02T16:56:18.393417Z"}]}}