{"id":"CVE-2026-97205","aliases":["ALPINE-CVE-2026-97205","AZL-108443","BELL-CVE-2026-97205","BIT-nginx-2026-97205","BIT-nginx-gateway-2026-97205","CLSA-2026-1792571502","CLSA-2026-1792589925","DEBIAN-CVE-2026-97205","EUVD-2026-101115","GHSA-ff5w-vvxc-fm9x","OESA-2026-4543","OESA-2026-4544","OESA-2026-4545","OESA-2026-4546","RHSA-2026:83427","ROOT-OS-DEBIAN-12-CVE-2026-97205","ROOT-OS-DEBIAN-13-CVE-2026-97205","UBUNTU-CVE-2026-97205","USN-8955-1","USN-8955-2","openSUSE-SU-2026:12143-1"],"status":"published","title":"NGINX ngx_http_core_module vulnerability","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","severity":{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00834,"percentile":0.57929,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-416"],"published":"2026-10-14T14:40:27Z","modified":"2026-11-06T01:13:08Z","exploits":[{"source":"pocgithub","id":"suominen/CVE-2026-97205","title":"suominen/CVE-2026-97205","date":"2026-10-15","url":"https://github.com/suominen/CVE-2026-97205"}],"fixes":[{"ecosystem":"Alpine:v3.24","package":"nginx","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"nginx","fixed_in":["1.30.6-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"nginx","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"nginx-base","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"nginx","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"nginx-base","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nginx","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nginx-base","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"nginx-base","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"nginx-base","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"nginx-base","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"nginx","fixed_in":["1.30.6","1.31.7"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"nginx-gateway","fixed_in":["1.30.6","1.31.7"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx","fixed_in":["1:1.20.1-14.el9_2.1.alma.1.tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-all-modules","fixed_in":["1:1.20.1-14.el9_2.1.alma.1.tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-core","fixed_in":["1:1.20.1-14.el9_2.1.alma.1.tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-filesystem","fixed_in":["1:1.20.1-14.el9_2.1.alma.1.tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-devel","fixed_in":["1:1.20.1-14.el9_2.1.alma.1.tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-http-image-filter","fixed_in":["1:1.20.1-14.el9_2.1.alma.1.tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-http-perl","fixed_in":["1:1.20.1-14.el9_2.1.alma.1.tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-http-xslt-filter","fixed_in":["1:1.20.1-14.el9_2.1.alma.1.tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-mail","fixed_in":["1:1.20.1-14.el9_2.1.alma.1.tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-stream","fixed_in":["1:1.20.1-14.el9_2.1.alma.1.tuxcare.els16"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx","fixed_in":["2:1.20.1-22.el9_6.3.alma.2.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-all-modules","fixed_in":["2:1.20.1-22.el9_6.3.alma.2.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-core","fixed_in":["2:1.20.1-22.el9_6.3.alma.2.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-filesystem","fixed_in":["2:1.20.1-22.el9_6.3.alma.2.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-devel","fixed_in":["2:1.20.1-22.el9_6.3.alma.2.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-http-image-filter","fixed_in":["2:1.20.1-22.el9_6.3.alma.2.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-http-perl","fixed_in":["2:1.20.1-22.el9_6.3.alma.2.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-http-xslt-filter","fixed_in":["2:1.20.1-22.el9_6.3.alma.2.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-mail","fixed_in":["2:1.20.1-22.el9_6.3.alma.2.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-stream","fixed_in":["2:1.20.1-22.el9_6.3.alma.2.tuxcare.els13"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nginx","fixed_in":["1.26.3-3+deb13u10"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nginx","fixed_in":["1.30.4-8"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"nginx","fixed_in":["1.22.1-9+deb12u10.aikido.11"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-nginx","fixed_in":["1.22.1-9+deb12u10.aikido.11"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nginx","fixed_in":["1.4.6-1ubuntu3.9+esm9"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nginx","fixed_in":["1.10.3-0ubuntu0.16.04.5+esm10"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nginx","fixed_in":["1.14.0-0ubuntu1.11+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"nginx","fixed_in":["1.18.0-0ubuntu1.7+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"nginx","fixed_in":["1.18.0-6ubuntu14.22"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"nginx","fixed_in":["1.24.0-2ubuntu7.19"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"nginx","fixed_in":["1.30.4-7ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"nginx","fixed_in":["1.28.3-2ubuntu1.12"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.6-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.22.1-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"nginx-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.3-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.28.0-r3"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"nginx-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.3-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.22.1-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nginx-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.3-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"nginx-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.3-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"nginx-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.3-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"nginx-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.3-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"nginx","ranges":[{"type":"SEMVER","events":[{"introduced":"1.30.0"},{"fixed":"1.30.6"},{"introduced":"1.31.0"},{"fixed":"1.31.7"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"nginx-gateway","ranges":[{"type":"SEMVER","events":[{"introduced":"1.30.0"},{"fixed":"1.30.6"},{"introduced":"1.31.0"},{"fixed":"1.31.7"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.20.1-14.el9_2.1.alma.1.tuxcare.els16"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.1-22.el9_6.3.alma.2.tuxcare.els13"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.1-9","1.22.1-9+deb12u1","1.22.1-9+deb12u10","1.22.1-9+deb12u2","1.22.1-9+deb12u3","1.22.1-9+deb12u4","1.22.1-9+deb12u5","1.22.1-9+deb12u6","1.22.1-9+deb12u7","1.22.1-9+deb12u8","1.22.1-9+deb12u9","1.24.0-1","1.24.0-1~exp1","1.24.0-2","1.26.0-1","1.26.0-1~exp1","1.26.0-2","1.26.0-3","1.26.2-1","1.26.3-1","1.26.3-2","1.26.3-3","1.28.0-1","1.28.0-2","1.28.0-3","1.28.0-4","1.28.0-5","1.28.0-6","1.28.1-1","1.28.1-2","1.28.1-3","1.28.2-1","1.28.2-2","1.28.2-3","1.28.2-4","1.28.3-1","1.28.3-2","1.30.0-1","1.30.0-2","1.30.0-3","1.30.0-4","1.30.1-1","1.30.1-2","1.30.1-3","1.30.1-4","1.30.1-5","1.30.1-6","1.30.1-7","1.30.4-1","1.30.4-2","1.30.4-3","1.30.4-4","1.30.4-5","1.30.4-6","1.30.4-7","1.30.4-8","1.30.6-1","1.30.6-2"]},{"source":"osv","ecosystem":"Debian:13","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.3-3+deb13u10"}]}],"versions":["1.26.3-3","1.26.3-3+deb13u1","1.26.3-3+deb13u2","1.26.3-3+deb13u3","1.26.3-3+deb13u4","1.26.3-3+deb13u5","1.26.3-3+deb13u6","1.26.3-3+deb13u7","1.26.3-3+deb13u8","1.26.3-3+deb13u9"]},{"source":"osv","ecosystem":"Debian:14","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4-8"}]}],"versions":["1.26.3-3","1.28.0-1","1.28.0-2","1.28.0-3","1.28.0-4","1.28.0-5","1.28.0-6","1.28.1-1","1.28.1-2","1.28.1-3","1.28.2-1","1.28.2-2","1.28.2-3","1.28.2-4","1.28.3-1","1.28.3-2","1.30.0-1","1.30.0-2","1.30.0-3","1.30.0-4","1.30.1-1","1.30.1-2","1.30.1-3","1.30.1-4","1.30.1-5","1.30.1-6","1.30.1-7","1.30.4-1","1.30.4-2","1.30.4-3","1.30.4-4","1.30.4-5","1.30.4-6","1.30.4-7"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-20.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-16.oe2403sp1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-15.oe2403sp3"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-15.oe2403sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-geoip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-stream-geoip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Root:Debian:12","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.1-9+deb12u10.aikido.11"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.1-9+deb12u10.aikido.11"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-1ubuntu3.9+esm9"}]}],"versions":["1.4.1-3ubuntu1","1.4.3-2ubuntu1","1.4.4-1ubuntu1","1.4.4-2ubuntu1","1.4.4-4ubuntu1","1.4.5-1ubuntu1","1.4.6-1ubuntu2","1.4.6-1ubuntu3","1.4.6-1ubuntu3.1","1.4.6-1ubuntu3.2","1.4.6-1ubuntu3.3","1.4.6-1ubuntu3.4","1.4.6-1ubuntu3.5","1.4.6-1ubuntu3.6","1.4.6-1ubuntu3.7","1.4.6-1ubuntu3.8","1.4.6-1ubuntu3.9","1.4.6-1ubuntu3.9+esm1","1.4.6-1ubuntu3.9+esm2","1.4.6-1ubuntu3.9+esm3","1.4.6-1ubuntu3.9+esm4","1.4.6-1ubuntu3.9+esm5","1.4.6-1ubuntu3.9+esm6","1.4.6-1ubuntu3.9+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.5+esm10"}]}],"versions":["1.9.3-1ubuntu1","1.9.6-2ubuntu1","1.9.6-2ubuntu2","1.9.9-0ubuntu1","1.9.9-1ubuntu1","1.9.10-0ubuntu1","1.9.10-1ubuntu1","1.9.11-0ubuntu1","1.9.11-0ubuntu2","1.9.12-0ubuntu1","1.9.13-0ubuntu1","1.9.14-0ubuntu1","1.9.15-0ubuntu1","1.10.0-0ubuntu0.16.04.1","1.10.0-0ubuntu0.16.04.2","1.10.0-0ubuntu0.16.04.3","1.10.0-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.1","1.10.3-0ubuntu0.16.04.2","1.10.3-0ubuntu0.16.04.3","1.10.3-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.5","1.10.3-0ubuntu0.16.04.5+esm1","1.10.3-0ubuntu0.16.04.5+esm2","1.10.3-0ubuntu0.16.04.5+esm3","1.10.3-0ubuntu0.16.04.5+esm4","1.10.3-0ubuntu0.16.04.5+esm5","1.10.3-0ubuntu0.16.04.5+esm6","1.10.3-0ubuntu0.16.04.5+esm7","1.10.3-0ubuntu0.16.04.5+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+esm5"}]}],"versions":["1.12.1-0ubuntu2","1.13.6-2ubuntu1","1.13.6-2ubuntu2","1.13.10-1ubuntu1","1.13.12-0ubuntu1","1.14.0-0ubuntu1","1.14.0-0ubuntu1.1","1.14.0-0ubuntu1.2","1.14.0-0ubuntu1.3","1.14.0-0ubuntu1.4","1.14.0-0ubuntu1.5","1.14.0-0ubuntu1.6","1.14.0-0ubuntu1.7","1.14.0-0ubuntu1.9","1.14.0-0ubuntu1.10","1.14.0-0ubuntu1.11","1.14.0-0ubuntu1.11+esm1","1.14.0-0ubuntu1.11+esm2","1.14.0-0ubuntu1.11+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+esm4"}]}],"versions":["1.16.1-0ubuntu2","1.16.1-0ubuntu3","1.17.5-0ubuntu1","1.17.6-0ubuntu1","1.17.7-0ubuntu1","1.17.8-0ubuntu1","1.17.8-0ubuntu2","1.17.8-0ubuntu3","1.17.9-0ubuntu1","1.17.9-0ubuntu2","1.17.9-0ubuntu3","1.17.10-0ubuntu1","1.18.0-0ubuntu1","1.18.0-0ubuntu1.2","1.18.0-0ubuntu1.3","1.18.0-0ubuntu1.4","1.18.0-0ubuntu1.5","1.18.0-0ubuntu1.6","1.18.0-0ubuntu1.7","1.18.0-0ubuntu1.7+esm1","1.18.0-0ubuntu1.7+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-6ubuntu14.22"}]}],"versions":["1.18.0-6ubuntu11","1.18.0-6ubuntu12","1.18.0-6ubuntu14","1.18.0-6ubuntu14.1","1.18.0-6ubuntu14.2","1.18.0-6ubuntu14.3","1.18.0-6ubuntu14.4","1.18.0-6ubuntu14.5","1.18.0-6ubuntu14.6","1.18.0-6ubuntu14.7","1.18.0-6ubuntu14.8","1.18.0-6ubuntu14.10","1.18.0-6ubuntu14.11","1.18.0-6ubuntu14.12","1.18.0-6ubuntu14.13","1.18.0-6ubuntu14.14","1.18.0-6ubuntu14.15","1.18.0-6ubuntu14.16","1.18.0-6ubuntu14.17","1.18.0-6ubuntu14.18","1.18.0-6ubuntu14.19","1.18.0-6ubuntu14.20","1.18.0-6ubuntu14.21"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-2ubuntu7.19"}]}],"versions":["1.24.0-1ubuntu1","1.24.0-2ubuntu1","1.24.0-2ubuntu2","1.24.0-2ubuntu3","1.24.0-2ubuntu4","1.24.0-2ubuntu6","1.24.0-2ubuntu7","1.24.0-2ubuntu7.1","1.24.0-2ubuntu7.3","1.24.0-2ubuntu7.4","1.24.0-2ubuntu7.5","1.24.0-2ubuntu7.6","1.24.0-2ubuntu7.7","1.24.0-2ubuntu7.8","1.24.0-2ubuntu7.9","1.24.0-2ubuntu7.10","1.24.0-2ubuntu7.11","1.24.0-2ubuntu7.12","1.24.0-2ubuntu7.13","1.24.0-2ubuntu7.14","1.24.0-2ubuntu7.15","1.24.0-2ubuntu7.16","1.24.0-2ubuntu7.17","1.24.0-2ubuntu7.18"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4-7ubuntu1.1"}]}],"versions":["1.28.3-2ubuntu1","1.30.1-4ubuntu1","1.30.1-6ubuntu1","1.30.4-5ubuntu1","1.30.4-7ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.3-2ubuntu1.12"}]}],"versions":["1.28.0-6ubuntu1","1.28.1-2ubuntu1","1.28.1-3ubuntu1","1.28.2-2ubuntu1","1.28.3-2ubuntu1","1.28.3-2ubuntu1.1","1.28.3-2ubuntu1.2","1.28.3-2ubuntu1.3","1.28.3-2ubuntu1.4","1.28.3-2ubuntu1.5","1.28.3-2ubuntu1.6","1.28.3-2ubuntu1.7","1.28.3-2ubuntu1.8","1.28.3-2ubuntu1.9","1.28.3-2ubuntu1.10","1.28.3-2ubuntu1.11"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-6ubuntu14.22"}]}],"versions":["1.18.0-6ubuntu11","1.18.0-6ubuntu12","1.18.0-6ubuntu14","1.18.0-6ubuntu14.1","1.18.0-6ubuntu14.2","1.18.0-6ubuntu14.3","1.18.0-6ubuntu14.4","1.18.0-6ubuntu14.5","1.18.0-6ubuntu14.6","1.18.0-6ubuntu14.7","1.18.0-6ubuntu14.8","1.18.0-6ubuntu14.10","1.18.0-6ubuntu14.11","1.18.0-6ubuntu14.12","1.18.0-6ubuntu14.13","1.18.0-6ubuntu14.14","1.18.0-6ubuntu14.15","1.18.0-6ubuntu14.16","1.18.0-6ubuntu14.17","1.18.0-6ubuntu14.18","1.18.0-6ubuntu14.19","1.18.0-6ubuntu14.20","1.18.0-6ubuntu14.21"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-2ubuntu7.19"}]}],"versions":["1.24.0-1ubuntu1","1.24.0-2ubuntu1","1.24.0-2ubuntu2","1.24.0-2ubuntu3","1.24.0-2ubuntu4","1.24.0-2ubuntu6","1.24.0-2ubuntu7","1.24.0-2ubuntu7.1","1.24.0-2ubuntu7.3","1.24.0-2ubuntu7.4","1.24.0-2ubuntu7.5","1.24.0-2ubuntu7.6","1.24.0-2ubuntu7.7","1.24.0-2ubuntu7.8","1.24.0-2ubuntu7.9","1.24.0-2ubuntu7.10","1.24.0-2ubuntu7.11","1.24.0-2ubuntu7.12","1.24.0-2ubuntu7.13","1.24.0-2ubuntu7.14","1.24.0-2ubuntu7.15","1.24.0-2ubuntu7.16","1.24.0-2ubuntu7.17","1.24.0-2ubuntu7.18"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4-7ubuntu1.1"}]}],"versions":["1.28.3-2ubuntu1","1.30.1-4ubuntu1","1.30.1-6ubuntu1","1.30.4-5ubuntu1","1.30.4-7ubuntu1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.3-2ubuntu1.12"}]}],"versions":["1.28.0-6ubuntu1","1.28.1-2ubuntu1","1.28.1-3ubuntu1","1.28.2-2ubuntu1","1.28.3-2ubuntu1","1.28.3-2ubuntu1.1","1.28.3-2ubuntu1.2","1.28.3-2ubuntu1.3","1.28.3-2ubuntu1.4","1.28.3-2ubuntu1.5","1.28.3-2ubuntu1.6","1.28.3-2ubuntu1.7","1.28.3-2ubuntu1.8","1.28.3-2ubuntu1.9","1.28.3-2ubuntu1.10","1.28.3-2ubuntu1.11"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-1ubuntu3.9+esm9"}]}],"versions":["1.4.1-3ubuntu1","1.4.3-2ubuntu1","1.4.4-1ubuntu1","1.4.4-2ubuntu1","1.4.4-4ubuntu1","1.4.5-1ubuntu1","1.4.6-1ubuntu2","1.4.6-1ubuntu3","1.4.6-1ubuntu3.1","1.4.6-1ubuntu3.2","1.4.6-1ubuntu3.3","1.4.6-1ubuntu3.4","1.4.6-1ubuntu3.5","1.4.6-1ubuntu3.6","1.4.6-1ubuntu3.7","1.4.6-1ubuntu3.8","1.4.6-1ubuntu3.9","1.4.6-1ubuntu3.9+esm1","1.4.6-1ubuntu3.9+esm2","1.4.6-1ubuntu3.9+esm3","1.4.6-1ubuntu3.9+esm4","1.4.6-1ubuntu3.9+esm5","1.4.6-1ubuntu3.9+esm6","1.4.6-1ubuntu3.9+esm8"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.5+esm10"}]}],"versions":["1.9.3-1ubuntu1","1.9.6-2ubuntu1","1.9.6-2ubuntu2","1.9.9-0ubuntu1","1.9.9-1ubuntu1","1.9.10-0ubuntu1","1.9.10-1ubuntu1","1.9.11-0ubuntu1","1.9.11-0ubuntu2","1.9.12-0ubuntu1","1.9.13-0ubuntu1","1.9.14-0ubuntu1","1.9.15-0ubuntu1","1.10.0-0ubuntu0.16.04.1","1.10.0-0ubuntu0.16.04.2","1.10.0-0ubuntu0.16.04.3","1.10.0-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.1","1.10.3-0ubuntu0.16.04.2","1.10.3-0ubuntu0.16.04.3","1.10.3-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.5","1.10.3-0ubuntu0.16.04.5+esm1","1.10.3-0ubuntu0.16.04.5+esm2","1.10.3-0ubuntu0.16.04.5+esm3","1.10.3-0ubuntu0.16.04.5+esm4","1.10.3-0ubuntu0.16.04.5+esm5","1.10.3-0ubuntu0.16.04.5+esm6","1.10.3-0ubuntu0.16.04.5+esm7","1.10.3-0ubuntu0.16.04.5+esm9"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+esm5"}]}],"versions":["1.12.1-0ubuntu2","1.13.6-2ubuntu1","1.13.6-2ubuntu2","1.13.10-1ubuntu1","1.13.12-0ubuntu1","1.14.0-0ubuntu1","1.14.0-0ubuntu1.1","1.14.0-0ubuntu1.2","1.14.0-0ubuntu1.3","1.14.0-0ubuntu1.4","1.14.0-0ubuntu1.5","1.14.0-0ubuntu1.6","1.14.0-0ubuntu1.7","1.14.0-0ubuntu1.9","1.14.0-0ubuntu1.10","1.14.0-0ubuntu1.11","1.14.0-0ubuntu1.11+esm1","1.14.0-0ubuntu1.11+esm2","1.14.0-0ubuntu1.11+esm4"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+esm4"}]}],"versions":["1.16.1-0ubuntu2","1.16.1-0ubuntu3","1.17.5-0ubuntu1","1.17.6-0ubuntu1","1.17.7-0ubuntu1","1.17.8-0ubuntu1","1.17.8-0ubuntu2","1.17.8-0ubuntu3","1.17.9-0ubuntu1","1.17.9-0ubuntu2","1.17.9-0ubuntu3","1.17.10-0ubuntu1","1.18.0-0ubuntu1","1.18.0-0ubuntu1.2","1.18.0-0ubuntu1.3","1.18.0-0ubuntu1.4","1.18.0-0ubuntu1.5","1.18.0-0ubuntu1.6","1.18.0-0ubuntu1.7","1.18.0-0ubuntu1.7+esm1","1.18.0-0ubuntu1.7+esm3"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.7-1.1"}]}],"bundled":5}],"products":[{"vendor":"f5","product":"nginx open source"},{"vendor":"f5","product":"nginx plus"}],"references":[{"url":"https://my.f5.com/manage/s/article/K000162608","tags":["vendor-advisory","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97205","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-ff5w-vvxc-fm9x"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-97205","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-97205","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1792571502.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1792589925.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-97205","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4543","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15176","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93479","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4544","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97629","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4545","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4546","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:83427","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15176","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-97205","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-97629","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-95101","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83427.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2552352","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15176","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000162416","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2552355","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-95101","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95101","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000162613","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2552359","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97205","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2552364","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97629","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000162606","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-97205","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8955-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8955-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-15176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93479","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-95101","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97629","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-42533","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-95101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97629","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-97205","title":"NGINX ngx_http_core_module vulnerability","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T14:40:27.487Z","modified":"2026-10-15T10:31:15.547Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T13:44:07.200604Z"}],"euvd":[{"id":"EUVD-2026-101115","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T14:40:27Z","modified":"2026-10-15T10:31:15Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T17:00:15.076272Z"}],"ghsa":[{"id":"GHSA-ff5w-vvxc-fm9x","title":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When...","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T15:32:30Z","modified":"2026-10-14T15:32:39Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:13:26.117603Z"}],"nvd":[{"id":"CVE-2026-97205","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T15:17:28.2Z","modified":"2026-10-15T11:18:08.67Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:12:58.99337Z"}],"osv":[{"id":"ALPINE-CVE-2026-97205","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T15:17:28.2Z","modified":"2026-10-22T11:30:02.513778107Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"BELL-CVE-2026-97205","status":"published","published":"2026-10-17T06:05:41.880282Z","modified":"2026-10-22T08:30:06.43640515Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:27.468539Z"},{"id":"DEBIAN-CVE-2026-97205","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.     Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T15:17:28.2Z","modified":"2026-10-21T17:01:59.886797093Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"updated_at":"2026-11-02T15:46:07.324252Z"},{"id":"OESA-2026-4543","title":"nginx security update","description":"NGINX is a free, open-source, high-performance HTTP server and reverse proxy,  as well as an IMAP/POP3 proxy server.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-15176)\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map\u0026apos;s regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact: \nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-93479)\n\nNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-97205)","status":"published","published":"2026-10-29T09:02:45Z","modified":"2026-10-29T09:15:26.752222537Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4544","title":"nginx security update","description":"NGINX is a free, open-source, high-performance HTTP server and reverse proxy,  as well as an IMAP/POP3 proxy server.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-15176)\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map\u0026apos;s regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact: \nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-93479)\n\nNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-97205)\n\nDescription\nWhen NGINX Plus or NGINX Open Source is configured with ssl_session_cache \n\nshared:name:size\n\nwithout an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions \n\nin a non-deterministic manner that is beyond the attacker\u0026apos;s control. An attacker could leverage this vulnerability to bypass verification of client certificates.\n\nImpact\n\n\nThis vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-97629)","status":"published","published":"2026-10-29T09:02:46Z","modified":"2026-10-29T09:15:26.178757646Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4545","title":"nginx security update","description":"NGINX is a free, open-source, high-performance HTTP server and reverse proxy,  as well as an IMAP/POP3 proxy server.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-15176)\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map\u0026apos;s regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact: \nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-93479)\n\nNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-97205)\n\nDescription\nWhen NGINX Plus or NGINX Open Source is configured with ssl_session_cache \n\nshared:name:size\n\nwithout an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions \n\nin a non-deterministic manner that is beyond the attacker\u0026apos;s control. An attacker could leverage this vulnerability to bypass verification of client certificates.\n\nImpact\n\n\nThis vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-97629)","status":"published","published":"2026-10-29T09:02:46Z","modified":"2026-10-29T09:15:27.099239173Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4546","title":"nginx security update","description":"NGINX is a free, open-source, high-performance HTTP server and reverse proxy,  as well as an IMAP/POP3 proxy server.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-15176)\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map\u0026apos;s regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact: \nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-93479)\n\nNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-97205)\n\nDescription\nWhen NGINX Plus or NGINX Open Source is configured with ssl_session_cache \n\nshared:name:size\n\nwithout an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions \n\nin a non-deterministic manner that is beyond the attacker\u0026apos;s control. An attacker could leverage this vulnerability to bypass verification of client certificates.\n\nImpact\n\n\nThis vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-97629)","status":"published","published":"2026-10-29T09:02:47Z","modified":"2026-10-29T09:15:27.522745084Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"RHSA-2026:83427","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-16T10:27:21Z","modified":"2026-10-20T10:43:38.614397927Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"UBUNTU-CVE-2026-97205","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-15T00:00:00Z","modified":"2026-11-06T01:11:58.823517344Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-06T01:32:47.895286Z"},{"id":"AZL-108443","title":"CVE-2026-97205 affecting package nginx for versions less than 1.30.6-1","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T15:17:28Z","modified":"2026-11-02T14:17:29.16902242Z","updated_at":"2026-11-02T15:28:01.725816Z"},{"id":"BIT-nginx-2026-97205","title":"NGINX ngx_http_core_module vulnerability","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-21T08:54:05.582Z","modified":"2026-10-21T12:11:26.429928178Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-nginx-gateway-2026-97205","title":"NGINX ngx_http_core_module vulnerability","description":"NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-21T08:54:19.423Z","modified":"2026-10-21T12:11:26.429928178Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"CLSA-2026-1792571502","title":"nginx: Fix of CVE-2026-97205","description":"- CVE-2026-97205: limit the number of pending operations per request so\n  that the 8-bit r-\u003emain-\u003eblocked counter cannot overflow","status":"published","published":"2026-10-21T08:31:53Z","modified":"2026-10-26T09:31:02.882248559Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792589925","title":"nginx: Fix of CVE-2026-97205","description":"- CVE-2026-97205: limit pending asynchronous operations per request to\n  NGX_HTTP_MAX_BLOCKED so the 8-bit r-\u003emain-\u003eblocked counter cannot wrap","status":"published","published":"2026-10-22T01:13:50Z","modified":"2026-10-26T09:31:19.808175483Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"openSUSE-SU-2026:12143-1","title":"nginx-1.31.7-1.1 on GA media","description":"These are all security issues fixed in the nginx-1.31.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-15T00:00:00Z","modified":"2026-10-16T17:23:13.464278658Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-97205","title":"CVE-2026-97205 in nginx - Patched by Root","description":"Root has patched CVE-2026-97205 in the nginx package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-20T11:32:19Z","modified":"2026-10-20T12:15:40.134260045Z","updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-97205","title":"CVE-2026-97205 in nginx - Patched by Root","description":"Root has patched CVE-2026-97205 in the nginx package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-10-22T07:10:55Z","modified":"2026-10-23T13:00:05.186360509Z","updated_at":"2026-11-02T15:53:33.943322Z"},{"id":"USN-8955-1","title":"nginx vulnerabilities","description":"It was discovered that nginx incorrectly handled certain configurations\nusing the alias directive together with rewrite rules. A remote attacker\ncould possibly use this issue to cause nginx to crash, resulting in a\ndenial of service, or execute arbitrary code.\n(CVE-2026-15176)\n\nIt was discovered that nginx incorrectly handled map directives using\nregex matching under certain circumstances. A remote attacker could\npossibly use this issue to cause nginx to crash, resulting in a denial\nof service, or execute arbitrary code.\n(CVE-2026-93479)\n\nIt was discovered that nginx incorrectly handled HTTP/3 requests when\nproxy_request_buffering was enabled. This issue only affected\nUbuntu 26.04 LTS and Ubuntu 26.10. A remote attacker could possibly use\nthis issue to inject data into proxied requests.\n(CVE-2026-95101)\n\nIt was discovered that nginx incorrectly handled asynchronous file I/O\nin certain configurations with Server Side Includes pages. A remote\nattacker could possibly use this issue to cause nginx to crash,\nresulting in a denial of service, or execute arbitrary code.\n(CVE-2026-97205)\n\nIt was discovered that nginx incorrectly handled SSL session ticket keys\nwhen configured with a shared session cache but without explicit ticket\nkey rotation. This issue only affected Ubuntu 24.04 LTS, Ubuntu 26.04 LTS,\nand Ubuntu 26.10. A remote attacker\ncould possibly use this issue to forge client SSL sessions and bypass\nclient certificate verification.\n(CVE-2026-97629)","status":"published","published":"2026-10-26T15:34:05Z","modified":"2026-10-26T22:46:19.977872622Z","updated_at":"2026-11-02T16:58:26.907654Z"},{"id":"USN-8955-2","title":"nginx vulnerabilities","description":"USN-8955-1 fixed vulnerabilities in nginx in Ubuntu 26.10, Ubuntu 26.04\nLTS, Ubuntu 24.04 LTS, and Ubuntu 22.04 LTS. This update provides the\ncorresponding update for Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu 16.04\nLTS, and Ubuntu 14.04 LTS.\n\nIn addition, this update fixes CVE-2026-42533 for these releases.\n\nIt was discovered that nginx incorrectly handled certain map directives\nusing regex matching and capture variables. A remote attacker could\npossibly use this issue to crash nginx, resulting in a denial of\nservice, or possibly execute arbitrary code. (CVE-2026-42533)\n\nOriginal advisory details:\n\n It was discovered that nginx incorrectly handled certain configurations\nusing the alias directive together with rewrite rules. A remote attacker\ncould possibly use this issue to cause nginx to crash, resulting in a\ndenial of service, or execute arbitrary code.  (CVE-2026-15176)\n\n It was discovered that nginx incorrectly handled map directives using\nregex matching under certain circumstances. A remote attacker could\npossibly use this issue to cause nginx to crash, resulting in a denial  of\nservice, or execute arbitrary code.  (CVE-2026-93479)\n\n It was discovered that nginx incorrectly handled HTTP/3 requests when\nproxy_request_buffering was enabled. This issue only affected  Ubuntu 26.04\nLTS and Ubuntu 26.10. A remote attacker could possibly use  this issue to\ninject data into proxied requests.  (CVE-2026-95101)\n\n It was discovered that nginx incorrectly handled asynchronous file I/O  in\ncertain configurations with Server Side Includes pages. A remote  attacker\ncould possibly use this issue to cause nginx to crash,  resulting in a\ndenial of service, or execute arbitrary code.  (CVE-2026-97205)\n\n It was discovered that nginx incorrectly handled SSL session ticket keys\nwhen configured with a shared session cache but without explicit ticket\nkey rotation. This issue only affected Ubuntu 24.04 LTS, Ubuntu 26.04 LTS,\nand Ubuntu 26.10. A remote attacker  could possibly use this issue to forge\nclient SSL sessions and bypass  client certificate verification.\n(CVE-2026-97629)","status":"published","published":"2026-11-05T14:40:26Z","modified":"2026-11-06T01:13:08.896367466Z","updated_at":"2026-11-06T01:32:47.895286Z"}]}}