CVE-2026-42530

Published Jun 17, 2026

Last updated 12 days ago

HTTP

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-42530 is a Use-After-Free vulnerability found in the `ngx_http_v3_module` of NGINX Open Source. This flaw allows a remote, unauthenticated attacker to exploit systems configured to use the HTTP/3 QUIC module. By sending a specially crafted HTTP/3 session, an attacker can force the reopening of a QPACK encoder stream, which can lead to a Use-After-Free condition in the NGINX worker process. Successful exploitation of this vulnerability can cause the NGINX worker process to restart, resulting in a denial-of-service (DoS) condition. Additionally, attackers may be able to execute arbitrary code on systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed. The vulnerability affects NGINX Open Source versions 1.31.0 through 1.31.1, as well as specific versions of NGINX Gateway Fabric, NGINX Instance Manager, and NGINX Ingress Controller. A recommended mitigation is to disable HTTP/3 by removing "quic" from all listen directives.

Description: NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source: f5sirt@f5.com
NVD status: Analyzed
Products: nginx_gateway_fabric, nginx_ingress_controller, nginx_instance_manager, nginx_open_source

Risk scores

CVSS 4.0

Type: Secondary
Base score: 9.2
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

CVSS 3.1

Type: Secondary
Base score: 8.1
Impact score: 5.9
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

f5sirt@f5.com: CWE-416
0b0ca135-0b70-47e7-9f44-1890c2a1c46c: CWE-416

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "15B7F1FD-0C49-460F-9CB8-23DA730EC4BE",
            "versionEndIncluding": "1.6.2",
            "versionStartIncluding": "1.3.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "8495C4C7-3BFA-49CD-B527-7E1EE9827634",
            "versionEndExcluding": "2.6.4",
            "versionStartIncluding": "2.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "10D5B143-4C1E-4626-8B49-3EA7160E9256",
            "versionEndIncluding": "3.7.2",
            "versionStartIncluding": "3.5.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "965E7D6E-288B-438E-A2A8-A25802E34933",
            "versionEndExcluding": "5.5.1",
            "versionStartIncluding": "5.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_ingress_controller:4.0.0:*:*:*:*:*:*:*",
            "matchCriteriaId": "896F495E-50C2-4A10-8FE8-F4D0AD52F6FF",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_ingress_controller:4.0.1:*:*:*:*:*:*:*",
            "matchCriteriaId": "0ACDA17B-D0AB-46C1-9D58-21DF6ED5479E",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "BCFCE3FC-61E0-4749-8F09-EEB4B09B1218",
            "versionEndIncluding": "2.22.0",
            "versionStartIncluding": "2.17.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "2C3B90C4-D305-4F5F-B4B2-CD09918D1C94",
            "versionEndExcluding": "1.31.2",
            "versionStartIncluding": "1.31.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.