security_advisories.xml

<!--
  Copyright (C) Igor Sysoev
  Copyright (C) Nginx, Inc.
  -->

<!DOCTYPE article SYSTEM "../../dtd/article.dtd">

<article name="nginx security advisories"
         link="/en/security_advisories.html"
         lang="en"
         rev="1">

<section>

<para>
All nginx security issues should be reported to
<link url="mailto:[email protected]">[email protected]</link>
or via one of the methods listed
<link url="https://github.com/nginx/nginx/blob/master/SECURITY.md">here</link>.
</para>

<para>
Patches are signed using one of the
<link doc="pgp_keys.xml">PGP public keys</link>.
</para>

<security>

<item name="Buffer overflow in the ngx_http_rewrite_module"
      severity="medium"
      advisory="https://my.f5.com/manage/s/article/K000161377"
      cve="2026-9256"
      good="1.31.1+, 1.30.2+"
      vulnerable="0.1.17-1.31.0">
</item>

<item name="HTTP/2 request injection in the ngx_http_proxy_module"
      severity="medium"
      advisory="https://my.f5.com/manage/s/article/K000161131"
      cve="2026-42926"
      good="1.31.0+, 1.30.1+"
      vulnerable="1.29.4-1.30.0">
</item>

<item name="Buffer overflow in the ngx_http_rewrite_module"
      severity="medium"
      advisory="https://my.f5.com/manage/s/article/K000161019"
      cve="2026-42945"
      good="1.31.0+, 1.30.1+"
      vulnerable="0.6.27-1.30.0">
</item>

<item name="Buffer overread in the ngx_http_scgi_module and ngx_http_uwsgi_module"
      severity="medium"
      advisory="https://my.f5.com/manage/s/article/K000161027"
      cve="2026-42946"
      good="1.31.0+, 1.30.1+"
      vulnerable="0.8.42-1.30.0">
</item>

<item name="Buffer overread in the ngx_http_charset_module"
      severity="low"
      advisory="https://my.f5.com/manage/s/article/K000161028"
      cve="2026-42934"
      good="1.31.0+, 1.30.1+"
      vulnerable="0.3.50-1.30.0">
</item>

<item name="HTTP/3 address spoofing"
      severity="medium"
      advisory="https://my.f5.com/manage/s/article/K000161068"
      cve="2026-40460"
      good="1.31.0+, 1.30.1+"
      vulnerable="1.25.0-1.30.0">
</item>

<item name="resolver use-after-free in OCSP"
      severity="medium"
      advisory="https://my.f5.com/manage/s/article/K000161021"
      cve="2026-40701"
      good="1.31.0+, 1.30.1+"
      vulnerable="1.19.0-1.30.0">
</item>

<item name="Buffer overflow in ngx_http_dav_module"
      severity="medium"
      advisory="https://my.f5.com/manage/s/article/K000160382"
      cve="2026-27654"
      good="1.29.7+, 1.28.3+"
      vulnerable="0.5.13-1.29.6">
</item>

<item name="Buffer overflow in the ngx_http_mp4_module"
      severity="medium"
      advisory="https://my.f5.com/manage/s/article/K000160364"
      cve="2026-27784"
      good="1.29.7+, 1.28.3+"
      vulnerable="1.1.19-1.29.6">
</item>

<item name="Buffer overflow in the ngx_http_mp4_module"
      severity="medium"
      advisory="https://my.f5.com/manage/s/article/K000160366"
      cve="2026-32647"
      good="1.29.7+, 1.28.3+"
      vulnerable="1.1.19-1.29.6">
</item>

<item name="NULL pointer dereference while using CRAM-MD5 or APOP"
      severity="low"
      advisory="https://my.f5.com/manage/s/article/K000160383"
      cve="2026-27651"
      good="1.29.7+, 1.28.3+"
      vulnerable="0.5.15-1.29.6">
</item>

<item name="Injection in auth_http and XCLIENT"
      severity="medium"
      advisory="https://my.f5.com/manage/s/article/K000160367"
      cve="2026-28753"
      good="1.29.7+, 1.28.3+"
      vulnerable="0.6.27-1.29.6">
</item>

<item name="OCSP result bypass in stream"
      severity="medium"
      advisory="https://my.f5.com/manage/s/article/K000160368"
      cve="2026-28755"
      good="1.29.7+, 1.28.3+"
      vulnerable="1.27.2-1.29.6">
</item>

<item name="SSL upstream injection"
      severity="medium"
      advisory="https://my.f5.com/manage/s/article/K000159824"
      cve="2026-1642"
      good="1.29.5+, 1.28.2+"
      vulnerable="1.3.0-1.29.4">
</item>

<item name="Buffer overread in the ngx_mail_smtp_module"
      severity="low"
      advisory="https://my.f5.com/manage/s/article/K000152786"
      cve="2025-53859"
      good="1.29.1+"
      vulnerable="0.7.22-1.29.0">
</item>

<item name="SSL session reuse vulnerability"
      severity="medium"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2025/NYEUJX7NCBCGJGXDFVXNMAAMJDFSE45G.html"
      cve="2025-23419"
      good="1.27.4+, 1.26.3+"
      vulnerable="1.11.4-1.27.3">
</item>

<item name="Buffer overread in the ngx_http_mp4_module"
      severity="low"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2024/UUOCLLONPR6244YQYU65PO5LB7JDYCWM.html"
      cve="2024-7347"
      good="1.27.1+, 1.26.2+"
      vulnerable="1.5.13-1.27.0">
<patch name="patch.2024.mp4.txt" />
</item>

<item name="Buffer overwrite in HTTP/3"
      severity="medium"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2024/GMY32CSHFH6VFTN76HJNX7WNEX4RLHF6.html"
      cve="2024-32760"
      good="1.27.0+, 1.26.1+"
      vulnerable="1.25.0-1.25.5, 1.26.0">
</item>

<item name="Stack overflow and use-after-free in HTTP/3"
      severity="medium"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2024/GMY32CSHFH6VFTN76HJNX7WNEX4RLHF6.html"
      cve="2024-31079"
      good="1.27.0+, 1.26.1+"
      vulnerable="1.25.0-1.25.5, 1.26.0">
</item>

<item name="NULL pointer dereference in HTTP/3"
      severity="medium"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2024/GMY32CSHFH6VFTN76HJNX7WNEX4RLHF6.html"
      cve="2024-35200"
      good="1.27.0+, 1.26.1+"
      vulnerable="1.25.0-1.25.5, 1.26.0">
</item>

<item name="Memory disclosure in HTTP/3"
      severity="medium"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2024/GMY32CSHFH6VFTN76HJNX7WNEX4RLHF6.html"
      cve="2024-34161"
      good="1.27.0+, 1.26.1+"
      vulnerable="1.25.0-1.25.5, 1.26.0">
</item>

<item name="NULL pointer dereference in HTTP/3"
      severity="major"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2024/NW6MNW34VZ6HDIHH5YFBIJYZJN7FGNAV.html"
      cve="2024-24989"
      good="1.25.4+"
      vulnerable="1.25.3">
</item>

<item name="Use-after-free in HTTP/3"
      severity="major"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2024/NW6MNW34VZ6HDIHH5YFBIJYZJN7FGNAV.html"
      cve="2024-24990"
      good="1.25.4+"
      vulnerable="1.25.0-1.25.3">
</item>

<item name="Memory corruption in the ngx_http_mp4_module"
      severity="medium"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2022/RBRRON6PYBJJM2XIAPQBFBVLR4Q6IHRA.html"
      cve="2022-41741"
      good="1.23.2+, 1.22.1+"
      vulnerable="1.1.3-1.23.1, 1.0.7-1.0.15">
<patch name="patch.2022.mp4.txt" />
</item>

<item name="Memory disclosure in the ngx_http_mp4_module"
      severity="medium"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2022/RBRRON6PYBJJM2XIAPQBFBVLR4Q6IHRA.html"
      cve="2022-41742"
      good="1.23.2+, 1.22.1+"
      vulnerable="1.1.3-1.23.1, 1.0.7-1.0.15">
<patch name="patch.2022.mp4.txt" />
</item>

<item name="1-byte memory overwrite in resolver"
      severity="medium"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2021/000300.html"
      cve="2021-23017"
      good="1.21.0+, 1.20.1+"
      vulnerable="0.6.18-1.20.0">
<patch name="patch.2021.resolver.txt" />
</item>

<item name="Excessive CPU usage in HTTP/2 with small window updates"
      severity="medium"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2019/000249.html"
      cve="2019-9511"
      good="1.17.3+, 1.16.1+"
      vulnerable="1.9.5-1.17.2">
</item>

<item name="Excessive CPU usage in HTTP/2 with priority changes"
      severity="low"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2019/000249.html"
      cve="2019-9513"
      good="1.17.3+, 1.16.1+"
      vulnerable="1.9.5-1.17.2">
</item>

<item name="Excessive memory usage in HTTP/2 with zero length headers"
      severity="low"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2019/000249.html"
      cve="2019-9516"
      good="1.17.3+, 1.16.1+"
      vulnerable="1.9.5-1.17.2">
</item>

<item name="Excessive memory usage in HTTP/2"
      severity="low"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2018/000220.html"
      cve="2018-16843"
      good="1.15.6+, 1.14.1+"
      vulnerable="1.9.5-1.15.5">
</item>

<item name="Excessive CPU usage in HTTP/2"
      severity="low"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2018/000220.html"
      cve="2018-16844"
      good="1.15.6+, 1.14.1+"
      vulnerable="1.9.5-1.15.5">
</item>

<item name="Memory disclosure in the ngx_http_mp4_module"
      severity="medium"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2018/000221.html"
      cve="2018-16845"
      good="1.15.6+, 1.14.1+"
      vulnerable="1.1.3-1.15.5, 1.0.7-1.0.15">
<patch name="patch.2018.mp4.txt" />
</item>

<item name="Integer overflow in the range filter"
      severity="medium"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html"
      cve="2017-7529"
      good="1.13.3+, 1.12.1+"
      vulnerable="0.5.6-1.13.2">
<patch name="patch.2017.ranges.txt" />
</item>

<item name="NULL pointer dereference while writing client request body"
      severity="medium"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2016/000179.html"
      cve="2016-4450"
      good="1.11.1+, 1.10.1+"
      vulnerable="1.3.9-1.11.0">
<patch name="patch.2016.write.txt" versions="1.9.13-1.11.0" />
<patch name="patch.2016.write2.txt" versions="1.3.9-1.9.12" />
</item>

<item name="Invalid pointer dereference in resolver"
      severity="medium"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2016/000169.html"
      cve="2016-0742"
      good="1.9.10+, 1.8.1+"
      vulnerable="0.6.18-1.9.9" />

<item name="Use-after-free during CNAME response processing in resolver"
      severity="medium"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2016/000169.html"
      cve="2016-0746"
      good="1.9.10+, 1.8.1+"
      vulnerable="0.6.18-1.9.9" />

<item name="Insufficient limits of CNAME resolution in resolver"
      severity="medium"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2016/000169.html"
      cve="2016-0747"
      good="1.9.10+, 1.8.1+"
      vulnerable="0.6.18-1.9.9" />

<item name="SSL session reuse vulnerability"
      severity="medium"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html"
      cve="2014-3616"
      good="1.7.5+, 1.6.2+"
      vulnerable="0.5.6-1.7.4">
</item>

<item name="STARTTLS command injection"
      severity="medium"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2014/000144.html"
      cve="2014-3556"
      good="1.7.4+, 1.6.1+"
      vulnerable="1.5.6-1.7.3">
<patch name="patch.2014.starttls.txt" />
</item>

<item name="SPDY heap buffer overflow"
      severity="major"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html"
      cve="2014-0133"
      good="1.5.12+, 1.4.7+"
      vulnerable="1.3.15-1.5.11">
<patch name="patch.2014.spdy2.txt" />
</item>

<item name="SPDY memory corruption"
      severity="major"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2014/000132.html"
      cve="2014-0088"
      good="1.5.11+"
      vulnerable="1.5.10">
<patch name="patch.2014.spdy.txt" />
</item>

<item name="Request line parsing vulnerability"
      severity="medium"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2013/000125.html"
      cve="2013-4547"
      good="1.5.7+, 1.4.4+"
      vulnerable="0.8.41-1.5.6">
<patch name="patch.2013.space.txt" />
</item>

<item name="Memory disclosure with specially crafted HTTP backend responses"
      severity="medium"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2013/000114.html"
      cve="2013-2070"
      good="1.5.0+, 1.4.1+, 1.2.9+"
      vulnerable="1.1.4-1.2.8, 1.3.9-1.4.0">
<patch name="patch.2013.chunked.txt" versions="1.3.9-1.4.0" />
<patch name="patch.2013.proxy.txt" versions="1.1.4-1.2.8" />
</item>

<item name="Stack-based buffer overflow with specially crafted request"
      severity="major"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2013/000112.html"
      cve="2013-2028"
      good="1.5.0+, 1.4.1+"
      vulnerable="1.3.9-1.4.0">
<patch name="patch.2013.chunked.txt" />
</item>

<item name="Vulnerabilities with Windows directory aliases"
      severity="medium"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2012/000086.html"
      cve="2011-4963"
      good="1.3.1+, 1.2.1+"
      vulnerable="nginx/Windows 0.7.52-1.3.0" />

<item name="Buffer overflow in the ngx_http_mp4_module"
      severity="major"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2012/000080.html"
      cve="2012-2089"
      good="1.1.19+, 1.0.15+"
      vulnerable="1.1.3-1.1.18, 1.0.7-1.0.14">
<patch name="patch.2012.mp4.txt" />
</item>

<item name="Memory disclosure with specially crafted backend responses"
      severity="major"
      advisory="https://mailman.nginx.org/pipermail/nginx-announce/2012/000076.html"
      cve="2012-1180"
      good="1.1.17+, 1.0.14+"
      vulnerable="0.1.0-1.1.16">
<patch name="patch.2012.memory.txt" />
</item>

<item name="Buffer overflow in resolver"
      severity="medium"
      cve="2011-4315"
      good="1.1.8+, 1.0.10+"
      vulnerable="0.6.18-1.1.7" />

<item name="Vulnerabilities with invalid UTF-8 sequence on Windows"
      severity="major"
      cve="2010-2266"
      good="0.8.41+, 0.7.67+"
      vulnerable="nginx/Windows 0.7.52-0.8.40" />

<item name="Vulnerabilities with Windows file default stream"
      severity="major"
      cve="2010-2263"
      good="0.8.40+, 0.7.66+"
      vulnerable="nginx/Windows 0.7.52-0.8.39" />

<item name="Vulnerabilities with Windows 8.3 filename pseudonyms"
      severity="major"
      core="CORE-2010-0121"
      href="http://www.coresecurity.com/content/filename-pseudonyms-vulnerabilities"
      good="0.8.33+, 0.7.65+"
      vulnerable="nginx/Windows 0.7.52-0.8.32" />

<item name="An error log data are not sanitized"
      severity="none"
      cve="2009-4487"
      good="none"
      vulnerable="all" />

<item name="The renegotiation vulnerability in SSL protocol"
      severity="major"
      cert="120541"
      cve="2009-3555"
      good="0.8.23+, 0.7.64+"
      vulnerable="0.1.0-0.8.22">
<patch name="patch.cve-2009-3555.txt" />
</item>

<item name="Directory traversal vulnerability"
      severity="minor"
      cve="2009-3898"
      good="0.8.17+, 0.7.63+"
      vulnerable="0.1.0-0.8.16" />

<item name="Buffer underflow vulnerability"
      severity="major"
      cert="180065"
      cve="2009-2629"
      good="0.8.15+, 0.7.62+, 0.6.39+, 0.5.38+"
      vulnerable="0.1.0-0.8.14">
<patch name="patch.180065.txt" />
</item>

<item name="Null pointer dereference vulnerability"
      severity="major"
      cve="2009-3896"
      good="0.8.14+, 0.7.62+, 0.6.39+, 0.5.38+"
      vulnerable="0.1.0-0.8.13">
<patch name="patch.null.pointer.txt" />
</item>

</security>

</section>

</article>