Vulnerability · Published Mar 30, 2026 · Assigned by GitHub_M

CVE-2026-33029Nginx UI: DoS via Negative Integer Input in Logrotate Interval

Medium 6.5

In plain English

A medium-severity improper input validation in nginx-ui from 0xJacky. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)1.0%top 37.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, an input validation vulnerability in the logrotate configuration allows an authenticated user to cause a complete Denial of Service (DoS). By submitting a negative integer for the rotation interval, the backend enters an infinite loop or an invalid state, rendering the web interface unresponsive. This issue has been patched in version 2.3.4.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/0xJacky/Nginx-UI	no fix listed	GHSA-cp8r-8jvw-v3qg
Go	github.com/0xJacky/Nginx-UI	no fix listed	GO-2026-4902

Affected products (as reported)

Vendor	Product	Versions
0xJacky	nginx-ui	< 2.3.4

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-cp8r-8jvw-v3qg x_refsource_CONFIRM
https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4 x_refsource_MISC