Vulnerability · Published Jun 17, 2026 · Assigned by f5
CVE-2026-42055NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability
High 8.1
In plain English
A high-severity heap buffer overflow in NGINX Open Source from F5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.5% (higher than 94% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)6.5%top 6.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | nginx | 2:1.26.3-6.el10_2.5 | ALSA-2026:36364 |
| AlmaLinux:8 | nginx | 1:1.24.0-3.module_el8.10.0+4215+c88f2fa5.3.alma.1 | ALSA-2026:38847 |
| AlmaLinux:9 | nginx | 1:1.24.0-7.module_el9.8.0+278+b57266e8.3.alma.1 | ALSA-2026:36618 |
| AlmaLinux:9 | nginx | 2:1.26.3-9.module_el9.8.0+281+75d5e6d4.2 | ALSA-2026:36639 |
| AlmaLinux:9 | nginx | 2:1.20.1-28.el9_8.4.alma.1 | ALSA-2026:36331 |
| AlmaLinux:10 | nginx-all-modules | 2:1.26.3-6.el10_2.5 | ALSA-2026:36364 |
| AlmaLinux:8 | nginx-all-modules | 1:1.24.0-3.module_el8.10.0+4215+c88f2fa5.3.alma.1 | ALSA-2026:38847 |
| AlmaLinux:9 | nginx-all-modules | 2:1.26.3-9.module_el9.8.0+281+75d5e6d4.2 | ALSA-2026:36639 |
| AlmaLinux:9 | nginx-all-modules | 2:1.20.1-28.el9_8.4.alma.1 | ALSA-2026:36331 |
| AlmaLinux:9 | nginx-all-modules | 1:1.24.0-7.module_el9.8.0+278+b57266e8.3.alma.1 | ALSA-2026:36618 |
| AlmaLinux:10 | nginx-core | 2:1.26.3-6.el10_2.5 | ALSA-2026:36364 |
| AlmaLinux:9 | nginx-core | 2:1.20.1-28.el9_8.4.alma.1 | ALSA-2026:36331 |
| AlmaLinux:9 | nginx-core | 2:1.26.3-9.module_el9.8.0+281+75d5e6d4.2 | ALSA-2026:36639 |
| AlmaLinux:9 | nginx-core | 1:1.24.0-7.module_el9.8.0+278+b57266e8.3.alma.1 | ALSA-2026:36618 |
| AlmaLinux:10 | nginx-filesystem | 2:1.26.3-6.el10_2.5 | ALSA-2026:36364 |
| AlmaLinux:8 | nginx-filesystem | 1:1.24.0-3.module_el8.10.0+4215+c88f2fa5.3.alma.1 | ALSA-2026:38847 |
| AlmaLinux:9 | nginx-filesystem | 2:1.20.1-28.el9_8.4.alma.1 | ALSA-2026:36331 |
| AlmaLinux:9 | nginx-filesystem | 2:1.26.3-9.module_el9.8.0+281+75d5e6d4.2 | ALSA-2026:36639 |
| AlmaLinux:9 | nginx-filesystem | 1:1.24.0-7.module_el9.8.0+278+b57266e8.3.alma.1 | ALSA-2026:36618 |
| AlmaLinux:10 | nginx-mod-devel | 2:1.26.3-6.el10_2.5 | ALSA-2026:36364 |
| AlmaLinux:8 | nginx-mod-devel | 1:1.24.0-3.module_el8.10.0+4215+c88f2fa5.3.alma.1 | ALSA-2026:38847 |
| AlmaLinux:9 | nginx-mod-devel | 2:1.26.3-9.module_el9.8.0+281+75d5e6d4.2 | ALSA-2026:36639 |
| AlmaLinux:9 | nginx-mod-devel | 2:1.20.1-28.el9_8.4.alma.1 | ALSA-2026:36331 |
| AlmaLinux:9 | nginx-mod-devel | 1:1.24.0-7.module_el9.8.0+278+b57266e8.3.alma.1 | ALSA-2026:36618 |
| AlmaLinux:10 | nginx-mod-http-image-filter | 2:1.26.3-6.el10_2.5 | ALSA-2026:36364 |
| AlmaLinux:8 | nginx-mod-http-image-filter | 1:1.24.0-3.module_el8.10.0+4215+c88f2fa5.3.alma.1 | ALSA-2026:38847 |
| AlmaLinux:9 | nginx-mod-http-image-filter | 2:1.20.1-28.el9_8.4.alma.1 | ALSA-2026:36331 |
| AlmaLinux:9 | nginx-mod-http-image-filter | 1:1.24.0-7.module_el9.8.0+278+b57266e8.3.alma.1 | ALSA-2026:36618 |
| AlmaLinux:9 | nginx-mod-http-image-filter | 2:1.26.3-9.module_el9.8.0+281+75d5e6d4.2 | ALSA-2026:36639 |
| AlmaLinux:10 | nginx-mod-http-perl | 2:1.26.3-6.el10_2.5 | ALSA-2026:36364 |
| AlmaLinux:8 | nginx-mod-http-perl | 1:1.24.0-3.module_el8.10.0+4215+c88f2fa5.3.alma.1 | ALSA-2026:38847 |
| AlmaLinux:9 | nginx-mod-http-perl | 2:1.26.3-9.module_el9.8.0+281+75d5e6d4.2 | ALSA-2026:36639 |
| AlmaLinux:9 | nginx-mod-http-perl | 2:1.20.1-28.el9_8.4.alma.1 | ALSA-2026:36331 |
| AlmaLinux:9 | nginx-mod-http-perl | 1:1.24.0-7.module_el9.8.0+278+b57266e8.3.alma.1 | ALSA-2026:36618 |
| AlmaLinux:10 | nginx-mod-http-xslt-filter | 2:1.26.3-6.el10_2.5 | ALSA-2026:36364 |
| AlmaLinux:8 | nginx-mod-http-xslt-filter | 1:1.24.0-3.module_el8.10.0+4215+c88f2fa5.3.alma.1 | ALSA-2026:38847 |
| AlmaLinux:9 | nginx-mod-http-xslt-filter | 1:1.24.0-7.module_el9.8.0+278+b57266e8.3.alma.1 | ALSA-2026:36618 |
| AlmaLinux:9 | nginx-mod-http-xslt-filter | 2:1.26.3-9.module_el9.8.0+281+75d5e6d4.2 | ALSA-2026:36639 |
| AlmaLinux:9 | nginx-mod-http-xslt-filter | 2:1.20.1-28.el9_8.4.alma.1 | ALSA-2026:36331 |
| AlmaLinux:10 | nginx-mod-mail | 2:1.26.3-6.el10_2.5 | ALSA-2026:36364 |
| AlmaLinux:8 | nginx-mod-mail | 1:1.24.0-3.module_el8.10.0+4215+c88f2fa5.3.alma.1 | ALSA-2026:38847 |
| AlmaLinux:9 | nginx-mod-mail | 1:1.24.0-7.module_el9.8.0+278+b57266e8.3.alma.1 | ALSA-2026:36618 |
| AlmaLinux:9 | nginx-mod-mail | 2:1.26.3-9.module_el9.8.0+281+75d5e6d4.2 | ALSA-2026:36639 |
| AlmaLinux:9 | nginx-mod-mail | 2:1.20.1-28.el9_8.4.alma.1 | ALSA-2026:36331 |
| AlmaLinux:10 | nginx-mod-stream | 2:1.26.3-6.el10_2.5 | ALSA-2026:36364 |
| AlmaLinux:8 | nginx-mod-stream | 1:1.24.0-3.module_el8.10.0+4215+c88f2fa5.3.alma.1 | ALSA-2026:38847 |
| AlmaLinux:9 | nginx-mod-stream | 2:1.20.1-28.el9_8.4.alma.1 | ALSA-2026:36331 |
| AlmaLinux:9 | nginx-mod-stream | 2:1.26.3-9.module_el9.8.0+281+75d5e6d4.2 | ALSA-2026:36639 |
| AlmaLinux:9 | nginx-mod-stream | 1:1.24.0-7.module_el9.8.0+278+b57266e8.3.alma.1 | ALSA-2026:36618 |
| Alpine:v3.21 | nginx | 1.26.3-r2 | ALPINE-CVE-2026-42055 |
| Alpine:v3.22 | nginx | 1.28.3-r4 | ALPINE-CVE-2026-42055 |
| Alpine:v3.23 | nginx | 1.28.3-r4 | ALPINE-CVE-2026-42055 |
| Alpine:v3.24 | nginx | 1.30.3-r0 | ALPINE-CVE-2026-42055 |
| Debian:12 | nginx | 1.22.1-9+deb12u9 | DEBIAN-CVE-2026-42055 |
| Debian:13 | nginx | 1.26.3-3+deb13u7 | DEBIAN-CVE-2026-42055 |
| Debian:14 | nginx | 1.30.1-5 | DEBIAN-CVE-2026-42055 |
| Rocky Linux:10 | nginx | 2:1.26.3-6.el10_2.5 | RLSA-2026:36364 |
| Rocky Linux:8 | nginx | 1:1.24.0-3.module+el8.10.0+40220+e6a4bcb0.2 | RLSA-2026:38847 |
| Rocky Linux:8 | nginx | 1:1.24.0-3.module+el8.10.0+40187+52bedf24.1 | RLSA-2026:38847 |
| Rocky Linux:8 | nginx | 1:1.24.0-3.module+el8.10.0+40144+38158758 | RLSA-2026:38847 |
| Rocky Linux:9 | nginx | 2:1.20.1-28.el9_8.4.rocky.0.1 | RLSA-2026:36331 |
| Rocky Linux:9 | nginx | 1:1.24.0-7.module+el9.8.0+40193+7b2d11e4.1.rocky.0.1 | RLSA-2026:36618 |
| Rocky Linux:9 | nginx | 1:1.24.0-7.module+el9.8.0+40218+76099d32.2.rocky.0.1 | RLSA-2026:36618 |
| Rocky Linux:9 | nginx | 2:1.26.3-9.module+el9.8.0+40222+e48d13b6.1 | RLSA-2026:36639 |
| Rocky Linux:9 | nginx | 2:1.26.3-9.module+el9.8.0+40194+40adfc1b | RLSA-2026:36639 |
| Ubuntu:22.04:LTS | nginx | 1.18.0-6ubuntu14.16 | UBUNTU-CVE-2026-42055 |
| Ubuntu:24.04:LTS | nginx | 1.24.0-2ubuntu7.13 | UBUNTU-CVE-2026-42055 |
| Ubuntu:25.10 | nginx | 1.28.0-6ubuntu1.8 | UBUNTU-CVE-2026-42055 |
| Ubuntu:26.04:LTS | nginx | 1.28.3-2ubuntu1.6 | UBUNTU-CVE-2026-42055 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| F5 | NGINX Open Source | 1.13.10 – before 1.31.21.30.2 – before 1.30.3 |
| F5 | NGINX Plus | 37.0 – before 37.0.2.1R36 – before R36 P6 |
Weakness: CWE-122, CWE-131 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://my.f5.com/manage/s/article/K000161584 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-42055 vdb-entry, x_refsource_REDHAT
- RHBZ#2489866 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42055.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:36364 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:38847 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36618 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36331 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36639 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:46836 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:27197 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:44481 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:58981 vendor-advisory, x_refsource_REDHAT