{"kind": "product", "path": "vulns/ubuntu-25.10/nginx", "name": "nginx", "product": "nginx", "ecosystem": "Ubuntu:25.10", "items": [{"id": "CVE-2026-48142", "noindex": false, "published": "2026-06-17T14:04:32.856Z", "modified": "2026-06-17T15:42:56.704Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00684, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-48142", "title": "NGINX ngx_http_charset_module vulnerability", "description": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with both source_charset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "references": ["https://my.f5.com/manage/s/article/K000161585", "https://nvd.nist.gov/vuln/detail/CVE-2026-48142"], "fixes": ["1.28.0-6ubuntu1.8"], "products": [{"name": "nginx", "path": "vulns/ubuntu-25.10/nginx", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-42055", "noindex": false, "published": "2026-06-17T14:04:32.520Z", "modified": "2026-09-14T12:04:28.530Z", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.06537, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-42055", "title": "NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability", "description": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on sys", "references": ["https://my.f5.com/manage/s/article/K000161584", "https://access.redhat.com/security/cve/CVE-2026-42055", "https://bugzilla.redhat.com/show_bug.cgi?id=2489866"], "fixes": ["1.28.0-6ubuntu1.8"], "products": [{"name": "nginx", "path": "vulns/ubuntu-25.10/nginx", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-49975", "noindex": false, "published": "2026-06-08T15:26:04.674Z", "modified": "2026-08-19T12:05:08.039Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.3295, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-49975", "title": "Apache HTTP Server: mod_http2 denial of service", "description": "Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests.\n\nThis issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.", "references": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://www.openwall.com/lists/oss-security/2026/06/03/3", "https://lists.debian.org/debian-lts-announce/2026/06/msg00009.html"], "fixes": ["1.28.0-6ubuntu1.7"], "products": [{"name": "nginx", "path": "vulns/ubuntu-25.10/nginx", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-9256", "noindex": false, "published": "2026-05-22T14:11:41.877Z", "modified": "2026-08-25T12:05:55.163Z", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.10856, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-9256", "title": "NGINX ngx_http_rewrite_module vulnerability", "description": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute co", "references": ["https://my.f5.com/manage/s/article/K000161377", "http://www.openwall.com/lists/oss-security/2026/05/22/14", "https://lists.debian.org/debian-lts-announce/2026/06/msg00023.html"], "fixes": ["1.28.0-6ubuntu1.4"], "products": [{"name": "nginx", "path": "vulns/ubuntu-25.10/nginx", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-40460", "noindex": false, "published": "2026-05-13T14:12:45.291Z", "modified": "2026-05-13T16:06:43.631Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00373, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-40460", "title": "NGINX ngx_quic_module vulnerability", "description": "When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or bypass of rate limiting.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "references": ["https://my.f5.com/manage/s/article/K000161068", "https://nvd.nist.gov/vuln/detail/CVE-2026-40460"], "fixes": ["1.28.0-6ubuntu1.4"], "products": [{"name": "nginx", "path": "vulns/ubuntu-25.10/nginx", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-42946", "noindex": false, "published": "2026-05-13T14:12:44.697Z", "modified": "2026-05-13T16:06:56.898Z", "cvss": 8.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00932, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-42946", "title": "NGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerability", "description": "A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "references": ["https://my.f5.com/manage/s/article/K000161027", "https://nvd.nist.gov/vuln/detail/CVE-2026-42946"], "fixes": ["1.28.0-6ubuntu1.4"], "products": [{"name": "nginx", "path": "vulns/ubuntu-25.10/nginx", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-42934", "noindex": false, "published": "2026-05-13T14:12:44.331Z", "modified": "2026-06-08T20:34:05.147Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00731, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-42934", "title": "NGINX ngx_http_charset_module vulnerability", "description": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map and proxy_pass with disabled buffering (\"off\") directives are configured, unauthenticated attackers can send requests that with conditions beyond the attackers' control to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart.\n\n\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "references": ["https://my.f5.com/manage/s/article/K000161028", "https://nvd.nist.gov/vuln/detail/CVE-2026-42934"], "fixes": ["1.28.0-6ubuntu1.4"], "products": [{"name": "nginx", "path": "vulns/ubuntu-25.10/nginx", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-42945", "noindex": false, "published": "2026-05-13T14:12:43.971Z", "modified": "2026-09-10T12:04:53.533Z", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.68047, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-42945", "title": "NGINX ngx_http_rewrite_module vulnerability", "description": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomiza", "references": ["https://my.f5.com/manage/s/article/K000161019", "https://depthfirst.com/nginx-rift", "https://github.com/DepthFirstDisclosures/Nginx-Rift"], "fixes": ["1.28.0-6ubuntu1.3"], "products": [{"name": "nginx", "path": "vulns/ubuntu-25.10/nginx", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-40701", "noindex": false, "published": "2026-05-13T14:12:43.588Z", "modified": "2026-05-13T16:07:37.463Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.0069, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-40701", "title": "NGINX ngx_http_ssl_module vulnerability", "description": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to \"on\" or \"optional,\" and the ssl_ocsp directive is set to \"on\" or the leaf parameters are configured with a resolver. With this configuration, an unauthenticated attacker can send requests along with conditions beyond its control that may cause a heap-use-after-free error in the NGINX worker process. This vulnerability may result in limited modification of data or the NGINX worker process restarting.\n\n\n\n Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "references": ["https://my.f5.com/manage/s/article/K000161021", "https://nvd.nist.gov/vuln/detail/CVE-2026-40701"], "fixes": ["1.28.0-6ubuntu1.4"], "products": [{"name": "nginx", "path": "vulns/ubuntu-25.10/nginx", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-27651", "noindex": false, "published": "2026-03-24T14:13:27.295Z", "modified": "2026-07-15T01:13:39.490Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00955, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-27651", "title": "NGINX ngx_mail_auth_http_module vulnerability", "description": "When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server permits retry by returning the Auth-Wait response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "references": ["https://my.f5.com/manage/s/article/K000160383", "https://access.redhat.com/security/cve/CVE-2026-27651", "https://bugzilla.redhat.com/show_bug.cgi?id=2450791"], "fixes": ["1.28.0-6ubuntu1.2"], "products": [{"name": "nginx", "path": "vulns/ubuntu-25.10/nginx", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-27654", "noindex": false, "published": "2026-03-24T14:13:26.879Z", "modified": "2026-07-15T01:13:37.047Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.25942, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-27654", "title": "NGINX ngx_http_dav_module vulnerability", "description": "NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names outside the document root. This issue affects NGINX Open Source and NGINX Plus when the configuration file uses DAV module MOVE or COPY methods, prefix location (nonregular expression location configuration), and alias directives. The integrity impact is constrained because the NGINX worker process user has low privileges and does not have access t", "references": ["https://my.f5.com/manage/s/article/K000160382", "https://access.redhat.com/security/cve/CVE-2026-27654", "https://bugzilla.redhat.com/show_bug.cgi?id=2450776"], "fixes": ["1.28.0-6ubuntu1.2"], "products": [{"name": "nginx", "path": "vulns/ubuntu-25.10/nginx", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-28755", "noindex": false, "published": "2026-03-24T14:13:26.502Z", "modified": "2026-03-24T15:24:16.108Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00138, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-28755", "title": "NGINX ngx_stream_ssl_module vulnerability", "description": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the certificate as revoked.   \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "references": ["https://my.f5.com/manage/s/article/K000160368", "https://nvd.nist.gov/vuln/detail/CVE-2026-28755"], "fixes": ["1.28.0-6ubuntu1.2"], "products": [{"name": "nginx", "path": "vulns/ubuntu-25.10/nginx", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-28753", "noindex": false, "published": "2026-03-24T14:13:26.107Z", "modified": "2026-03-24T15:24:34.995Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00275, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-28753", "title": "NGINX ngx_mail_proxy_module vulnerability", "description": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "references": ["https://my.f5.com/manage/s/article/K000160367", "https://nvd.nist.gov/vuln/detail/CVE-2026-28753"], "fixes": ["1.28.0-6ubuntu1.2"], "products": [{"name": "nginx", "path": "vulns/ubuntu-25.10/nginx", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-32647", "noindex": false, "published": "2026-03-24T14:13:25.724Z", "modified": "2026-07-15T01:07:50.616Z", "cvss": 8.5, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00934, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-32647", "title": "NGINX ngx_http_mp4_module vulnerability", "description": "NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 file. This issue affects NGINX Open Source and NGINX Plus if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module. \n\n\nNote: Software versions which have reached End of T", "references": ["https://my.f5.com/manage/s/article/K000160366", "https://access.redhat.com/security/cve/CVE-2026-32647", "https://bugzilla.redhat.com/show_bug.cgi?id=2449598"], "fixes": ["1.28.0-6ubuntu1.2"], "products": [{"name": "nginx", "path": "vulns/ubuntu-25.10/nginx", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-27784", "noindex": false, "published": "2026-03-24T14:13:25.343Z", "modified": "2026-07-15T01:12:57.824Z", "cvss": 8.5, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.01071, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-27784", "title": "NGINX ngx_http_mp4_module vulnerability", "description": "The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NGINX worker memory resulting in its termination, using a specially crafted MP4 file. The issue only affects 32-bit NGINX Open Source if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module. \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "references": ["https://my.f5.com/manage/s/article/K000160364", "https://access.redhat.com/security/cve/CVE-2026-27784", "https://bugzilla.redhat.com/show_bug.cgi?id=2450785"], "fixes": ["1.28.0-6ubuntu1.2"], "products": [{"name": "nginx", "path": "vulns/ubuntu-25.10/nginx", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-1642", "noindex": false, "published": "2026-02-04T15:02:06.154Z", "modified": "2026-02-05T05:25:39.303Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00385, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2026-1642", "title": "NGINX vulnerability", "description": "A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "references": ["https://my.f5.com/manage/s/article/K000159824", "http://www.openwall.com/lists/oss-security/2026/02/05/1", "https://nvd.nist.gov/vuln/detail/CVE-2026-1642"], "fixes": ["1.28.0-6ubuntu1.1"], "products": [{"name": "nginx", "path": "vulns/ubuntu-25.10/nginx", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2025-53859", "noindex": false, "published": "2025-08-13T14:46:55.471Z", "modified": "2025-11-04T21:12:39.856Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00413, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}], "path": "vulns/cve-2025-53859", "title": "NGINX ngx_mail_smtp_module vulnerability", "description": "NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method \"none,\" and (3) the authentication server returns the \"Auth-Wait\" re", "references": ["https://my.f5.com/manage/s/article/K000152786", "http://www.openwall.com/lists/oss-security/2025/08/13/5", "https://nvd.nist.gov/vuln/detail/CVE-2025-53859"], "fixes": ["1.26.3-3ubuntu3"], "products": [{"name": "nginx", "path": "vulns/ubuntu-25.10/nginx", "ecosystem": "Ubuntu:25.10"}]}], "total": 17, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "nginx", "path": "vulns/ubuntu-25.10/nginx", "ecosystem": "Ubuntu:25.10"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-09-14T12:04:28.530Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}