Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-07-19 20:42 UTC
Importiert: 2026-07-24 12:59 UTC
CVSS: 9.2
Quelle-ID: thn_global
uid_hash: 8a2134bc6853ee0399d94f60e0555580f64eb435ee7f1b13bec2f6191576dff5

The Hacker News

Inhalt

F5 has shipped fixes for a critical nginx flaw that lets a remote, unauthenticated attacker trigger a heap buffer overflow in the worker process with crafted HTTP requests. CVE-2026-42533 was patched on July 15 in nginx 1.30.4 (stable) and 1.31.3 (mainline), and in NGINX Plus 37.0.3.1; anyone on an earlier build should upgrade.

Triggering it can crash or restart the worker, causing a denial of

Verknuepfte CVEs

CVE-ID	Severity (Quelle)	CVSS (Quelle)	Severity (CVE.org)	CVSS (CVE.org)	EPSS	EPSS-Pctl	Veroeffentlicht (CVE.org)
CVE-2026-42533	CRITICAL	9.2	CRITICAL	9.2			2026-07-15

Quellen-Details

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
The Hacker News	thn_global	security_news		-	de	https://feeds.feedburner.com/TheHackersNews

Zurueck zur Eintrags-Liste