CVE-2026-42055Patch(f5 / discovery)

CRITICALCVSS 9.2 · CRITICAL

Exploitation observed; activity peaked at 14 mentions and remains active

Immediate actions

Patch f5 discovery systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

f5 CVEs Back to dashboard

9.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Other references

https://access.redhat.com/errata/RHSA-2026:58981

Weakness type (CWE)

CWE-122CWE-787CWE-131

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

discovery
dos
enterprise_linux
hardened_images

Threat summary

Active exploitation appears in 2 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
45 mentions across 15 observed days

What's happening

Active exploitation reported across 2 signals
Exploit tool or code specified in 2 signals
PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 31 signals
Technical details provided in 32 signals
Disclosure: 10 classified signals
General: 3 classified signals
Peaked 13d ago at 14 mentions (2026-06-18); latest day: 1
45 total mentions across 15 days

Affected systems

Vendors

f5 redhat

Products

discoverydosenterprise_linuxhardened_imagesnginx_gateway_fabricnginx_ingress_controllernginx_instance_managernginx_open_sourcenginx_plusupdate_infrastructure

6 versions affected across 11 products

Deep dive

Activity timeline45 mentions / 15d

Signal classification5 categories

Patch

2862.2%

Disclosure

1022.2%

General

36.7%

Active Exploitation

24.4%

PoC

24.4%

Referenced assets24 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-17	2	General1Patch1
2026-06-18	14	Active Exploitation1Disclosure2Patch11
2026-06-19	13	Active Exploitation1Disclosure2Patch8PoC2
2026-06-21	1	Disclosure1
2026-06-22	1	Patch1
2026-06-25	1	Patch1
2026-06-26	1	Disclosure1
2026-06-29	1	Patch1
2026-07-02	2	General1Patch1
2026-07-06	1	Patch1
2026-07-12	3	Patch3
2026-07-13	1	General1
2026-07-14	2	Disclosure2
2026-07-27	1	Disclosure1
2026-10-15	1	Disclosure1

Full discourse20 posts

The Hacker News@TheHackersNews137d
Patch
🚨 Two critical NGINX flaws can lead to remote code execution. F5 has patched: • CVE-2026-42530 (HTTP/3 use-after-free) • CVE-2026-42055 (HTTP/2 heap buffer overflow) Both require specific configurations and ASLR bypass conditions. Details here → https://thehackernews.com/2026/06/f5-patches-two-critical-nginx-open.html
Post summary
F5 has released patches for two NGINX CVEs that could cause remote code execution, detailing the vulnerability types and required conditions, with no evidence of in‑the‑wild exploitation or PoC.
45961776254.4K
2.2M followersView on X
mufeed vh@mufeedvh98d
Disclosure
Introducing ENDGINX - 5 CVEs in NGINX with open models. We let loose GLM 5.1 and 5.2 by @Zai_org on the NGINX codebase. The work resulted in six fixed vulnerabilities across five CVEs: CVE-2026-28755, CVE-2026-42926, CVE-2026-9256, CVE-2026-42055, and CVE-2026-42533. First of our open-model vulnerability research series. https://winfunc.com/research/endginx
Post summary
The tweet announces the discovery of five CVEs in NGINX, noting that six fixes have been applied, but it does not provide any PoC, exploit, patch details, or technical attributes.
130192549.2K
4.8K followersView on X
The Hacker News@TheHackersNews134d
Patch
Update: the critical NGINX flaws now have a clearer technical path. CVE-2026-42530 comes down to an HTTP/3 lifetime mismatch that can leave a freed stream pointer treated as valid. CVE-2026-42055 lets oversized HPACK data write past its buffer, causing unauthenticated worker crashes. Patch or apply mitigations. Read: https://thehackernews.com/2026/06/f5-patches-two-critical-nginx-open.html
Post summary
The update describes two critical NGINX CVEs, provides technical details, and urges patching or mitigation.
13311122530.4K
2.2M followersView on X
The Hacker News@TheHackersNews134d
Disclosure
Attackers don’t need every NGINX box. They need the right config. CVE-2026-42055 depends on a narrow but real mix: HTTP/2 proxying or gRPC, ignore_invalid_headers off, and header buffers set above 2 MB. That’s the audit path defenders should not skip.
Post summary
The post discloses CVE-2026-42055 and details the specific NGINX configuration conditions that enable exploitation, urging defenders to audit these settings.
1241912528.7K
2.2M followersView on X
SOCRadar®@socradar136d
Patch
NGINX admins, your weekend might be starting early (and not in a good way). 🚨 F5 just dropped out-of-band fixes for two nasty NGINX flaws that can trigger remote DoS and potentially lead to RCE. 🔹 CVE-2026-42530 (HTTP/3 QUIC) 🔹 CVE-2026-42055 (HTTP/2 & gRPC proxying) Both can force worker restarts on exposed systems. Patch now to mitigate the risk and keep your servers humming. 🛠️ https://hubs.la/Q04l_j-00 #F5 #NGINX #CyberSecurity #VulnerabilityManagement #InfoSec
Post summary
F5 released out‑of‑band fixes for two NGINX CVEs that pose DoS and potential RCE risks; the post urges administrators to apply the patch immediately.
36023133.2K
6.6K followersView on X
Frank@jedisct1138d
Patch
nginx 1.30.3 and 1.31.2 released to fix CVE-2026-42055, CVE-2026-48142 and CVE-2026-42530 https://nginx.org
Post summary
Nginx has issued new releases (1.30.3 and 1.31.2) that patch three CVEs (CVE‑2026‑42055, CVE‑2026‑48142, CVE‑2026‑42530). The post serves as a patch announcement without additional exploit or vulnerability details.
011101839
17.5K followersView on X
The CyberSec Guru@thecybersecguru137d
PoC
@akaclandestine Technical details behing Nginx;s CVE-2026-42530 & CVE-2026-42055..with PoCs and more https://thecybersecguru.com/news/nginx-cve-2026-42530-cve-2026-42055-rce/
Post summary
The post announces that technical details and PoCs for Nginx CVE‑2026‑42530 and CVE‑2026‑42055 are available, providing a link to a site with further information.
010461.1K
1.2K followersView on X
GovCERT.CZ@GOVCERT_CZ136d
Disclosure
🚨 Upozorňujeme na závažné zranitelnosti v NGINX, CVE-2026-42530 a CVE-2026-42055. CVE-2026-42530: jedná se o chybu typu use-after-free v modulu ngx_http_v3_module, která může být zneužita vzdáleným neautentizovaným útočníkem při použití HTTP/3 QUIC a speciálně vytvořené HTTP/3 relace k opětovnému otevření QPACK encoder streamu, což umožňuje spuštění libovolného kódu na systémech s deaktivovaným ASLR nebo při jeho obejití. CVE-2026-42055: jedná se o chybu typu heap-based buffer overflow v modulech ngx_http_proxy_v2_module a ngx_http_grpc_module, kterou lze zneužít při proxy provozu HTTP/2 za specifických konfiguračních podmínek (proxy_http_version nastaveno na 2 nebo grpc_pass, ignore_invalid_headers vypnuto a large_client_header_buffers větší než 2 MB), což rovněž umožňuje vzdálené spuštění kódu bez autentizace při neaktivním nebo obejitelném ASLR. Zranitelnosti ovlivňují více verzí NGINX Open Source, NGINX Plus, NGINX Ingress Controller, Gateway Fabric a dalších komponent, přičemž opravy jsou dostupné například ve verzích NGINX Open Source 1.31.2 a 1.30.3, NGINX Plus 37.0.2.1 nebo Gateway Fabric 2.6.4. 📌Doporučujeme aktualizovat na uvedené opravené verze a současně aplikovat mitigace: deaktivovat HTTP/3 pro CVE-2026-42530 a upravit konfiguraci (odstranit ignore_invalid_headers off nebo snížit large_client_header_buffers pod 2 MB) pro CVE-2026-42055.
Post summary
The post discloses two critical NGINX CVEs, providing detailed technical characteristics and recommending specific patch versions and mitigations.
03042598
4.3K followersView on X
cPanel@cPanel130d
Patch
EasyApache 4 v25.67 is now available: • ea-nginx→ 1.31.2 (CVE-2026-42055, CVE-2026-48142) • ea-nodejs22→ 22.23.0 • ea-modsec30-connector-nginx, ea-nginx-echo, ea-nginx-headers-more, ea-nginx-njs, and ea-nginx-passenger rebuilt against ea-nginx v1.31.2 https://docs.cpanel.net/changelogs/easyapache-4-change-log-25/ https://t.co/13PeDu3Dvf
Post summary
This post announces an EasyApache 4 update (v25.67) that includes new package versions specifically intended to patch CVE‑2026‑42055 and CVE‑2026‑48142.
01070611
28.9K followersView on X
ProjetoLabo@ProjetoLabo137d
Active Exploitation
Mais uma do NGIX, fica ligado desenvolvedor de SAAS em VPS. Duas brechas graves no NGINX, ambas nota 9.2, e a F5 lançou correção de emergência. O Nginx Rift já está sendo explorado desde maio. A CVE-2026-42530 é um erro de gerenciamento de memória no HTTP/3 que atinge as versões 1.31.0 e 1.31.1. A CVE-2026-42055 também corrompe a memória pelos módulos proxy. Nenhuma das duas exige autenticação e, sem a proteção de segurança do sistema (ASLR), viram execução remota de código. Mais duas falhas altas no Gateway Fabric, que expõem dados internos e deixam alterar configurações do servidor, além de duas médias. A F5 não esperou o ciclo normal de correção, a atualização saiu antes do previsto. NGINX roda em quase um terço dos servidores web do mundo. Seu servidor já está na 1.31.2 ou 1.30.3?
Post summary
The tweet reports two 9.2‑rated NGINX CVEs (CVE‑2026‑42530 and CVE‑2026‑42055) causing unprivileged memory corruption and remote code execution, notes that they are already being exploited since May, and cites an emergency patch released by F5.
0102198
190 followersView on X
The CyberSec Guru@thecybersecguru137d
Patch
Breaking: Two critical NGINX bugs just dropped. CVE-2026-42530: HTTP/3 QPACK UAF CVE-2026-42055: HTTP/2/gRPC heap overflow Remote. Unauthenticated. CVSS 9.2. Patches are live. Patch em before the exploit race starts: https://thecybersecguru.com/news/nginx-cve-2026-42530-cve-2026-42055-rce/
Post summary
The post announces two new critical NGINX vulnerabilities, provides technical details and CVSS scores, and confirms patches are available.
01011110
970 followersView on X
iototsecnews@iototsecnews130d
Disclosure
NGINX の脆弱性 CVE-2026-42530／42055 が FIX：DoS と RCE の可能性 https://iototsecnews.jp/2026/06/18/f5-patches-nginx-vulnerability-enabling-code-execution-and-dos-attacks/ 人気の Web サーバ NGINX に、深刻な脆弱性 CVE-2026-42530／CVE-2026-42055 が発生しました。これらの問題の原因は、HTTP/2 や HTTP/3 を処理する内部プログラムにおいて、データの通り道を再度開いてしまう不整合や、特殊な接続要求を受け取った際のメモリ管理の不備にあります。これらの脆弱性が悪用されると、細工されたデータの送信によるサービス停止や、不正な命令の実行に至る危険性があります。ご利用のチームは、ご注意ください。 #CVE202611311 #CVE202642055 #CVE202642530 #CVE202650107 #nginx #Vulnerability
Post summary
The post announces the discovery of NGINX CVE-2026-42530 and CVE-2026-42055, briefly describes their technical nature (HTTP/2/3 memory issues causing DoS and RCE), and notes that a fix is available.
01001129
500 followersView on X
CyStack@CyStackSecurity136d
Disclosure
Nginx runs about 1 in 3 web servers. CyStack researcher Trung Nguyen found two vulnerabilities in it. Full analysis: https://cystack.net/research/cve-2026-42530-nginx-en https://cystack.net/research/cve-2026-42055-nginx-en This includes: CVE-2026-42530: use-after-free in the HTTP/3 QPACK encoder. ~40 bytes of QUIC traffic, no auth required. Write arbitrary data to server memory before logic runs. CVE-2026-42055: buffer overflow in the HTTP/2 and gRPC proxy modules. A one-byte miscalculation in header encoding. #CyStack #CyberSec #CyberSecurity #CVE202642530 #CVE202642055 #nginx
Post summary
The post announces two CVE vulnerabilities in Nginx, offering technical details about the use‑after‑free and buffer overflow issues, but provides no evidence of active exploitation, PoC, or patches.
10010129
3.7K followersView on X
Clone Systems@CloneSystemsInc136d
Patch
CVE Alert: Critical NGINX Open Source Flaws F5 has released security updates for two critical NGINX Open Source vulnerabilities that could allow remote code execution on affected systems. • CVE-2026-42530 | CVSS 9.2 • CVE-2026-42055 | CVSS 9.2 The flaws impact certain NGINX configurations involving HTTP/3 QUIC, HTTP/2 proxying, and gRPC traffic. Affected organizations should update to the latest fixed versions immediately. F5 also recommends disabling HTTP/3 for CVE-2026-42530 and adjusting affected header configuration settings for CVE-2026-42055 where patching cannot be completed right away. Although active exploitation has not been reported, critical NGINX vulnerabilities can move quickly from disclosure to attack activity. Patch now. Validate configurations. Monitor exposed systems. #Cybersecurity #CVEAlert #NGINX #F5 #RemoteCodeExecution #VulnerabilityManagement #PatchManagement #CloudSecurity #WebSecurity #CloneSystems
Post summary
The post announces F5’s security updates for two critical NGINX CVEs, advises immediate patching and configuration changes, and notes no current active exploitation.
0002062
257 followersView on X
Daily CyberSecurity@the_yellow_fall137d
Patch
Two critical NGINX vulnerabilities, CVE-2026-42530 and CVE-2026-42055, let remote attackers crash workers and possibly run code. Patch NGINX now. #NGINX #F5 #HTTP3 #BufferOverflow #CVE #Vulnerability https://securityonline.info/nginx-vulnerabilities https://t.co/iqSsJs0E0b
Post summary
The post announces two critical NGINX CVEs that enable remote crashes and possible code execution, urging immediate patching, with no PoC or exploit details provided.
00020324
12.8K followersView on X
Divinmentis@Divinmentis137d
Patch
🚨 Edge patch watch: F5 released out-of-band updates for NGINX flaws including CVE-2026-42530 and CVE-2026-42055. SecurityWeek says unauthenticated remote attackers can trigger DoS, with code execution possible in some conditions. #NGINX #Cyber https://t.co/6blR5xlopn
Post summary
F5 has issued out‑of‑band updates for two NGINX CVEs, noting the flaws can cause DoS and potentially allow code execution, though no exploitation evidence or PoC is provided.
2000086
26 followersView on X
Autumn Good@autumn_good_35137d
Disclosure
NGINXなどF5製品群で複数の脆弱性。 High CVEsは以下4件 CVE-2026-42530 CVE-2026-42055 CVE-2026-11311 CVE-2026-50107 K000161614: Out-of-band Security Notification (June 17, 2026) https://my.f5.com/manage/s/article/K000161614
Post summary
The post lists four high‑severity CVEs for F5 products and points to an out‑of‑band security notification, but provides no proof‑of‑concept, exploit code, evidence of active attacks, or patch details.
01010506
6.9K followersView on X
ThreatBook@ThreatBookLabs137d
Patch
XGPT, ThreatBook's AI security research system, found an original heap buffer overflow vulnerability in NGINX, now CVE-2026-42055. Reported responsibly; the fix is out. Run NGINX? Update now. Official NGINX security advisory: https://na2.hubs.ly/H06bz6T0
Post summary
ThreatBook’s XGPT discovered a heap buffer overflow in NGINX (CVE-2026-42055); while no exploit details are shared, the vulnerability is patched and users are urged to apply the fix immediately.
01010517
4.6K followersView on X
Lyrie.ai@lyrie_ai112d
Disclosure
CVE-2026-42055 lets oversized HPACK data write past its buffer, causing unauthenticated worker Source: X search for CVE-2026 critical Posted: 2026-06-22T05:54:11.000Z Likes: 73
Post summary
The text announces the CVE and outlines its technical impact involving a buffer overflow triggered by oversized HPACK data, but does not provide a PoC, exploit, or patch.
1000029
318 followersView on X
Lyrie.ai@lyrie_ai112d
Disclosure
CVE-2026-42530: Update: the critical NGINX flaws now have a clearer technical path. CVE-2026-42530 comes down to an HTTP/3 lifetime mismatch that can leave a freed stream pointer treated as valid. CVE-2026-42055 lets oversized HPACK data write past its buffer, causing…
Post summary
The update explains the technical details of CVE-2026-42530 (HTTP/3 pointer misuse) and CVE-2026-42055 (HPACK overflow) but offers no PoC, exploit, patch, or evidence of active exploitation.
1000068
318 followersView on X

CPE platform detail21 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

21 of 21 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	f5	dos	-	nginx	-
App	f5	dos	4.9.0	nginx	-
App	f5	nginx_gateway_fabric	-	-	-
App	f5	nginx_ingress_controller	-	-	-
App	f5	nginx_instance_manager	-	-	-
App	f5	nginx_open_source	-	-	-
App	f5	nginx_plus	-	-	-
App	f5	nginx_plus	-	-	-
App	f5	nginx_plus	r36	-	-
App	f5	nginx_plus	r36	-	-
App	f5	nginx_plus	r36	-	-
App	f5	nginx_plus	r36	-	-
App	f5	nginx_plus	r36	-	-
App	f5	nginx_plus	r36	-	-
App	f5	waf	-	nginx	-
App	redhat	discovery	-	-	-
OS	redhat	enterprise_linux	10.0	-	-
OS	redhat	enterprise_linux	8.0	-	-
OS	redhat	enterprise_linux	9.0	-	-
App	redhat	hardened_images	-	-	-
App	redhat	update_infrastructure	-	-	-

Explore more

Back to dashboard f5 CVEs redhat CVEs discovery vulnerabilities

What researchers are saying

CVE-2026-42055

mufeed vh[verified]@mufeedvhDisclosure

The tweet announces the discovery of five CVEs in NGINX, noting that six fixes have been applied, but it does not provide any PoC, exploit, patch details, or technical attributes.

SOCRadar®[verified]@socradarPatch

F5 released out‑of‑band fixes for two NGINX CVEs that pose DoS and potential RCE risks; the post urges administrators to apply the patch immediately.

Frank[verified]@jedisct1Patch

Nginx has issued new releases (1.30.3 and 1.31.2) that patch three CVEs (CVE‑2026‑42055, CVE‑2026‑48142, CVE‑2026‑42530). The post serves as a patch announcement without additional exploit or vulnerability details.

The CyberSec Guru[verified]@thecybersecguruPoC

The post announces that technical details and PoCs for Nginx CVE‑2026‑42530 and CVE‑2026‑42055 are available, providing a link to a site with further information.

GovCERT.CZ[verified]@GOVCERT_CZDisclosure

The post discloses two critical NGINX CVEs, providing detailed technical characteristics and recommending specific patch versions and mitigations.

ProjetoLabo[verified]@ProjetoLaboActive Exploitation

The tweet reports two 9.2‑rated NGINX CVEs (CVE‑2026‑42530 and CVE‑2026‑42055) causing unprivileged memory corruption and remote code execution, notes that they are already being exploited since May, and cites an emergency patch released by F5.

The CyberSec Guru[verified]@thecybersecguruPatch

The post announces two new critical NGINX vulnerabilities, provides technical details and CVSS scores, and confirms patches are available.

Clone Systems[verified]@CloneSystemsIncPatch

The post announces F5’s security updates for two critical NGINX CVEs, advises immediate patching and configuration changes, and notes no current active exploitation.