CVE-2026-42946: f5 dos
Vulnerability summary
CVE-2026-42946 is a high (CVSS 8.3) vulnerability in f5 dos. EPSS estimates a 0.93% chance of exploitation in the next 30 days, higher than 60% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 5Timeline
- 13-05-2026PublishedVulnerability first disclosed.
- 13-05-2026Last modifiedVulnerability information updated.
Description
A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS metrics
10 scores · 7 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.3HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
- NVDNIST8.3HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · AlpineEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:HDiffers
- OSV · DebianEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:HDiffers
- OSV · WolfiEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:HDiffers
- OSV · ChainguardEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:HDiffers
- NVDNIST7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:HDiffers
EPSS trend
Probability
0.93%
Chance of exploitation in the next 30 days
Percentile
60%
Versus all other CVEs
30-day change
0.00 pp
From 0.93% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-789Memory Allocation with Excessive Size ValueThe product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
- CWE-823Use of Out-of-range Pointer OffsetThe product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.
Affected systems
F57 products
- dos≥ 4.3.0, ≤ 4.7.0 | 4.8.0
- nginx gateway fabric≥ 1.3.0, ≤ 1.6.2 | ≥ 2.0.0, ≤ 2.6.0
- nginx ingress controller≥ 3.5.0, ≤ 3.7.2 | ≥ 4.0.0, ≤ 4.0.1 | ≥ 5.0.0, ≤ 5.4.2
- nginx_instance_manager≥ 2.16.0, ≤ 2.22.0
- nginx open source≥ 0.8.42, < 1.30.1 | ≥ 0.8.42, ≤ 0.9.7 | ≥ 1.0.0, ≤ 1.30.0
Chainguard2 products
- nginx-mainline< 1.31.0-r0
- nginx-stable< 1.30.1-r0
Wolfi2 products
- nginx-mainline< 1.31.0-r0
- nginx-stable< 1.30.1-r0
Alpine1 product
- nginx< 1.26.3-r1 | < 1.28.3-r1 | < 1.30.1-r0
Debian1 product
- nginx< 1.22.1-9+deb12u8 | < 1.26.3-3+deb13u6 | < 1.30.0-4
Ubuntu1 product
- nginx< 1.4.6-1ubuntu3.9+esm6 | < 1.10.3-0ubuntu0.16.04.5+esm7 | < 1.14.0-0ubuntu1.11+esm2 | < 1.18.0-0ubuntu1.7+esm1 | < 1.18.0-6ubuntu14.12 | < 1.24.0-2ubuntu7.9 | < 1.28.0-6ubuntu1.4 | < 1.28.3-2ubuntu1.2
6 vendors · 14 products
