CVE-2026-95101mediumCWE-172

CVE-2026-95101: falha de média gravidade em F5 NGINX Plus

NGINX ngx_http_v3_module vulnerability

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar NGINX Plus+ Monitorar NGINX Open Source

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.3%
Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject data in the proxied request.  There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
F5 · NGINX Open SourceF5 · NGINX Plus
CVEs relacionadas — F5 NGINX Plus

No mesmo produto, das mais perigosas para as menos.

CVE-2026-42945CRITICALNGINX ngx_http_rewrite_module vulnerabilityEPSS 68.0%CVE-2026-27654HIGHNGINX ngx_http_dav_module vulnerabilityEPSS 25.9%CVE-2026-9256CRITICALNGINX ngx_http_rewrite_module vulnerabilityEPSS 10.9%CVE-2026-42055CRITICALNGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerabilityEPSS 6.5%CVE-2026-42533CRITICALNGINX Map directive and Regex matching vulnerabilityEPSS 6.3%CVE-2026-42530CRITICALNGINX Open-Source ngx_http_v3_module vulnerabilityEPSS 6.2%