CVE-2026-90439— NGINX ngx_http_v3_module vulnerability
Quick assessment
Affected
F5 NGINX Plus
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
以下是该漏洞描述信息的中文翻译： NGINX Plus 和 NGINX 开源版在 模块中存在一个漏洞。当在特定配置下使用 HTTP/3，且 OpenSSL 版本低于或等于 OpenSSL 3.5.0 时，在处理 TLS 握手过程中可能发生有限的堆缓冲区溢出。该溢出以非确定性方式发生，攻击者无法完全控制。这可能导致 NGINX 工作进程发生堆缓冲区溢出，进而导致进程重启和/或有限的数据损坏。 影响： 该漏洞可能允许远程攻击者导致 NGINX 系统发生服务中断（DoS）或有限的数据损坏。此问题仅涉及数据平面，不涉及控制
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1499 · Endpoint Denial of ServiceAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| F5 | NGINX Open Source | 1.29.2< 1.31.6 |
affected |
1.30.4< 1.30.5 |
affected | ||
| F5 | NGINX Plus | 37.1.0.1< 37.1.1.1 |
affected |
37.0.0.1< 37.0.6.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-90439
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NGINX ngx_http_v3_module vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption.
Impact:
This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| F5 | NGINX Plus | 37.1.0.1 ~ 37.1.1.1 | - |
|
| F5 | NGINX Open Source | 1.29.2 ~ 1.31.6 | - |
|
II. Public POCs for CVE-2026-90439
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-90439
请登录查看更多情报信息。
Other References for CVE-2026-90439 (1)
-
https://my.f5.com/manage/s/article/K000162604 vendor-advisory
IV. Related Vulnerabilities
Same product: NGINX Plus
-
CVE-2026-60005
NGINX ngx_http_slice_module vulnerability -
CVE-2026-42533
NGINX Map directive and Regex matching vulnerability -
CVE-2026-60065
NGINX Plus ngx_stream_mqtt_filter_module vulnerability -
CVE-2026-56434
NGINX ngx_http_ssi_module vulnerability -
CVE-2026-9256
NGINX ngx_http_rewrite_module vulnerability
Same weakness: CWE-122
-
CVE-2026-19781
Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overf -
CVE-2026-91964
FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via Routin -
CVE-2026-39919
Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Out -
CVE-2026-91088
GPAC URL url.c gf_url_concatenate_ex heap-based overflow -
CVE-2026-91086
GPAC MPEG Video Reframer reframe_mpgvid.c mpgviddmx_process
V. Comments for CVE-2026-90439
No comments yet