---
cve: "CVE-2026-42055"
severity: "CRITICAL"
cvss: 9.2
epss: "2.4%"
vendor: "F5"
kev: false
exploited: false
published: "2026-06-17 15:16:50"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-10-23T23:24:41+02:00"
---

# CVE-2026-42055

> 9.2 CRITICAL

## Beschreibung

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

## CNA-Record (Kanon, cvelistV5)

- CNA: **f5**
- State: PUBLISHED
- Stand: 2026-09-14 12:04:28
- CNA-CVSS: **8.1** (`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Hoch | good |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-131** — Incorrect Calculation of Buffer Size
  The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

## Angriffsmuster (CAPEC)

- [CAPEC-47 — Buffer Overflow via Parameter Expansion](https://capec.mitre.org/data/definitions/47.html) _(Severity: High)_
- [CAPEC-100 — Overflow Buffers](https://capec.mitre.org/data/definitions/100.html) _(Severity: Very High)_

## BSI-Hinweise (deutsch)

- [NGINX und NGINX Plus: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-1995) — _BSI-Einstufung: hoch_
  Ein Angreifer kann mehrere Schwachstellen in NGINX und NGINX NGINX Plus ausnutzen, um Daten zu manipulieren, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.

## Referenzen

- <https://my.f5.com/manage/s/article/K000161584>
- <https://access.redhat.com/errata/RHSA-2026:27197>
- <https://access.redhat.com/errata/RHSA-2026:36331>
- <https://access.redhat.com/errata/RHSA-2026:36364>
- <https://access.redhat.com/errata/RHSA-2026:36618>
- <https://access.redhat.com/errata/RHSA-2026:36639>
- <https://access.redhat.com/errata/RHSA-2026:38847>
- <https://access.redhat.com/errata/RHSA-2026:44481>
- <https://access.redhat.com/errata/RHSA-2026:46836>
- <https://access.redhat.com/errata/RHSA-2026:58981>
- <https://access.redhat.com/security/cve/CVE-2026-42055>
- <https://bugzilla.redhat.com/show_bug.cgi?id=2489866>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-42055/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_