Home

Description

A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

PUBLISHED Reserved 2026-04-30 | Published 2026-05-13 | Updated 2026-05-13 | Assigner f5




MEDIUM: 6.5CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L

HIGH: 8.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Problem types

CWE-789: Memory Allocation with Excessive Size Value

CWE-823: Use of Out-of-range Pointer Offset

Product status

Default status
unknown

R37 (custom) before *
unaffected

R36 (custom) before R36 P4
affected

R32 (custom) before R32 P6
affected

Default status
unaffected

1.31.0 (semver) before *
unaffected

0.8.42 (semver) before 1.30.1
affected

Credits

F5 acknowledges Zhenpeng (Leo) Lin of depthfirst for bringing this issue to our attention and following the highest standards of coordinated disclosure. finder

References

my.f5.com/manage/s/article/K000161027 vendor-advisory patch

cve.org (CVE-2026-42946)

nvd.nist.gov (CVE-2026-42946)

Download JSON