CVE-2026-42395

MediumCVSS 4.3/10Last modified Sep 3, 2026

Description

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Aug 28, 2026
Last modified: Sep 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-423966.5Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail CVE-2026-423976.5Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130 CVE-2026-423987.7Server-Side Request Forgery (CWE-918) in Kibana allows authenticated users with connector management privileges to bypass the operator-confi CVE-2026-423996.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated l CVE-2026-42407.5A vulnerability was determined in Open5GS up to 2.7.6. The affected element is the function smf_gx_cca_cb/smf_gy_cca_cb/smf_s6b_aaa_cb/smf_s CVE-2026-424006.5Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated u CVE-2026-424015.4Improper Neutralization of Input During Web Page Generation (CWE-79) in Kibana can lead to stored HTML injection. A user with write access t CVE-2026-424027.5Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specially crafted WS-Polic CVE-2026-424037.5Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy document contains circular policy referen CVE-2026-424047.2Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When CVE-2026-424068.7A vulnerability exists in BIG-IP and BIG-IQ systems where a highly privileged, authenticated attacker with at least the Certificate Manager CVE-2026-424084.4When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) command that may allow a highly privileged authen