CVE-2026-90439

MediumCVSS 6.5/10Last modified Sep 18, 2026

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption.

Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-122

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 15, 2026
Last modified: Sep 18, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-90448.0An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authentic CVE-2026-904408.2Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in Apache Thrift D thrift.server.n CVE-2026-904418.1A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privil CVE-2026-904435.4A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does no CVE-2026-904448.8A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An CVE-2026-904456.5An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted CVE-2026-904464.3An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request CVE-2026-904476.5A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-suppli CVE-2026-904486.5A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restr CVE-2026-904496.5When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface CVE-2026-90457.8During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise fo CVE-2026-904504.3The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role re