PT-2026-29090 · Nginx-Ui · Nginx-Ui

Dapickle · Published 2026-03-30 · Updated 2026-04-07 · CVE-2026-33029

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.3.4

Description An input validation issue in the logrotate configuration allows an authenticated user to cause a Denial of Service (DoS). Submitting a negative integer for the rotation interval causes the backend to enter an infinite loop or an invalid state, making the web interface unresponsive. The issue resides in the handler for the API Endpoint /api/settings, specifically within the logrotate.interval Vulnerable Parameter. When a negative value is processed, it triggers a non-terminating loop, consuming CPU resources and preventing the server from handling further requests.

Recommendations Versions prior to 2.3.4 should be updated to version 2.3.4 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2026-04701

CVE-2026-33029

GHSA-CP8R-8JVW-V3QG

GO-2026-4902

SUSE-SU-2026:1205-1

Affected Products

Nginx-Ui

References · 46

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33029.json · Exploit
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-cp8r-8jvw-v3qg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33029 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33029 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cp8r-8jvw-v3qg · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1205-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4902 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04701 · Security Note
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4 · Note
• https://github.com/0xJacky/nginx-ui · Note
• https://suse.com/security/cve/CVE-2026-33747 · Note
• https://suse.com/security/cve/CVE-2026-29180 · Note
• https://suse.com/security/cve/CVE-2026-26060 · Note
• https://suse.com/security/cve/CVE-2026-26233 · Note
• https://suse.com/security/cve/CVE-2026-32241 · Note