PT-2026-40682 · F5+4 · Nginx+3

Published 2026-05-13 · Updated 2026-06-18 · CVE-2026-42946

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions NGINX (affected versions not specified)

Description An issue in the ngx http scgi module and ngx http uwsgi module modules can lead to excessive memory allocation or an over-read of data. When scgi pass or uwsgi pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) capabilities—the ability to intercept and alter communications between two parties—who controls responses from an upstream server may read the memory of the NGINX worker process or cause it to restart.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-789

CWE-823

Related Identifiers

BDU:2026-06963

BIT-NGINX-2026-42946

BIT-NGINX-GATEWAY-2026-42946

CVE-2026-42946

ECHO-ED65-1C33-BEA3

OPENSUSE-SU-2026:10796-1

SUSE-SU-2026:2370-1

USN-8354-1

USN-8375-1

Affected Products

Linuxmint

Nginx

Red Os

Ubuntu

References · 66

• https://osv.dev/vulnerability/openSUSE-SU-2026:10796-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42945 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-nginx-2026-42946 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-42946 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42946 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27654 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42946 · Security Note
• https://osv.dev/vulnerability/USN-8375-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8354-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-42946 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27651 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-28753 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-42934 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-40460 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-40701 · Vendor Advisory