CVE-2026-42055 is a heap-based buffer overflow vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module of F5 NGINX Open Source and NGINX Plus. It arises under conditions where HTTP/2 proxying is configured with proxy_http_version set to 2 or grpc_pass directives, ignore_invalid_headers is off, and large_client_header_buffers is configured with a size exceeding 2 megabytes. An unauthenticated remote attacker can exploit this by sending large crafted headers, causing a heap overflow in the NGINX worker process. This leads to a denial of service via process restart and may allow arbitrary code execution on systems with ASLR disabled or bypassed. Red Hat has released security updates addressing this issue in their NGINX packages for Red Hat Enterprise Linux 10.

Successful exploitation can cause the NGINX worker process to crash and restart, resulting in denial of service. On systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed, attackers may achieve arbitrary code execution, leading to full compromise of the affected system. The vulnerability affects confidentiality, integrity, and availability of the service.

Red Hat has released security updates for NGINX packages in Red Hat Enterprise Linux 10 that fix this vulnerability. Users should apply these official patches promptly. There is no indication that the vulnerability is mitigated by default or that no action is required. Patch status is confirmed by Red Hat advisories. No other specific mitigations are documented.