NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability (CVE-2026-42055)
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
AI Analysis
Technical Summary
This Red Hat security advisory (RHSA-2026:27197) covers bug fixes and enhancements for Red Hat Hardened Images RPMs, including nginx version 1.30.3-2.hum1 and related modules. It addresses two CVEs: CVE-2026-42055 and CVE-2026-48142. CVE-2026-48142 is a vulnerability in the ngx_http_charset_module of nginx that can be triggered by remote unauthenticated attackers when specific charset directives are configured together (source_charset utf-8 and an additional charset directive in the same location block). This leads to a heap buffer over-read, which may cause limited disclosure of memory contents or a denial of service by crashing or restarting the nginx worker process. The advisory provides a mitigation by recommending removal or avoidance of these charset configurations and reloading nginx. The advisory does not explicitly confirm a released patch version beyond the updated RPMs listed. No known exploits in the wild have been reported. The CVSS v3.1 score assigned by Red Hat for CVE-2026-48142 is 4.8 (medium severity), but the overall advisory severity is marked as high.
Potential Impact
The vulnerability allows remote unauthenticated attackers to cause a heap buffer over-read in nginx's ngx_http_charset_module under certain charset configurations. This can lead to limited disclosure of memory contents, potentially exposing sensitive information such as cryptographic keys or memory addresses, which could aid further attacks. Additionally, it can cause a denial of service by crashing or restarting the nginx worker process, disrupting service availability. No active exploitation has been reported.
Mitigation Recommendations
Red Hat advises avoiding the use of both 'source_charset utf-8;' and an additional 'charset' directive within the same location block in nginx's ngx_http_charset_module configuration. If these directives are not essential, removing one or both will prevent exploitation. After modifying the configuration, reload the nginx service using 'systemctl reload nginx', which may temporarily interrupt active connections. The advisory lists updated RPMs for nginx version 1.30.3-2.hum1 and related modules; applying these updates is recommended. Patch status is not explicitly confirmed in the advisory; users should consult Red Hat's official errata and update channels for the latest remediation guidance.
NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability (CVE-2026-42055)
Description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 or grpc_pass directives are used to proxy HTTP/2 traffic, the ignore_invalid_headers directive is set to off, and the large_client_header_buffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This Red Hat security advisory (RHSA-2026:27197) covers bug fixes and enhancements for Red Hat Hardened Images RPMs, including nginx version 1.30.3-2.hum1 and related modules. It addresses two CVEs: CVE-2026-42055 and CVE-2026-48142. CVE-2026-48142 is a vulnerability in the ngx_http_charset_module of nginx that can be triggered by remote unauthenticated attackers when specific charset directives are configured together (source_charset utf-8 and an additional charset directive in the same location block). This leads to a heap buffer over-read, which may cause limited disclosure of memory contents or a denial of service by crashing or restarting the nginx worker process. The advisory provides a mitigation by recommending removal or avoidance of these charset configurations and reloading nginx. The advisory does not explicitly confirm a released patch version beyond the updated RPMs listed. No known exploits in the wild have been reported. The CVSS v3.1 score assigned by Red Hat for CVE-2026-48142 is 4.8 (medium severity), but the overall advisory severity is marked as high.
Potential Impact
The vulnerability allows remote unauthenticated attackers to cause a heap buffer over-read in nginx's ngx_http_charset_module under certain charset configurations. This can lead to limited disclosure of memory contents, potentially exposing sensitive information such as cryptographic keys or memory addresses, which could aid further attacks. Additionally, it can cause a denial of service by crashing or restarting the nginx worker process, disrupting service availability. No active exploitation has been reported.
Mitigation Recommendations
Red Hat advises avoiding the use of both 'source_charset utf-8;' and an additional 'charset' directive within the same location block in nginx's ngx_http_charset_module configuration. If these directives are not essential, removing one or both will prevent exploitation. After modifying the configuration, reload the nginx service using 'systemctl reload nginx', which may temporarily interrupt active connections. The advisory lists updated RPMs for nginx version 1.30.3-2.hum1 and related modules; applying these updates is recommended. Patch status is not explicitly confirmed in the advisory; users should consult Red Hat's official errata and update channels for the latest remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:27197
- Cve Count
- 2
- Additional Cves
- ["CVE-2026-48142"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a3e9ebf6e08203f7db1dee3
Added to database: 06/26/2026, 15:46:07 UTC
Last enriched: 08/16/2026, 17:50:16 UTC
Last updated: 09/12/2026, 03:57:59 UTC
Views: 154
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.