CVE catalog

CVE-2026-90439

Severity: Medium · CVSS 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published: Sep 15, 2026, 2:27:26 PM UTC
Updated: Sep 15, 2026, 3:17:27 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.26% · Oct 25, 2026

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	nginx	sid	`1.30.6-2`	fixed
Debian	nginx	forky	`1.30.6-2`	fixed
Debian	nginx	trixie	`1.26.3-3+deb13u7`	not affected
Debian	nginx	trixie-security	`1.26.3-3+deb13u10`	not affected
Debian	nginx	bookworm	`1.22.1-9+deb12u9`	not affected
Debian	nginx	bookworm-security	`1.22.1-9+deb12u10`	not affected
Opensuse	nginx	tumbleweed	`1.31.6-1.1`	fixed
Alpine	nginx	3.24	`1.30.6-r0`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	nginx	source	sid	`1.30.4-7`	not yet assigned	Not reported	Not reported
Debian	nginx	source	forky	`1.30.4-7`	not yet assigned	Not reported	Not reported
Debian	nginx	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	nginx	source	bookworm	`Not affected`	unimportant	Not reported	Not reported
Opensuse	nginx	rpm	tumbleweed	`1.31.6-1.1`	Not reported	OPENSUSE-SU-2026:11807-1	Not reported
Alpine	nginx	apk	3.24	`1.30.6-r0`	Not reported	ALPINE-CVE-2026-90439	Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

[nginx]Affected
Source package: [nginx]
Details (1)
- 1.31.4-1.1 · x86_64 · tumbleweed
  Affected · Fixed: 1.31.6-1.1
  nvd · nginx · opensuse · tumbleweed
[nginx-source]Unknown
Source package: [nginx]
Details (1)
- 1.31.4-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.31.6-1.1
  Version impact unknown
  nvd · nginx · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[libnginx-mod-http-geoip]Not affected
Source package: [nginx]
Details (4)
- 1.22.1-9+deb12u9 · amd64 · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · arm64 · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · amd64 · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · arm64 · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
[libnginx-mod-http-image-filter]Not affected
Source package: [nginx]
Details (4)
- 1.22.1-9+deb12u9 · amd64 · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · arm64 · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · amd64 · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · arm64 · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
[libnginx-mod-http-perl]Not affected
Source package: [nginx]
Details (4)
- 1.22.1-9+deb12u9 · amd64 · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · arm64 · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · amd64 · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · arm64 · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
[libnginx-mod-http-xslt-filter]Not affected
Source package: [nginx]
Details (4)
- 1.22.1-9+deb12u9 · amd64 · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · arm64 · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · amd64 · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · arm64 · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
[libnginx-mod-mail]Not affected
Source package: [nginx]
Details (4)
- 1.22.1-9+deb12u9 · amd64 · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · arm64 · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · amd64 · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · arm64 · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
[libnginx-mod-stream]Not affected
Source package: [nginx]
Details (4)
- 1.22.1-9+deb12u9 · amd64 · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · arm64 · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · amd64 · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · arm64 · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
[libnginx-mod-stream-geoip]Not affected
Source package: [nginx]
Details (4)
- 1.22.1-9+deb12u9 · amd64 · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · arm64 · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · amd64 · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · arm64 · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
[nginx]Not affected
Details (4)
- 1.22.1-9+deb12u9 · amd64 · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · arm64 · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · amd64 · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · arm64 · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
[nginx-common]Not affected
Source package: [nginx]
Details (4)
- 1.22.1-9+deb12u9 · all · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · all · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · all · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · all · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
[nginx-core]Not affected
Source package: [nginx]
Details (4)
- 1.22.1-9+deb12u9 · all · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · all · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · all · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · all · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
[nginx-dev]Not affected
Source package: [nginx]
Details (4)
- 1.22.1-9+deb12u9 · all · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · all · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · all · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · all · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
[nginx-doc]Not affected
Source package: [nginx]
Details (4)
- 1.22.1-9+deb12u9 · all · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · all · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · all · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · all · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
[nginx-extras]Not affected
Source package: [nginx]
Details (4)
- 1.22.1-9+deb12u9 · amd64 · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · arm64 · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · amd64 · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · arm64 · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
[nginx-full]Not affected
Source package: [nginx]
Details (4)
- 1.22.1-9+deb12u9 · all · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · all · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · all · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · all · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
[nginx-light]Not affected
Source package: [nginx]
Details (4)
- 1.22.1-9+deb12u9 · all · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · all · bookworm
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · all · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm
- 1.22.1-9+deb12u9 · all · bookworm-security
  Not affected
  nvd · nginx · debian · bookworm

Observed: Oct 27, 2026, 6:28:45 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]