CVE-2026-60005 NGINX ngx_http_slice_module vulnerability
HighCVSS 8.8
EPSS 0.74%
- Published
- Updated
- Exploit status
- No public exploit known
Description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart.
Impact:
This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only.
Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| f5 NGINX Plus | >= 37.0.0.1, < 37.0.3.1 | 37.0.3.1 |
| f5 NGINX Plus | >= R36, < R36 P7 | R36 P7 |
| f5 NGINX Plus | >= R33 | No fix listed |
| f5 NGINX Open Source | >= 1.31.2, < 1.31.3 | 1.31.3 |
| f5 NGINX Open Source | >= 1.15.8, < 1.30.4 | 1.30.4 |
| redhat/nginx(Red Hat:enterprise_linux:10.2) | < 2:1.26.3-6.el10_2.6 | 2:1.26.3-6.el10_2.6 |
| redhat/nginx:1.24-8100020260809162034.489197e6(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/nginx(Red Hat:enterprise_linux:9) | < 2:1.20.1-28.el9_8.5 | 2:1.20.1-28.el9_8.5 |
| redhat/nginx:1.24-9080020260804072754.9(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/nginx:1.26-9080020260803214158.9(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/nginx(Red Hat:rhel_e4s:9.2) | < 1:1.20.1-14.el9_2.7 | 1:1.20.1-14.el9_2.7 |
| redhat/nginx(Red Hat:rhel_e4s:9.4) | < 1:1.20.1-16.el9_4.7 | 1:1.20.1-16.el9_4.7 |
| redhat/nginx(Red Hat:rhel_eus:9.6) | < 2:1.20.1-22.el9_6.7 | 2:1.20.1-22.el9_6.7 |
| redhat/discovery/discovery-ui-rhel9:1788206196(Red Hat:discovery:2::el9) | All versions | No fix listed |
| redhat/nginx-main(Red Hat:hummingbird:1) | < 1.30.4-2.hum1 | 1.30.4-2.hum1 |
| redhat/rhui5/cds-kubernetes-rhel9:1788880445(Red Hat:rhui:5::el9) | All versions | No fix listed |
| redhat/rhui5/cds-rhel9:1788880464(Red Hat:rhui:5::el9) | All versions | No fix listed |
| redhat/rhui5/rhua-rhel9:1788880581(Red Hat:rhui:5::el9) | All versions | No fix listed |
| redhat/insights-proxy/insights-proxy-container-rhel9(Red Hat:insights_proxy:1) | All versions | No fix listed |
| debian/nginx(Debian:12) | < 1.22.1-9+deb12u10 | 1.22.1-9+deb12u10 |
| debian/nginx(Debian:12) | = 1.22.1-9 | No fix listed |
| debian/nginx(Debian:12) | = 1.22.1-9+deb12u1 | No fix listed |
| debian/nginx(Debian:12) | = 1.22.1-9+deb12u2 | No fix listed |
| debian/nginx(Debian:12) | = 1.22.1-9+deb12u3 | No fix listed |
| debian/nginx(Debian:12) | = 1.22.1-9+deb12u4 | No fix listed |
Show 70 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/nginx(Debian:12) | = 1.22.1-9+deb12u5 | No fix listed |
| debian/nginx(Debian:12) | = 1.22.1-9+deb12u6 | No fix listed |
| debian/nginx(Debian:12) | = 1.22.1-9+deb12u7 | No fix listed |
| debian/nginx(Debian:12) | = 1.22.1-9+deb12u8 | No fix listed |
| debian/nginx(Debian:12) | = 1.22.1-9+deb12u9 | No fix listed |
| debian/nginx(Debian:13) | < 1.26.3-3+deb13u8 | 1.26.3-3+deb13u8 |
| debian/nginx(Debian:13) | = 1.26.3-3 | No fix listed |
| debian/nginx(Debian:13) | = 1.26.3-3+deb13u1 | No fix listed |
| debian/nginx(Debian:13) | = 1.26.3-3+deb13u2 | No fix listed |
| debian/nginx(Debian:13) | = 1.26.3-3+deb13u3 | No fix listed |
| debian/nginx(Debian:13) | = 1.26.3-3+deb13u4 | No fix listed |
| debian/nginx(Debian:13) | = 1.26.3-3+deb13u5 | No fix listed |
| debian/nginx(Debian:13) | = 1.26.3-3+deb13u6 | No fix listed |
| debian/nginx(Debian:13) | = 1.26.3-3+deb13u7 | No fix listed |
| debian/nginx(Debian:14) | < 1.30.1-7 | 1.30.1-7 |
| debian/nginx(Debian:14) | = 1.26.3-3 | No fix listed |
| debian/nginx(Debian:14) | = 1.28.0-1 | No fix listed |
| debian/nginx(Debian:14) | = 1.28.0-2 | No fix listed |
| debian/nginx(Debian:14) | = 1.28.0-3 | No fix listed |
| debian/nginx(Debian:14) | = 1.28.0-4 | No fix listed |
| debian/nginx(Debian:14) | = 1.28.0-5 | No fix listed |
| debian/nginx(Debian:14) | = 1.28.0-6 | No fix listed |
| debian/nginx(Debian:14) | = 1.28.1-1 | No fix listed |
| debian/nginx(Debian:14) | = 1.28.1-2 | No fix listed |
| debian/nginx(Debian:14) | = 1.28.1-3 | No fix listed |
| debian/nginx(Debian:14) | = 1.28.2-1 | No fix listed |
| debian/nginx(Debian:14) | = 1.28.2-2 | No fix listed |
| debian/nginx(Debian:14) | = 1.28.2-3 | No fix listed |
| debian/nginx(Debian:14) | = 1.28.2-4 | No fix listed |
| debian/nginx(Debian:14) | = 1.28.3-1 | No fix listed |
| debian/nginx(Debian:14) | = 1.28.3-2 | No fix listed |
| debian/nginx(Debian:14) | = 1.30.0-1 | No fix listed |
| debian/nginx(Debian:14) | = 1.30.0-2 | No fix listed |
| debian/nginx(Debian:14) | = 1.30.0-3 | No fix listed |
| debian/nginx(Debian:14) | = 1.30.0-4 | No fix listed |
| debian/nginx(Debian:14) | = 1.30.1-1 | No fix listed |
| debian/nginx(Debian:14) | = 1.30.1-2 | No fix listed |
| debian/nginx(Debian:14) | = 1.30.1-3 | No fix listed |
| debian/nginx(Debian:14) | = 1.30.1-4 | No fix listed |
| debian/nginx(Debian:14) | = 1.30.1-5 | No fix listed |
| debian/nginx(Debian:14) | = 1.30.1-6 | No fix listed |
| ubuntu/nginx(Ubuntu:22.04) | < 1.18.0-6ubuntu14.17 | 1.18.0-6ubuntu14.17 |
| alpine/nginx(Alpine:v3.21) | < 1.26.3-r2 | 1.26.3-r2 |
| alpine/nginx(Alpine:v3.22) | < 1.28.3-r6 | 1.28.3-r6 |
| alpine/nginx(Alpine:v3.23) | < 1.28.3-r6 | 1.28.3-r6 |
| alpine/nginx(Alpine:v3.24) | < 1.30.4-r0 | 1.30.4-r0 |
| ubuntu/nginx(Ubuntu:24.04) | < 1.24.0-2ubuntu7.14 | 1.24.0-2ubuntu7.14 |
| ubuntu/nginx(Ubuntu:26.04) | < 1.28.3-2ubuntu1.7 | 1.28.3-2ubuntu1.7 |
| f5 NGINX Gateway Fabric | >= 1.3.0, <= 1.6.2 | No fix listed |
| f5 NGINX Gateway Fabric | >= 2.0.0, < 2.6.7 | 2.6.7 |
| f5 NGINX Ingress Controller | >= 3.5.0, <= 3.7.2 | No fix listed |
| f5 NGINX Ingress Controller | >= 5.0.0, < 5.5.3 | 5.5.3 |
| f5 NGINX Ingress Controller | >= 2026-lts-r1, < 2026-lts-r4 | 2026-lts-r4 |
| f5 NGINX Ingress Controller | = 4.0.0 | No fix listed |
| f5 NGINX Ingress Controller | = 4.0.1 | No fix listed |
| f5 NGINX Instance Manager | >= 2.17.0, < 2.22.2 | 2.22.2 |
| f5 NGINX Open Source | >= 1.30.0, < 1.30.4 | 1.30.4 |
| f5 NGINX Open Source | = 1.31.2 | No fix listed |
| f5 NGINX Plus | >= r33, < r36 | r36 |
| f5 NGINX Plus | = r36 | No fix listed |
| f5 NGINX Plus | = r36-p1 | No fix listed |
| f5 NGINX Plus | = r36-p2 | No fix listed |
| f5 NGINX Plus | = r36-p3 | No fix listed |
| f5 NGINX Plus | = r36-p4 | No fix listed |
| f5 NGINX Plus | = r36-p5 | No fix listed |
| f5 NGINX Plus | = r36-p6 | No fix listed |
| f5 waf | >= 4.11.0, <= 4.16.0 | No fix listed |
| f5 waf | >= 5.2.0, <= 5.8.0 | No fix listed |
| f5 waf | >= 5.9.0, < 5.13.4 | 5.13.4 |
| f5 nginx(Azure Linux:3.0) | All versions | No fix listed |
References
- MSRC Security Update Guide vendor-advisory
- my.f5.com patch vendor-advisory
- Red Hat CVE page mitigation vendor-advisory
- RHSA-2026:59220 patch vendor-advisory
- RHSA-2026:59216 patch vendor-advisory
- RHSA-2026:59362 patch vendor-advisory
- RHSA-2026:59490 patch vendor-advisory
- RHSA-2026:59496 patch vendor-advisory
- RHSA-2026:93472 patch vendor-advisory
- RHSA-2026:93468 patch vendor-advisory
- RHSA-2026:93467 patch vendor-advisory
- RHSA-2026:61783 patch vendor-advisory
- RHSA-2026:46012 patch vendor-advisory
- RHSA-2026:66018 patch vendor-advisory
- Red Hat Bugzilla 2500992 issue-tracking
- www.cve.org
- nvd.nist.gov
- Debian Security Tracker CVE-2026-60005 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- USN-8563-1 vendor-advisory
- security.alpinelinux.org vendor-advisory