Skip to main content
No exploitation reportedFix available

CVE-2026-60005

No exploitation reported by the sources we read.

  • Published2026-07-15
  • Fixed in2026-lts-r4 · 5.5.3
  • WeaknessCWE-908

Am I affected?

With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart. Impact: This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Timeline

dates in UTC
  1. 2026-07-1516:16CVE publishedNVD

Versions per branch

NVD · OSV
F5 nginx ingress controller
BranchAffectedFixed in
2026.x≥ 2026-lts-r1, < 2026-lts-r42026-lts-r4
5.x≥ 5.0.0, < 5.5.35.5.3
3.x≥ 3.5.0, ≤ 3.7.2no fix published
4.0= 4.0.0no fix published
4.0= 4.0.1no fix published
F5 nginx open source
BranchAffectedFixed in
1.31≥ 1.31.0, < 1.31.31.31.3
1.30≥ 1.30.0, < 1.30.41.30.4
1.x≥ 1.15.8, < 1.30.41.30.4
1.31= 1.31.2no fix published
F5 nginx plus
BranchAffectedFixed in
—≥ r33, < r36r36
37.0≥ 37.0.0.1, < 37.0.3.137.0.3.1
—= r36no fix published

3 more products in the sources.

as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.

Products declared by the CNA2 products

As f5, the CNA that assigned this CVE, declared them in the CVE record; versions as written.

  • F5 NGINX Plusother versions: affected
    Affected
    • ≥ 37.0.0.1, < 37.0.3.1fixed in 37.0.3.1custom
    • ≥ R36, < R36 P7fixed in R36 P7custom
    • ≥ R33no fix statedcustom
  • F5 NGINX Open Sourceother versions: not affected
    Affected
    • ≥ 1.31.2, < 1.31.3fixed in 1.31.3custom
    • ≥ 1.15.8, < 1.30.4fixed in 1.30.4custom

Source: the CNA record (CVE Program), © The MITRE Corporation,CVE Terms of UseCVE recordupdated 2026-07-15

Distribution builds and vendor advisories

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Packages

  • commercial-nginx-plusChainguardall versions · fixed in 37.0.3.1-r0
  • ingress-nginx-controller-1.15Wolfiall versions · fixed in 1.15.12-r0
  • ingress-nginx-controller-1.15Chainguardall versions · fixed in 1.15.12-r0and 1 other package
  • nginxUbuntu:Pro:20.04:LTSall versions · no fixed version listed
  • nginxUbuntu:Pro:18.04:LTSall versions · no fixed version listed
  • nginxUbuntu:Pro:16.04:LTSall versions · no fixed version listed
  • nginxUbuntu:Pro:14.04:LTSall versions · no fixed version listed
  • nginxUbuntu:26.04:LTSall versions · fixed in 1.28.3-2ubuntu1.7

76 more package ranges on OSV.dev

Vendor advisories

  • CVE-2026-60005 Red Hat Product Security646 products fixed · 1 known affected

    nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module

    insights-proxy/insights-proxy-container-rhel9 as a component of Red Hat Lightspeed proxy 1

  • RHSA-2026:93467 Red Hat Product Security99 products fixed

    Red Hat Security Advisory: nginx security update

  • RHSA-2026:93468 Red Hat Product Security63 products fixed

    Red Hat Security Advisory: nginx security update

  • RHSA-2026:93472 Red Hat Product Security63 products fixed

    Red Hat Security Advisory: nginx security update

  • RHSA-2026:66018 Red Hat Product Security3 products fixed

    Red Hat Security Advisory: Red Hat Update Infrastructure 5.3 security update

  • RHSA-2026:61783 Red Hat Product Security2 products fixed

    Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage

6 more advisories

Full record on NVD

Fix

  1. Update F5 nginx ingress controller to 2026-lts-r4 · 5.5.3
  2. Vendor fix Red Hat Product Security RHSA-2026:93467 · 99 productsFor details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
  3. Vendor fix Red Hat Product Security RHSA-2026:66018 · 3 productsThe container images provided by this release, apart from the installer, should be deployed using rhui-installer utility. See the official documentation for more details.
  4. Vendor fix Red Hat Product Security RHSA-2026:61783 · 2 productsThe containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.
  5. Vendor fix Red Hat Product Security RHSA-2026:46012 · 25 productsFor details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/
  6. Workaround from the vendor Red Hat Product Security RHSA-2026:93467 · 99 productsTo mitigate this issue, disable the ngx_http_slice_module entirely if it is not required. If the module must be used, avoid unnamed regex captures with the slice directive and explicitly disable proxy_cache_background_update. Reload or restart the NGINX service to apply these changes. Please note t…

Advisories and patches

Detection

Nuclei template
none so far
ProjectDiscovery
Exploit-DB
no entry
Exploit-DB
Proof of concept
Metasploit modules
none listed
Metasploit Framework

Sources

Identifiers

Technical details

CVSS v3 Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CVSS 4.0 vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
2026-07-15
Last Modified
2026-08-11
NVD status
Analyzed
GitHub Advisory
GHSA-vxcv-h5wj-jxr5

Frequently asked questions

What is CVE-2026-60005?

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart. Impact: This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Is CVE-2026-60005 actively exploited?

Active exploitation of CVE-2026-60005 has not been confirmed. Its EPSS score was 0.7% on 2026-11-09, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2026-60005?

CVE-2026-60005 has a CVSS v3 base score of 8.2 (HIGH severity), with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H.

Running nginx? Hear about its next vulnerability

Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».

Get alerts for this productCISA KEV additions, November 2026Search CVEs

No credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database

Sources for this record