CVE-2026-90439 — Heap-based Buffer Overflow in F5

Vendor	Product	Version range	Fixed in
f5	nginx_open_source	>= 1.29.2 < 1.31.6	1.31.6
f5	nginx_open_source	>= 1.30.4 < 1.30.5	1.30.5
f5	nginx_plus	—	—
f5	nginx_plus	>= 37.0.0.1 < 37.0.6.2	37.0.6.2
f5	nginx_plus	>= 37.1.0.1 < 37.1.1.2	37.1.1.2
openshift	ose-rhel-coreos-8	—	—
openshift	ose-rhel-coreos-9	—	—
php	php	—	—

Red Hat

nginx: NGINX ngx_http_v3_module: Denial of Service via TLS handshake heap buffer overflow

vendor_redhat·2026-09-15·CVSS 6.5

CVE-2026-90439 [MEDIUM] CWE-787 nginx: NGINX ngx_http_v3_module: Denial of Service via TLS handshake heap buffer overflow nginx: NGINX ngx_http_v3_module: Denial of Service via TLS handshake heap buffer overflow A flaw was found in NGINX ngx_http_v3_module. A limited heap buffer overflow can occur during a Transport Layer Security (TLS) handshake when using HTTP/3 with certain OpenSSL versions. This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. Additionally, it could lead to limited data corruption. Package: php (Red Hat Hardened Images) - Affected Package: openshift/ose-rhel-coreos-8 (Red Hat OpenShift Container Platform 4) - Fix deferred Package: openshift/ose-rhel-coreos-9 (Red Hat OpenShift Container Platform 4) - Fix deferred

F5

CVE-2026-90439: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module

vendor_f5·2026-09-15·CVSS 6.5

CVE-2026-90439 [MEDIUM] CWE-122 CVE-2026-90439: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module CVE-2026-90439: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this is a data plane issue only. Note: Software versions which

GHSA

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module.

ghsa_unreviewed·2026-09-15

CVE-2026-90439 [MEDIUM] CWE-122 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVE-2026-90439: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain…

Affected

CVSS provenance