CVE-2026-40460

The nginx package before 1.6.2-5+deb8u3 on Debian jessie and earlier versions on Ubuntu and Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log.

In nginx before 1.10.1 and 1.11.x before 1.11.1, a vulnerability allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.

The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service via an invalid pointer dereference, leading to a worker process crash.

Heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remote attackers to execute arbitrary code via a crafted request.

A vulnerability in the ngx_http_rewrite_module of NGINX Plus and NGINX Open Source occurs when a rewrite directive uses a regex pattern with overlapping PCRE captures and a replacement string referencing multiple captures. An unauthenticated attacker can send crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process, leading to a restart.

A vulnerability exists in NGINX Plus and NGINX Open Source within the ngx_http_rewrite_module. It occurs when the rewrite directive is followed by rewrite, if, or set directives and an unnamed PCRE capture (e.g., $1, $2) with a replacement string containing a question mark (?). An unauthenticated attacker can send crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process, leading to a restart.

A vulnerability in the NGINX ngx_http_dav_module allows an attacker to trigger a buffer overflow in the NGINX worker process. The issue occurs when the configuration uses MOVE or COPY methods with alias directives and prefix locations.

A use-after-free vulnerability in the resolver in nginx versions 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other impact via a crafted DNS response related to CNAME response processing.

A vulnerability exists in NGINX Plus and NGINX Open Source within the ngx_http_slice_module module. When the slice directive with unnamed regex captures is configured or during a background cache update, unauthenticated attackers can send requests causing uninitialized memory access in the NGINX worker process, leading to limited memory disclosure or a restart.

A vulnerability exists in NGINX Plus and NGINX Open Source within the ngx_http_ssi_module module. This issue occurs when Server-Side Includes (SSI), proxy_pass, and proxy_buffering off directives are configured. An unauthenticated attacker with man-in-the-middle (MITM) capability to control upstream server responses may trigger a use-after-free in the NGINX worker process.