[{"data":1,"prerenderedAt":563},["ShallowReactive",2],{"switcher-blog-pareja":3,"art-nginx-cve-2026-90439-http3-openssl-buffer-overflow-en":6},{"en":4,"es":5},"\u002Fen\u002Fblog\u002Fnginx-cve-2026-90439-http3-openssl-buffer-overflow\u002F","\u002Fes\u002Fblog\u002Fnginx-cve-2026-90439-http3-openssl\u002F",{"id":7,"title":8,"author":9,"body":10,"date":546,"description":547,"extension":548,"image":549,"meta":550,"navigation":373,"pareja":551,"path":552,"seo":553,"sin_cta":554,"stem":555,"tags":556,"__hash__":562},"blogEn\u002Fen\u002Fblog\u002Fnginx-cve-2026-90439-http3-openssl-buffer-overflow.md","Nginx 1.30.5 and 1.31.6: the HTTP\u002F3 buffer overflow (CVE-2026-90439) and two commands to tell if you're exposed","Paco Cubel",{"type":11,"value":12,"toc":532},"minimark",[13,18,40,47,51,82,86,128,135,139,145,182,185,189,194,229,232,246,250,279,282,286,305,412,419,423,426,454,457,461,468,483,486,490,528],[14,15,17],"h2",{"id":16},"http3-again","HTTP\u002F3 again",[19,20,21,22,26,27,30,31,34,35,39],"p",{},"On 15 September nginx released ",[23,24,25],"strong",{},"1.30.5"," (stable) and ",[23,28,29],{},"1.31.6"," (mainline). Both have a single urgent reason to exist: ",[23,32,33],{},"CVE-2026-90439",", a buffer overflow in ",[36,37,38],"code",{},"ngx_http_v3_module",", the module behind HTTP\u002F3 support.",[19,41,42,43,46],{},"The good news is that this time the bug is ",[23,44,45],{},"not universal",". The bad news is that if you run HTTP\u002F3 —and more and more people switch it on because browsers reward it— you should check today, not \"at some point\".",[14,48,50],{"id":49},"in-one-sentence","In one sentence",[19,52,53,54,57,58,61,62,65,66,69,70,73,74,77,78,81],{},"With ",[23,55,56],{},"HTTP\u002F3 enabled"," and nginx linked against ",[23,59,60],{},"OpenSSL 3.5.0 or earlier",", a remote, unauthenticated attacker can trigger a ",[23,63,64],{},"limited memory overflow"," in a worker during the TLS handshake, which ends up ",[23,67,68],{},"restarting the worker"," and may corrupt some data. ",[23,71,72],{},"Medium"," severity: CVSS ",[23,75,76],{},"6.5"," on v3.1 and ",[23,79,80],{},"6.9"," on v4.0, according to F5 itself.",[14,83,85],{"id":84},"what-we-know-about-the-bug","What we know about the bug",[87,88,89,96,106,112,118],"ul",{},[90,91,92,95],"li",{},[23,93,94],{},"Where it lives",": in TLS handshake processing for HTTP\u002F3 (QUIC) connections.",[90,97,98,101,102,105],{},[23,99,100],{},"What it causes",": worker restarts and, at most, limited data corruption. F5 doesn't attribute any information leak or code execution to it, and notes that the effect is ",[23,103,104],{},"non-deterministic"," and not under the attacker's control.",[90,107,108,111],{},[23,109,110],{},"What it doesn't touch",": it's data plane only. There's no control plane exposure.",[90,113,114,117],{},[23,115,116],{},"Who found it",": Banny Liao, per the nginx changelog.",[90,119,120,123,124,127],{},[23,121,122],{},"Is it being exploited?"," As of today there's no evidence of exploitation and no public proof of concept. But CISA's assessment flags it as ",[23,125,126],{},"automatable",": nothing fancy is needed to spray it at exposed servers.",[19,129,130,131,134],{},"Besides the fix, both releases change one behaviour: ",[23,132,133],{},"the QUIC transport parameters extension received over a regular SSL connection is now always ignored",". Mainline 1.31.6 also ships a handful of bug fixes unrelated to security.",[14,136,138],{"id":137},"whos-affected","Who's affected",[19,140,141,144],{},[23,142,143],{},"Both conditions"," have to be true:",[146,147,148,166],"ol",{},[90,149,150,153,154,157,158,161,162,165],{},[23,151,152],{},"Vulnerable version",": ",[23,155,156],{},"1.29.2 through 1.31.5",". On the stable branch, that covers 1.30.x releases before 1.30.5. NGINX Plus is affected too; the fix is in ",[23,159,160],{},"37.1.1.2"," and ",[23,163,164],{},"37.0.6.2",".",[90,167,168,170,171,174,175,178,179,165],{},[23,169,56],{}," (any ",[36,172,173],{},"listen"," directive with ",[36,176,177],{},"quic",") ",[23,180,181],{},"and OpenSSL 3.5.0 or earlier",[19,183,184],{},"If your nginx is older than 1.29.2, the vulnerable code isn't there. That's typical of packages from stable distributions, which tend to lag several versions behind; still, check rather than assume. And if you don't use HTTP\u002F3, this bug can't reach you even if your version falls in the range.",[14,186,188],{"id":187},"what-to-do-today","What to do today",[190,191,193],"h3",{"id":192},"_1-check-the-version-and-openssl","1. Check the version and OpenSSL",[195,196,201],"pre",{"className":197,"code":198,"language":199,"meta":200,"style":200},"language-bash shiki shiki-themes github-dark-high-contrast","nginx -V 2>&1 | head -3\n","bash","",[36,202,203],{"__ignoreMap":200},[204,205,208,212,216,220,223,226],"span",{"class":206,"line":207},"line",1,[204,209,211],{"class":210},"s_sBn","nginx",[204,213,215],{"class":214},"sCcAr"," -V",[204,217,219],{"class":218},"sWyjQ"," 2>&1",[204,221,222],{"class":218}," |",[204,224,225],{"class":210}," head",[204,227,228],{"class":214}," -3\n",[19,230,231],{},"The first line shows the nginx version, and another one shows the OpenSSL it was built with (\"built with OpenSSL…\"). Check the system one as well:",[195,233,235],{"className":197,"code":234,"language":199,"meta":200,"style":200},"openssl version\n",[36,236,237],{"__ignoreMap":200},[204,238,239,242],{"class":206,"line":207},[204,240,241],{"class":210},"openssl",[204,243,245],{"class":244},"sTRMh"," version\n",[190,247,249],{"id":248},"_2-check-whether-http3-is-on","2. Check whether HTTP\u002F3 is on",[195,251,253],{"className":197,"code":252,"language":199,"meta":200,"style":200},"nginx -T 2>\u002Fdev\u002Fnull | grep -E \"listen.*quic|http3\"\n",[36,254,255],{"__ignoreMap":200},[204,256,257,259,262,265,268,270,273,276],{"class":206,"line":207},[204,258,211],{"class":210},[204,260,261],{"class":214}," -T",[204,263,264],{"class":218}," 2>",[204,266,267],{"class":244},"\u002Fdev\u002Fnull",[204,269,222],{"class":218},[204,271,272],{"class":210}," grep",[204,274,275],{"class":214}," -E",[204,277,278],{"class":244}," \"listen.*quic|http3\"\n",[19,280,281],{},"If nothing comes back, HTTP\u002F3 isn't enabled and you can relax about this CVE (and update anyway in your next window).",[190,283,285],{"id":284},"_3-if-youre-affected-update-and-reload-with-no-downtime","3. If you're affected: update and reload with no downtime",[87,287,288,297],{},[90,289,290,293,294,165],{},[23,291,292],{},"Stable"," branch: aim for ",[23,295,296],{},"1.30.5 or later",[90,298,299,293,302,165],{},[23,300,301],{},"Mainline",[23,303,304],{},"1.31.6 or later",[195,306,308],{"className":197,"code":307,"language":199,"meta":200,"style":200},"# Debian \u002F Ubuntu (official nginx.org repository)\nsudo apt update && sudo apt install --only-upgrade nginx\nsudo nginx -t && sudo systemctl reload nginx\n\n# RHEL \u002F AlmaLinux \u002F Rocky\nsudo dnf update nginx\nsudo nginx -t && sudo systemctl reload nginx\n",[36,309,310,316,345,368,375,381,393],{"__ignoreMap":200},[204,311,312],{"class":206,"line":207},[204,313,315],{"class":314},"sQrFR","# Debian \u002F Ubuntu (official nginx.org repository)\n",[204,317,319,322,325,328,332,334,336,339,342],{"class":206,"line":318},2,[204,320,321],{"class":210},"sudo",[204,323,324],{"class":244}," apt",[204,326,327],{"class":244}," update",[204,329,331],{"class":330},"sMAXC"," && ",[204,333,321],{"class":210},[204,335,324],{"class":244},[204,337,338],{"class":244}," install",[204,340,341],{"class":214}," --only-upgrade",[204,343,344],{"class":244}," nginx\n",[204,346,348,350,353,356,358,360,363,366],{"class":206,"line":347},3,[204,349,321],{"class":210},[204,351,352],{"class":244}," nginx",[204,354,355],{"class":214}," -t",[204,357,331],{"class":330},[204,359,321],{"class":210},[204,361,362],{"class":244}," systemctl",[204,364,365],{"class":244}," reload",[204,367,344],{"class":244},[204,369,371],{"class":206,"line":370},4,[204,372,374],{"emptyLinePlaceholder":373},true,"\n",[204,376,378],{"class":206,"line":377},5,[204,379,380],{"class":314},"# RHEL \u002F AlmaLinux \u002F Rocky\n",[204,382,384,386,389,391],{"class":206,"line":383},6,[204,385,321],{"class":210},[204,387,388],{"class":244}," dnf",[204,390,327],{"class":244},[204,392,344],{"class":244},[204,394,396,398,400,402,404,406,408,410],{"class":206,"line":395},7,[204,397,321],{"class":210},[204,399,352],{"class":244},[204,401,355],{"class":214},[204,403,331],{"class":330},[204,405,321],{"class":210},[204,407,362],{"class":244},[204,409,365],{"class":244},[204,411,344],{"class":244},[19,413,414,415,418],{},"Then run ",[36,416,417],{},"nginx -v"," again. If you haven't checked it, it isn't done.",[190,420,422],{"id":421},"_4-if-you-cant-update-today","4. If you can't update today",[19,424,425],{},"F5 suggests two temporary workarounds:",[87,427,428,440],{},[90,429,430,433,434,436,437,439],{},[23,431,432],{},"Disable HTTP\u002F3"," by removing ",[36,435,177],{}," from your ",[36,438,173],{}," directives. Browsers will fall back to HTTP\u002F2, and users won't notice anything beyond a touch of extra latency.",[90,441,442,443,450,451,453],{},"Or ",[23,444,445,446,449],{},"enable it on every ",[36,447,448],{},"server"," block"," that shares the configuration, adding ",[36,452,177],{}," to all of them. F5 doesn't explain why; if you go this way, test it outside production first.",[19,455,456],{},"The first one is simpler and safer. The second is best left to people who already know why they're doing it.",[14,458,460],{"id":459},"how-we-approach-it","How we approach it",[19,462,463,464,467],{},"This is the kind of CVE where an ",[23,465,466],{},"inventory"," pays off: knowing in advance which servers run HTTP\u002F3 and which OpenSSL each nginx was built against. With that, \"am I affected?\" takes minutes, not an afternoon of SSH-ing into one server after another.",[19,469,470,471,476,477,479,480,482],{},"And one thing worth keeping in mind: HTTP\u002F3 code is far younger than HTTP\u002F1.1 or HTTP\u002F2 code. That's no reason to avoid it —we've already covered ",[472,473,475],"a",{"href":474},"\u002Fen\u002Fblog\u002Fnginx-http3-quic-2026","when it's worth turning on","— but it is a reason to treat the ",[36,478,177],{}," in your ",[36,481,173],{}," as something you enable knowing it needs watching.",[19,484,485],{},"If you don't know which nginx version your server runs, or whether HTTP\u002F3 is on, let's talk.",[14,487,489],{"id":488},"references","References",[87,491,492,500,507,514,521],{},[90,493,494],{},[472,495,499],{"href":496,"rel":497},"https:\u002F\u002Fnginx.org\u002Fen\u002Fsecurity_advisories.html",[498],"nofollow","nginx security advisories — nginx.org",[90,501,502],{},[472,503,506],{"href":504,"rel":505},"https:\u002F\u002Fnginx.org\u002Fen\u002FCHANGES",[498],"nginx CHANGES (1.31.6) — nginx.org",[90,508,509],{},[472,510,513],{"href":511,"rel":512},"https:\u002F\u002Fnginx.org\u002Fen\u002FCHANGES-1.30",[498],"nginx CHANGES-1.30 (1.30.5) — nginx.org",[90,515,516],{},[472,517,520],{"href":518,"rel":519},"https:\u002F\u002Fmy.f5.com\u002Fmanage\u002Fs\u002Farticle\u002FK000162604",[498],"NGINX vulnerability CVE-2026-90439 — F5 (K000162604)",[90,522,523],{},[472,524,527],{"href":525,"rel":526},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-90439",[498],"CVE-2026-90439 — NVD",[529,530,531],"style",{},"html pre.shiki code .s_sBn, html code.shiki .s_sBn{--shiki-default:#FFB757}html pre.shiki code .sCcAr, html code.shiki .sCcAr{--shiki-default:#91CBFF}html pre.shiki code .sWyjQ, html code.shiki .sWyjQ{--shiki-default:#FF9492}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sTRMh, html code.shiki .sTRMh{--shiki-default:#ADDCFF}html pre.shiki code .sQrFR, html code.shiki .sQrFR{--shiki-default:#BDC4CC}html pre.shiki code .sMAXC, html code.shiki .sMAXC{--shiki-default:#F0F3F6}",{"title":200,"searchDepth":318,"depth":318,"links":533},[534,535,536,537,538,544,545],{"id":16,"depth":318,"text":17},{"id":49,"depth":318,"text":50},{"id":84,"depth":318,"text":85},{"id":137,"depth":318,"text":138},{"id":187,"depth":318,"text":188,"children":539},[540,541,542,543],{"id":192,"depth":347,"text":193},{"id":248,"depth":347,"text":249},{"id":284,"depth":347,"text":285},{"id":421,"depth":347,"text":422},{"id":459,"depth":318,"text":460},{"id":488,"depth":318,"text":489},"2026-09-15","Nginx has shipped releases fixing a buffer overflow in its HTTP\u002F3 module, rated medium severity. It only bites if HTTP\u002F3 is enabled and nginx is built against OpenSSL 3.5.0 or earlier, but in that case an unauthenticated attacker can knock workers over. Here's how to check and what to do.","md","\u002Fog\u002Fog-default.png",{},"nginx-cve-2026-90439-http3-openssl","\u002Fen\u002Fblog\u002Fnginx-cve-2026-90439-http3-openssl-buffer-overflow",{"title":8,"description":547},false,"en\u002Fblog\u002Fnginx-cve-2026-90439-http3-openssl-buffer-overflow",[557,558,559,560,561],"Nginx","Servers","Security","CVE","HTTP\u002F3","ecd_n_X4X3TFi9Ion655LDbZzrhBlGSpgkZfciVuUdo",1792647976999]