CVE-2026-55233

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55233
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55233.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55233
Aliases
  • GHSA-wx83-v28q-68gx
Published
2026-07-10T19:59:59.530Z
Modified
2026-07-16T03:48:42.369948580Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
OpenResty: Buffer overflow when writing PROXY protocol v2 header to upstream
Details

OpenResty is a high performance web platform. From 1.29.2.1 to before 1.29.2.5, an out-of-bounds write vulnerability exists in the upstream PROXY protocol v2 implementation. When OpenResty is configured to send PROXY protocol version 2 headers to upstream servers, constructing the header in the stream proxy protocol v2 patch can write beyond the bounds of the allocated buffer, causing the worker process to crash and resulting in a denial of service. Only configurations that explicitly enable PROXY protocol v2 for upstream connections are impacted. This issue is fixed in version 1.29.2.5.

Database specific 
{
    "cwe_ids": [
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55233.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/openresty/openresty

Affected ranges

Type
GIT
Repo
https://github.com/openresty/openresty
Events
Introduced
ad85d73f5bfa1a6ce0a83b4f947fefc638050a64
Fixed
2ec0f65e434c92e9f78fd5c3af601a6b286c6d2b
Fixed
5c56ad2958a2dad8b2cc99f4987b8642cbc647d1
Database specific 
{
    "cpe": "cpe:2.3:a:openresty:openresty:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.29.2.1"
        },
        {
            "fixed": "1.29.2.5"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.29.2.1
v1.29.2.2
v1.29.2.2rc1
v1.29.2.3
v1.29.2.4
v1.29.8.1rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55233.json"