CVE-2026-60065
- Source
- https://cve.org/CVERecord?id=CVE-2026-60065
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-60065.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-60065
- Published
- 2026-07-15T15:16:47Z
- Modified
- 2026-08-12T04:18:32Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
- Summary
- [none]
- Details
-
When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filter_module), unauthenticated attackers can send requests with conditions beyond the attacker's control to cause a heap buffer over-read in the NGINX worker process, leading to a restart.
Impact: This vulnerability may allow remote unauthenticated attackers to have limited control to restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Database specific
{ "unresolved_ranges": [ { "cpes": [ "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:continuous_releases:*:*:*", "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:long-term_support:*:*:*" ], "extracted_events": [ { "introduced": "3.5.0" }, { "last_affected": "3.7.2" }, { "introduced": "5.0.0" }, { "fixed": "5.5.3" }, { "introduced": "2026-lts-r1" }, { "fixed": "2026-lts-r4" } ], "source": "CPE_RANGE", "vendor_product": "f5:nginx_ingress_controller" }, { "cpes": [ "cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "37.0.0.1" }, { "fixed": "37.0.3.1" }, { "introduced": "r33" }, { "fixed": "r36" } ], "source": "CPE_RANGE", "vendor_product": "f5:nginx_plus" }, { "cpes": [ "cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:*" ], "extracted_events": [ { "introduced": "4.11.0" }, { "last_affected": "4.16.0" }, { "introduced": "5.2.0" }, { "last_affected": "5.8.0" }, { "introduced": "5.9.0" }, { "fixed": "5.13.4" } ], "source": "CPE_RANGE", "vendor_product": "f5:waf" }, { "cpes": [ "cpe:2.3:a:f5:nginx_ingress_controller:4.0.0:*:*:*:continuous_releases:*:*:*", "cpe:2.3:a:f5:nginx_ingress_controller:4.0.1:*:*:*:continuous_releases:*:*:*" ], "extracted_events": [ { "introduced": "4.0.0" }, { "last_affected": "4.0.0" }, { "introduced": "4.0.1" }, { "last_affected": "4.0.1" } ], "source": "CPE_STRING", "vendor_product": "f5:nginx_ingress_controller" }, { "cpes": [ "cpe:2.3:a:f5:nginx_plus:r36:-:*:*:*:*:*:*", "cpe:2.3:a:f5:nginx_plus:r36:p1:*:*:*:*:*:*", "cpe:2.3:a:f5:nginx_plus:r36:p2:*:*:*:*:*:*", "cpe:2.3:a:f5:nginx_plus:r36:p3:*:*:*:*:*:*", "cpe:2.3:a:f5:nginx_plus:r36:p4:*:*:*:*:*:*", "cpe:2.3:a:f5:nginx_plus:r36:p5:*:*:*:*:*:*", "cpe:2.3:a:f5:nginx_plus:r36:p6:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "r36-NA" }, { "last_affected": "r36-NA" }, { "introduced": "r36-p1" }, { "last_affected": "r36-p1" }, { "introduced": "r36-p2" }, { "last_affected": "r36-p2" }, { "introduced": "r36-p3" }, { "last_affected": "r36-p3" }, { "introduced": "r36-p4" }, { "last_affected": "r36-p4" }, { "introduced": "r36-p5" }, { "last_affected": "r36-p5" }, { "introduced": "r36-p6" }, { "last_affected": "r36-p6" } ], "source": "CPE_STRING", "vendor_product": "f5:nginx_plus" } ] }- References
Affected packages
Git / github.com/nginx/nginx-gateway-fabric
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nginx/nginx-gateway-fabric
- Events
-
IntroducedLast AffectedIntroducedFixed
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "1.3.0" }, { "last_affected": "1.6.2" }, { "introduced": "2.0.0" }, { "fixed": "2.6.7" } ], "source": "CPE_RANGE" }