CVE-2026-97205

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97205", "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "state": "PUBLISHED", "assignerShortName": "f5", "dateReserved": "2026-09-30T21:56:14.607Z", "datePublished": "2026-10-14T14:40:27.487Z", "dateUpdated": "2026-10-15T10:31:15.547Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "modules": ["ngx_http_core_module"], "product": "NGINX Plus", "vendor": "F5", "versions": [{"lessThan": "37.1.0.1", "status": "affected", "version": "37.1.0", "versionType": "custom"}, {"lessThan": "37.0.5.1", "status": "affected", "version": "37.0.0", "versionType": "custom"}, {"lessThan": "*", "status": "affected", "version": "R36", "versionType": "custom"}, {"lessThan": "*", "status": "affected", "version": "R35", "versionType": "custom"}, {"lessThan": "*", "status": "affected", "version": "R34", "versionType": "custom"}, {"lessThan": "*", "status": "affected", "version": "R33", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["ngx_http_core_module"], "product": "NGINX Open Source", "vendor": "F5", "versions": [{"lessThan": "1.31.7", "status": "affected", "version": "1.31.0", "versionType": "custom"}, {"lessThan": "1.30.6", "status": "affected", "version": "1.30.0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "F5 acknowledges Cyberlanc3r for bringing this issue to our attention and following the highest standards of coordinated disclosure."}], "datePublic": "2026-10-14T14:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing \u201cinclude virtual\u201d commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.<br><br>Impact:<br>This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.<br><br>\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}], "value": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing \u201cinclude virtual\u201d commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}], "impacts": [{"capecId": "CAPEC-234", "descriptions": [{"lang": "en", "value": "CAPEC-234 Hijacking a privileged process"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.2, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-416", "description": "CWE-416 Use After Free", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "shortName": "f5", "dateUpdated": "2026-10-14T14:40:27.487Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://my.f5.com/manage/s/article/K000162608"}], "source": {"discovery": "EXTERNAL"}, "title": "NGINX ngx_http_core_module vulnerability", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Disable the \"aio\" directive or do not serve SSI pages.<br>"}], "value": "Disable the \"aio\" directive or do not serve SSI pages."}], "x_generator": {"engine": "F5 SIRTBot v1.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-97205", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T03:57:01.124115Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T10:31:15.547Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-97205", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T03:57:01.124115Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T10:29:28.871Z"}}], "cna": {"title": "NGINX ngx_http_core_module vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "F5 acknowledges Cyberlanc3r for bringing this issue to our attention and following the highest standards of coordinated disclosure."}], "impacts": [{"capecId": "CAPEC-234", "descriptions": [{"lang": "en", "value": "CAPEC-234 Hijacking a privileged process"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "F5", "modules": ["ngx_http_core_module"], "product": "NGINX Plus", "versions": [{"status": "affected", "version": "37.1.0", "lessThan": "37.1.0.1", "versionType": "custom"}, {"status": "affected", "version": "37.0.0", "lessThan": "37.0.5.1", "versionType": "custom"}, {"status": "affected", "version": "R36", "lessThan": "*", "versionType": "custom"}, {"status": "affected", "version": "R35", "lessThan": "*", "versionType": "custom"}, {"status": "affected", "version": "R34", "lessThan": "*", "versionType": "custom"}, {"status": "affected", "version": "R33", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "F5", "modules": ["ngx_http_core_module"], "product": "NGINX Open Source", "versions": [{"status": "affected", "version": "1.31.0", "lessThan": "1.31.7", "versionType": "custom"}, {"status": "affected", "version": "1.30.0", "lessThan": "1.30.6", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2026-10-14T14:00:00.000Z", "references": [{"url": "https://my.f5.com/manage/s/article/K000162608", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "en", "value": "Disable the \"aio\" directive or do not serve SSI pages.", "supportingMedia": [{"type": "text/html", "value": "Disable the \"aio\" directive or do not serve SSI pages.<br>", "base64": false}]}], "x_generator": {"engine": "F5 SIRTBot v1.0"}, "descriptions": [{"lang": "en", "value": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing \u201cinclude virtual\u201d commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "supportingMedia": [{"type": "text/html", "value": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing \u201cinclude virtual\u201d commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.<br><br>Impact:<br>This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.<br><br>\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "shortName": "f5", "dateUpdated": "2026-10-14T14:40:27.487Z"}}}, "cveMetadata": {"cveId": "CVE-2026-97205", "state": "PUBLISHED", "dateUpdated": "2026-10-15T10:31:15.547Z", "dateReserved": "2026-09-30T21:56:14.607Z", "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab", "datePublished": "2026-10-14T14:40:27.487Z", "assignerShortName": "f5"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "modules": ["ngx_http_core_module"], "product": "NGINX Plus", "vendor": "F5", "versions": [{"lessThan": "37.1.0.1", "status": "affected", "version": "37.1.0", "versionType": "custom"}, {"lessThan": "37.0.5.1", "status": "affected", "version": "37.0.0", "versionType": "custom"}, {"lessThan": "*", "status": "affected", "version": "R36", "versionType": "custom"}, {"lessThan": "*", "status": "affected", "version": "R35", "versionType": "custom"}, {"lessThan": "*", "status": "affected", "version": "R34", "versionType": "custom"}, {"lessThan": "*", "status": "affected", "version": "R33", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["ngx_http_core_module"], "product": "NGINX Open Source", "vendor": "F5", "versions": [{"lessThan": "1.31.7", "status": "affected", "version": "1.31.0", "versionType": "custom"}, {"lessThan": "1.30.6", "status": "affected", "version": "1.30.0", "versionType": "custom"}]}], "source": "f5sirt@f5.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing \u201cinclude virtual\u201d commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}], "id": "CVE-2026-97205", "lastModified": "2026-10-15T11:18:08.670", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "f5sirt@f5.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f5sirt@f5.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-97205", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T03:57:01.124115Z", "version": "2.0.3"}}]}, "published": "2026-10-14T15:17:28.200", "references": [{"source": "f5sirt@f5.com", "url": "https://my.f5.com/manage/s/article/K000162608"}], "sourceIdentifier": "f5sirt@f5.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "f5sirt@f5.com", "type": "Secondary"}]}

{"bugzilla": {"description": "nginx: NGINX ngx_http_core_module vulnerability", "id": "2552359", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552359"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["A flaw was found in NGINX. In certain configurations using asynchronous file I/O and SSI pages with include virtual commands, request processing can access freed memory in a worker process. A remote attacker may trigger memory corruption or a worker crash. Arbitrary code execution may be possible if ASLR is disabled or bypassed."], "mitigation": {"lang": "en:us", "value": "To mitigate this vulnerability, based on your environment requirements, you can either disable asynchronous file I/O (AIO) or Server Side Includes (SSI)."}, "name": "CVE-2026-97205", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "nginx", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "nginx:1.24/nginx", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "nginx", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "nginx:1.24/nginx", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "nginx:1.26/nginx", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "nginx", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-10-14T14:40:27Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97205\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97205\nhttps://my.f5.com/manage/s/article/K000162608"], "statement": "This vulnerability is rated as Important severity because an unauthenticated remote attacker could trigger memory corruption and worker crashes, potentially leading to arbitrary code execution. However, successful exploitation requires non-standard configurations where both asynchronous file I/O (aio) and Server Side Includes (ssi) processing are explicitly enabled. Furthermore, Red Hat Enterprise Linux systems enforce Address Space Layout Randomization (ASLR) by default, which substantially limits the feasibility of reliable code execution.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.31.0,1.31.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.30.0,1.30.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "NGINX Open Source", "source": "cna", "vendor": "F5"}, "product": "nginx_open_source", "vendor": "f5"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[37.1.0,37.1.0.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[37.0.0,37.0.5.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[R36,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[R35,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[R34,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[R33,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "NGINX Plus", "source": "cna", "vendor": "F5"}, "product": "nginx_plus", "vendor": "f5"}], "created": "2026-10-15T02:00:12.671425+00:00", "updated": "2026-10-20T15:00:17.071254+00:00", "vendors": ["f5", "f5$PRODUCT$nginx_open_source", "f5$PRODUCT$nginx_plus"]}