{"schema":"threatline.record/2","record":{"id":"CVE-2026-42530","aliases":[],"summary":"NGINX Open-Source ngx_http_v3_module vulnerability","details":"NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","categories":["Web servers"],"product":"NGINX Open Source","vendor":"F5","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-42530","source_modified_at":"2026-07-16T12:04:40.146Z","fetched_at":"2026-10-28T08:18:35.509402Z","product":"NGINX Open Source","vendor":"F5","versions":[{"lessThan":"1.31.2","status":"affected","version":"1.31.0","versionType":"custom"}],"defaultStatus":"unknown"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-42530","source_modified_at":"2026-07-16T12:04:40.146Z","fetched_at":"2026-10-28T08:18:35.509402Z","package":{"name":"NGINX Open Source","ecosystem":null},"version":"1.31.2","basis":"first unaffected version stated in the CVE record"}],"cvss":8.1,"severity":"High","kev":{"listed":false},"epss":{"probability":0.06452,"percentile":0.93695,"score_date":"2026-10-27"},"published_at":"2026-06-17T14:04:32.173Z","modified_at":"2026-07-16T12:04:40.146Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-42530","fetched_at":"2026-10-28T08:18:35.509402Z","source_modified_at":"2026-07-16T12:04:40.146Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-42530","fetched_at":"2026-10-28T08:18:35.509402Z","source_modified_at":"2026-10-27"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://my.f5.com/manage/s/article/K000161616","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://access.redhat.com/security/cve/CVE-2026-42530","tags":["vdb-entry","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489872","tags":["issue-tracking","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42530.json","tags":["x_sadp-csaf-vex"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:20351","tags":["vendor-advisory","x_refsource_REDHAT"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-06-17T00:00:00+00:00"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-07-16T12:04:40.146Z","content_hash":"7f9418a89db49e181fff76cddbdd583b5060a742c4e160245c762da181711a4c"}}