High [CVE-2026-42530] use-after-free issue leads to denial of service
This high-severity Red Hat Linux advisory covers CVE-2026-42530 affecting Red Hat Hardened Images.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
NGINX Open Source has a vulnerability in the ngx_http_v3_module module. This may cause a Use-after-Free in the NGINX worker process leading to a restart.
Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
This vulnerability is only exploitable when NGINX is configured to use the HTTP/3 QUIC module. This issue allows a remote unauthenticated attacker to potentially execute arbitrary code or cause a denial of service by forcing the worker process to restart.
Default Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability.
Due to these reasons, this vulnerability has been rated with an important severity. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Weakness: CWE-416. Affected Red Hat products: Red Hat Hardened Images.
Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Lightspeed proxy 1 as not affected. Red Hat fixing advisory: RHSA-2026:20351.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 16 days ago·verify at source
- nginx-main-1.30.2-1.hum1
- RHSA-2026:20351
Official advisory · high-confidence parse· fetched 16 days ago·verify at source
Mitigation checklist
- To mitigate this vulnerability, disable HTTP/3 by removing quic from all listen directives.
Official advisory · high-confidence parse· fetched 16 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.