Skip to content
VulniPulse
Sign in
Highest advisory severityMedium 2 vendors · 2 advisories

CVE-2026-90439

CVE-2026-90439: 2 tracked advisory records across F5, Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

F5

1 advisory
  • Advisory severityMedium6.9

    Medium [CVE-2026-90439] NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module

    CVE-2026-90439Source published Source updated

    NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or limited data corruption. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    Affected products in this advisory
    • NGINX Plus
    • NGINX Open Source
    Source-reported affected versions
    • NGINX Plus 37.1.0.1 before 37.1.1.2
    • NGINX Plus 37.0.0.1 before 37.0.6.2
    • NGINX Open Source 1.29.2 before 1.31.6
    • NGINX Open Source 1.30.4 before 1.30.5
    Source-reported fixed versions
    • 37.1.1.2
    • 37.0.6.2
    • 1.31.6
    • 1.30.5
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityMedium6.5

    Medium [CVE-2026-90439] NGINX ngx_http_v3_module: Denial of Service via TLS handshake heap buffer overflow

    CVE-2026-90439Source published Source updated

    NGINX ngx_http_v3_module: Denial of Service via TLS handshake heap buffer overflow. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-787. Red Hat lists fixing advisory RHSA-2026:67977 with package nginx-main-1.30.5-4.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat OpenShift Container Platform 4.

    Related products — impact not confirmed
    • Red Hat Hardened Images
    • Red Hat OpenShift Container Platform 4
    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    • nginx-main-1.30.5-4.hum1
    • RHSA-2026:67977
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features