Read the docs
TI-2026-25475 Aliases CVE-2026-33029GHSA-cp8r-8jvw-v3qg

Nginx UI: DoS via Negative Integer Input in Logrotate Interval

Priority MEDIUM 64CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, an input validation vulnerability in the logrotate configuration allows an authenticated user to cause a complete Denial of Service (DoS). By submitting a negative integer for the rotation interval, the backend enters an infinite loop or an invalid state, rendering the web interface unresponsive. This issue has been patched in version 2.3.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00985 62nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed nginx-ui (0xJacky): 2.3.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
0xJackynginx-uibefore 2.3.42.3.4Patch availableCNA
—github.com/0xJacky/Nginx-UI (Go)up to 1.99—No fix listedGHSA-cp8r-8jvw-v3qg
  • nginx-ui Vendor0xJacky Affected before 2.3.4 Fixed in 2.3.4 Patch available CNA
  • github.com/0xJacky/Nginx-UI (Go) Vendor— Affected up to 1.99 Fixed in — No fix listed GHSA-cp8r-8jvw-v3qg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:*before 2.3.4Vulnerable0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:* Versions before 2.3.4 Vulnerable ·0xJacky

Remediation

  • Fix · CNA nginx-ui (0xJacky) Fixed in 2.3.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33029
  2. 2026-10-03 Alias added: GHSA-cp8r-8jvw-v3qg
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Exploit 1

Advisory 1

Other 2

  • TI-2026-25478 Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover CVSS 3.1CRITICAL 9.8
  • TI-2026-25472 nginx-ui Backup Restore Allows Tampering with Encrypted Backups CVSS 4.0CRITICAL 9.4
  • TI-2026-22288 Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure CVSS 3.1CRITICAL 9.8
  • TI-2024-15821 Nginx-UI arbitrary file write through the Import Certificate feature CVSS 3.1CRITICAL 9.8
  • TI-2026-70057 Code injection in Nginx UI backup restore allows code execution CVSS 4.0CRITICAL 9.4
  • TI-2026-32056 Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services CVSS 3.1CRITICAL 9.9
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences