Database/Container, Kubernetes & orchestration

NGINX: HTTP/3 handshake can overflow a heap buffer in the worker, restarting it or corrupting data

CVSS 6.9CVE-2026-90439Container, Kubernetes & orchestrationcurated

Impact

With HTTP/3 enabled and built against OpenSSL 3.5.0 or older, processing a TLS handshake can overflow a heap buffer in the NGINX worker process. The result is a worker restart or limited data corruption. F5 states the overflow happens non-deterministically and outside the attacker's control, so this is a reliability and data-integrity concern rather than a controllable code-execution primitive, and F5 explicitly scopes it to the data plane with no control plane exposure. For an operator, the exposure is wherever NGINX or NGINX Plus fronts inference or API endpoints with HTTP/3 turned on - an ingress tier in front of a GPU fleet is the usual case.

Who can reach it

Remote and unauthenticated: anyone who can open an HTTP/3 connection to the listener. Only configurations that enable ngx_http_v3_module and link against OpenSSL 3.5.0 or earlier are affected.

What to do

Take the fixed NGINX Plus or NGINX Open Source build per F5 article K000162604 and restart the service; the record names no fixed version, so read it from the advisory. Two mitigations stand alone: rebuild or relink against an OpenSSL newer than 3.5.0, or disable HTTP/3 (listen ... quic) on the affected listeners, which clients fall back from to HTTP/2. This is a proxy-tier rolling restart, not a node drain. F5 notes versions past end of technical support were not evaluated.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-90439 https://my.f5.com/manage/s/article/K000162604

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.