dos vulnerabilities and fixes

Recent CVEs affecting dos, with upgrade or downgrade steps. 5 tracked.

dos has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-05-13. Highest priority: CVE-2026-42945 (score 68/100).

• CVE-2026-40460 MEDIUM 6.5 UPGRADE UPGRADE When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to
• CVE-2026-40701 MEDIUM 4.8 UPGRADE UPGRADE NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_cl
• CVE-2026-42945 HIGH 8.1 UPGRADE UPGRADE NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module
• CVE-2026-42946 MEDIUM 6.5 UPGRADE UPGRADE A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excess
• CVE-2026-42934 MEDIUM 4.8 UPGRADE UPGRADE NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module

FAQ

How do I fix dos vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is dos being exploited right now?

None of the tracked dos CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which dos CVE should I patch first?

CVE-2026-42945 currently ranks highest (68/100): NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.

RSS feed for dos · ← Back to latest CVEs