CVE-2026-33029

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-33029
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, an input validation vulnerability in the logrotate configuration allows an authenticated user to cause a complete Denial of Service (DoS). By submitting a negative integer for the rotation interval, the backend enters an infinite loop or an invalid state, rendering the web interface unresponsive. This issue has been patched in version 2.3.4.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4 Product Release Notes
https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-cp8r-8jvw-v3qg Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:*
History

02 Apr 2026, 17:10

Type Values Removed Values Added
CPE cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:*
CWE NVD-CWE-noinfo
References () https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4 - () https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4 - Product, Release Notes
References () https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-cp8r-8jvw-v3qg - () https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-cp8r-8jvw-v3qg - Exploit, Vendor Advisory
First Time Nginxui nginx Ui
Nginxui

01 Apr 2026, 19:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

01 Apr 2026, 14:24

Type Values Removed Values Added
Summary
  • (es) Nginx UI es una interfaz de usuario web para el servidor web Nginx. Antes de la versión 2.3.4, una vulnerabilidad de validación de entrada en la configuración de logrotate permite a un usuario autenticado causar una completa denegación de servicio (DoS). Al enviar un número entero negativo para el intervalo de rotación, el backend entra en un bucle infinito o un estado no válido, lo que hace que la interfaz web no responda. Este problema se ha corregido en la versión 2.3.4.

30 Mar 2026, 18:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-30 18:16

Updated : 2026-04-02 17:10

NVD link : CVE-2026-33029

Mitre link : CVE-2026-33029

CVE.ORG link : CVE-2026-33029

JSON object : View

Products Affected

nginxui

  • nginx_ui
CWE
CWE-20

Improper Input Validation

NVD-CWE-noinfo