CVE intelligence

CVE-2026-60005

Vulnerability intelligence

Published Jul 15, 2026Sources checked Oct 28, 2026

8.2HIGHCVSS out of 10

What this means

Review the available evidence

CVE-2026-60005 and is rated High severity with a CVSS score of 8.2. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Ubuntu Security Notices guidance

Vendor revision: Sep 14, 2026

USN-8563-1 fixed vulnerabilities in nginx.

Ubuntu Security Notices guidance

Vendor revision: Aug 19, 2026

USN-8563-3 fixed a vulnerability in nginx.

Ubuntu Security Notices guidance

Vendor revision: Aug 19, 2026

USN-8563-1 fixed vulnerabilities in nginx.

CISA KEVNot listedBased on the latest collected catalog

EPSS0.5%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-60005?

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart.

Impact: This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only.

Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Source: NVD