Medium severity · published Mar 30, 2026
CVE-2026-33029
Nginx UI: DoS via Negative Integer Input in Logrotate Interval
6.5
CVSS
1%
EPSS
No
On KEV
Description
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, an input validation vulnerability in the logrotate configuration allows an authenticated user to cause a complete Denial of Service (DoS). By submitting a negative integer for the rotation interval, the backend enters an infinite loop or an invalid state, rendering the web interface unresponsive. This issue has been patched in version 2.3.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NG
nginx-ui · 0xJacky
< 2.3.4 · source: vendor
NU
Nginx UI · Nginxui
before 2.3.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33029
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-33029
Product
https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4
Exploit
https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-cp8r-8jvw-v3qg
More from nginx-ui
9.9
CVE-2026-44015
Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services
9.9
CVE-2026-33030
Nginx UI: Unencrypted Storage of DNS API Tokens and ACME Private Keys
9.8
CVE-2026-42238
Unauthenticated Remote Code Execution via Backup Restore in nginx-ui
9.8
CVE-2026-42222
nginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover
9.8
CVE-2026-42221
nginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim