High severity · published Jul 10, 2026
CVE-2026-55233
OpenResty: Buffer overflow when writing PROXY protocol v2 header to upstream
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
OpenResty is a high performance web platform. From 1.29.2.1 to before 1.29.2.5, an out-of-bounds write vulnerability exists in the upstream PROXY protocol v2 implementation. When OpenResty is configured to send PROXY protocol version 2 headers to upstream servers, constructing the header in the stream proxy protocol v2 patch can write beyond the bounds of the allocated buffer, causing the worker process to crash and resulting in a denial of service. Only configurations that explicitly enable PROXY protocol v2 for upstream connections are impacted. This issue is fixed in version 1.29.2.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openresty · openresty
>= 1.29.2.1, < 1.29.2.5 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-55233
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-55233
Patch
https://github.com/openresty/openresty/commit/5c56ad2958a2dad8b2cc99f4987b8642cbc647d1
Mitigation
https://github.com/openresty/openresty/security/advisories/GHSA-wx83-v28q-68gx
More from openresty
9.8
CVE-2018-9230
In OpenResty through 1.13.6.1, URI parameters are obtained using the ngx.req.get_uri_args and ngx.req.get_post_args functions that ignore parameters beyond the hundredth one,…
7.7
CVE-2021-23017
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting…
7.5
CVE-2020-11724
An issue was discovered in OpenResty before 1.15.8.4
5.9
CVE-2024-39702
In lj_str_hash.c in OpenResty 1.19.3.1 through 1.25.3.1, the string hashing function (used during string interning) allows HashDoS (Hash Denial of Service) attacks