Nginx Ingress Controller

Vendor:

First CVE: Apr 21, 2022 · Active for 4 years

20

Total CVEs

More Total CVEs than 94% of tracked products

4.0

Avg CVEs / Year

Higher CVE frequency than 83% of tracked products

6.8

Avg CVSS

Higher Avg CVSS than 36% of tracked products

5.0%

KEV Rate

Higher KEV Rate than 97% of tracked products

Trends Over Time

The number and severity of CVEs published that impact Nginx Ingress Controller over time

Volume of CVEsAvg CVSS Base Score

First CVE

Apr 21, 2022

4 years ago

Most Recent CVE

Jul 15, 2026

9 days ago

CVE Severity & Scoring

Nginx Ingress Controller20 CVEs

50%

All CVEs352,294 CVEs

45%

40%

11%

MediumHigh

Attack Vector

Local3 (15.0%)

Network17 (85.0%)

Unknown0 (0.0%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low11 (55.0%)

High9 (45.0%)

Unknown0 (0.0%)

User Interaction

None19 (95.0%)

Unknown0 (0.0%)

Required1 (5.0%)

Privileges Required

Low8 (40.0%)

High0 (0.0%)

None12 (60.0%)

Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (20 CVEs).

20 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2023-44487HIGH The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through	Oct 10, 2023	7.5	97	YES	YES
CVE-2026-42945HIGH NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or s	May 13, 2026	8.1	79	NO	NO
CVE-2026-42530HIGH NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along	Jun 17, 2026	8.1	44	NO	NO
CVE-2026-42055HIGH NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_proxy_v2_module and ngx_http_grpc_module modules. This vulnerability exists when the proxy_http_version to 2 o	Jun 17, 2026	8.1	43	NO	NO
CVE-2026-55723HIGH When NGINX Ingress Controller is configured with Custom Resource Definitions (CRDs) or Ingress annotations, an injection vulnerability exists in the configuration generator of NGIN	Jul 15, 2026	8.3	38	NO	NO
CVE-2026-52865MEDIUM When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with permission to create or modify Ingress or TransportServer resou	Jul 15, 2026	6.5	31	NO	NO
CVE-2026-42946HIGH A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi	May 13, 2026	7.4	31	NO	NO
CVE-2026-40460MEDIUM When NGINX Plus or NGINX Open Source are configured to use the HTTP/3 QUIC module, an attacker may be able to spoof their source IP address allowing for bypass of authorization or	May 13, 2026	6.5	30	NO	NO
CVE-2026-40701MEDIUM NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_ssl_module module when the ssl_verify_client directive is set to "on" or "optional," and the ssl_ocsp directiv	May 13, 2026	4.8	28	NO	NO
CVE-2025-14727HIGH A vulnerability exists in NGINX Ingress Controller's nginx.org/rewrite-target annotation validation. Note: Software versions which have reached End of Technical Support (EoTS) a	Dec 17, 2025	8.3	28	NO	NO

View all 20 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (20 CVEs).

CISA KEV

1 CVE

5.0% of CVEs· 97th percentile

Metasploit

0 CVEs

0.0% of CVEs· Bottom 1%

Nuclei

0 CVEs

0.0% of CVEs· Bottom 1%

ExploitDB

1 CVE

5.0% of CVEs· 88th percentile

Social Chatter

Signals from CVEs in this product scope (20 CVEs).

Media Mentions

Signals from CVEs in this product scope (20 CVEs).

Top CNAs Publishing CVEs For Nginx Ingress Controller

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS
5.3.0	1	8.3	0.4%
4.0.1	2	8.1	3.4%
4.0.0	2	8.1	3.4%