CVE-2026-107805

{
  "etk_id": "ETK-2026-1082",
  "cve_id": "CVE-2026-107805",
  "display_id": "CVE-2026-107805",
  "ghsa_id": "GHSA-j3hg-9rp3-5hw9",
  "euvd_id": "EUVD-2026-95818",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated resource exhaustion in nginx-ui signature handling",
  "summary": "nginx-ui versions 2.5.0 through versions before 2.6.0 can consume temporary storage, disk I/O, and request-processing capacity while handling signed API requests. An unauthenticated remote client can trigger this behavior if it can reach the API and submit syntactically valid signature metadata, potentially reducing service availability.",
  "mitigation": "Upgrade nginx-ui to version 2.6.0 or later. Restrict access to the affected API to trusted clients until the update is applied.",
  "vendor": "0xJacky",
  "product": "nginx-ui",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.5.0, < 2.6.0"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        ">= 2.6.0"
      ],
      "package_name": "github.com/0xJacky/Nginx-UI",
      "purl": "pkg:golang/github.com/0xJacky/Nginx-UI"
    }
  ],
  "cwes": [
    400
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": 0.0044,
  "epss_percentile": 0.3718,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 34.025222883333335,
  "t0_at": "2026-10-09T14:50:58.011000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-09T16:34:49.051806+00:00",
      "days": 0.07211852784722222,
      "is_lower_bound": false,
      "measured_at": "2026-10-09T14:50:58.011000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-09T14:50:58.011000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-09T14:50:58.011000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107805"
    }
  }
}