CVE-2026-33029 MEDIUM

CVE-2026-33029: Nginx UI: DoS via Negative Integer Input in Logrotate Interval

Vendor 0Xjacky

Product nginx-ui

Weakness CWE-20 · Input validation

Published March 30, 2026

Last update April 1, 2026

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

Description

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, an input validation vulnerability in the logrotate configuration allows an authenticated user to cause a complete Denial of Service (DoS). By submitting a negative integer for the rotation interval, the backend enters an infinite loop or an invalid state, rendering the web interface unresponsive. This issue has been patched in version 2.3.4.

Key dates

Disclosure timeline

March 30, 2026 CVE published

April 1, 2026 Record updated