What is the CVSS score of CVE-2026-55233?

CVE-2026-55233 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Openresty are affected by CVE-2026-55233?

OpenResty instances (1.29.2.1-1.29.2.4) with PROXY protocol v2 enabled are vulnerable to denial of service attacks that disable worker processes and disrupt service availability.. A patch is available.

How to fix or mitigate CVE-2026-55233?

Within 24 hours: Inventory OpenResty deployments and identify which have PROXY protocol v2 enabled for upstream connections. Within 7 days: Upgrade affected systems to OpenResty 1.29.2.5. Within 30 days: Verify all OpenResty instances running versions 1.29.2.1-1.29.2.4 have been upgraded and none remain in production.

Openresty CVE-2026-55233

EUVD-2026-43013 HIGH

Out-of-bounds Write (CWE-787)

2026-07-10 GitHub_M

Memory Corruption Denial Of Service Buffer Overflow Openresty

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jul 10, 2026 - 22:02 EUVD

Analysis Generated

Jul 10, 2026 - 21:16 vuln.today

DescriptionCVE.org

OpenResty is a high performance web platform. From 1.29.2.1 to before 1.29.2.5, an out-of-bounds write vulnerability exists in the upstream PROXY protocol v2 implementation. When OpenResty is configured to send PROXY protocol version 2 headers to upstream servers, constructing the header in the stream proxy protocol v2 patch can write beyond the bounds of the allocated buffer, causing the worker process to crash and resulting in a denial of service. Only configurations that explicitly enable PROXY protocol v2 for upstream connections are impacted. This issue is fixed in version 1.29.2.5.

AnalysisAI

Denial of service in OpenResty 1.29.2.1 through 1.29.2.4 arises from an out-of-bounds write (CWE-787) in the upstream PROXY protocol v2 implementation; when the platform is configured to prepend PROXY protocol v2 headers to upstream connections, header construction in the stream proxy-protocol-v2 patch overruns its allocated buffer and crashes the worker process. Any environment that has explicitly enabled PROXY protocol v2 for upstream connections is affected, degrading availability without any impact to confidentiality or integrity. There is no public exploit identified at time of analysis and the issue is not on CISA KEV; it is resolved in OpenResty 1.29.2.5.