## https://sploitus.com/exploit?id=E06F62BF-FA49-5F5D-A835-777DE385E17D
CVE-2026-42530 โ Safe-Check Scanner
Non-destructive mass scanner for the NGINX HTTP/3 (QUIC) use-after-free
Inventory which of your hosts are exposed โ without ever triggering the bug.
---
## โ ๏ธ Disclaimer
This tool is for **authorized security testing only** โ your own infrastructure, or systems you have explicit written permission to assess. It performs a **read-only fingerprint** and does **not** exploit the vulnerability. You are responsible for staying within scope and complying with applicable law and responsible-disclosure principles. The authors accept no liability for misuse.
---
## ๐ About the vulnerability
**CVE-2026-42530** is a use-after-free (CWE-416) in NGINX's `ngx_http_v3_module`. When NGINX is configured to serve HTTP/3, a remote, unauthenticated attacker can reopen a QPACK encoder stream within a crafted HTTP/3 session, causing a worker process to reference freed memory. The immediate impact is a worker crash / restart (denial of service); on hosts where ASLR is disabled or can be bypassed, it may escalate to remote code execution.
> **Key point:** the flaw is only reachable when **HTTP/3 (QUIC) is enabled** โ it is *not* on by default. Hosts serving only HTTP/1.1 or HTTP/2 over TCP are not affected by this specific vector.
| | |
|---|---|
| **CVE** | CVE-2026-42530 |
| **Component** | `ngx_http_v3_module` (HTTP/3 / QUIC) |
| **Class** | Use-After-Free (CWE-416) |
| **CVSS** | 9.2 (v4) ยท 8.1 (v3.1) |
| **Impact** | Worker crash / DoS, possible RCE without ASLR |
| **Vector** | Network, unauthenticated, no user interaction |
### Affected & fixed versions
| Branch | Status |
|---|---|
| NGINX Open Source **1.31.0 โ 1.31.1** | โ Vulnerable |
| NGINX Open Source **1.31.2+** | โ Fixed |
| NGINX Plus | Apply vendor advisory (R36 P6 / 37.0.2.1) |
---
## โจ What this scanner does
It opens a real HTTP/3 connection, sends a single `HEAD /` request, and reads back the `Server` header. From that it classifies each target โ and crucially, it treats **reachable-but-version-hidden** hosts as *needs manual review* rather than a false "clean", because QUIC being reachable is the precondition for the CVE.
- ๐ก๏ธ **Safe by design** โ only a benign probe; never reopens a QPACK stream, never sends a crafted/malicious session.
- ๐ **Mass scanning** โ feed it a target list from a file or stdin.
- โก **Concurrent** โ async (asyncio) engine handles hundreds of QUIC handshakes in flight with a single, tunable bound.
- ๐ฏ **Actionable classification** โ six clear statuses instead of a bare true/false.
- ๐ฆ **Report-ready output** โ colorized console summary plus CSV / JSON for engagement documentation.
- ๐ฆ **CI-friendly** โ exits non-zero when any host is vulnerable.
### Status meanings
| Status | Meaning |
|---|---|
| `VULNERABLE` | NGINX **1.31.0 / 1.31.1** served over HTTP/3 |
| `HTTP3_VERSION_HIDDEN` | HTTP/3 reachable but `Server` is masked (`server_tokens off`) โ **verify version manually** |
| `LIKELY_PATCHED` | NGINX over HTTP/3, version outside the affected range |
| `NOT_NGINX` | HTTP/3 reachable, but the server isn't NGINX |
| `NO_HTTP3` | No HTTP/3 / QUIC listener reachable (not exposed via this vector) |
| `ERROR` | Probe failed for another reason |
---
## ๐ฆ Installation
Requires **Python 3.11+** (uses `asyncio.timeout`).
```bash
git clone https://github.com/renzi25031469/CVE-2026-42530-scanner.git
cd CVE-2026-42530-scanner
pip install aioquic
```
> Tip: use a virtual environment โ `python3 -m venv .venv && source .venv/bin/activate`.
---
## ๐ Usage
```bash
# Single host
python3 cve-2026-42530-scanner.py example.com
# Many hosts from a file, 100 in parallel, save a CSV
python3 cve-2026-42530-scanner.py -f targets.txt -c 100 --csv results.csv
# Pipe targets from stdin and export JSON
cat hosts.txt | python3 cve-2026-42530-scanner.py -f - --json results.json
# Custom port and timeout
python3 cve-2026-42530-scanner.py target.internal -p 8443 -t 5
```
### Target file format
One host per line. Ports, schemes, paths and comments are handled automatically:
```text
# production edge
edge01.example.com
edge02.example.com:8443
https://api.example.com/
# staging
10.0.5.21
```
### Options
| Flag | Description | Default |
|---|---|---|
| `host` | Single target (positional) | โ |
| `-f, --file` | Target list file (`-` = stdin) | โ |
| `-p, --port` | Default QUIC/UDP port | `443` |
| `-t, --timeout` | Per-host timeout (seconds) | `10` |
| `-c, --concurrency` | Max simultaneous scans | `50` |
| `--csv` | Write results to CSV | โ |
| `--json` | Write results to JSON | โ |
### Sample output
```text
[*] CVE-2026-42530 safe-check โ 4 target(s), concurrency=100, timeout=10s
======================================================================
CVE-2026-42530 SAFE-CHECK RESULTS
======================================================================
[VULNERABLE ] edge01.example.com:443 (Server: nginx/1.31.1)
-> Vulnerable NGINX version over HTTP/3. Upgrade to nginx/1.31.2 or later.
[HTTP3_VERSION_HIDDEN ] api.example.com:443
-> HTTP/3 reachable but Server header is masked. Verify the NGINX version manually.
[LIKELY_PATCHED ] edge02.example.com:8443 (Server: nginx/1.31.2)
[NO_HTTP3 ] 10.0.5.21:443
----------------------------------------------------------------------
Summary: VULNERABLE=1 | HTTP3_VERSION_HIDDEN=1 | LIKELY_PATCHED=1 | NO_HTTP3=1
[!] 1 host(s) appear VULNERABLE. Mitigation: upgrade to nginx/1.31.2 or later,
or remove 'quic' from all 'listen' directives.
======================================================================
```
---
## ๐ฉน Remediation
1. **Patch** โ upgrade NGINX Open Source to **1.31.2+** (or apply the F5 advisory for NGINX Plus).
2. **Temporary mitigation** โ if you can't patch immediately, disable HTTP/3 by removing the `quic` parameter from every `listen` directive and dropping `http3 on;`, then reload NGINX. This removes the vulnerable code path entirely.
3. **Defense in depth** โ keep ASLR enabled (`/proc/sys/kernel/randomize_va_space` = `2`). Treat this as a hardening layer, **not** a substitute for patching.
---
## โ๏ธ A note on concurrency
`aioquic` is asynchronous, so this scanner uses an `asyncio.Semaphore` rather than OS threads. For network-I/O-bound work โ hundreds of QUIC handshakes waiting on the wire โ a single event loop scales further with far less overhead than a thread pool, while giving the same "scan many hosts at once" behavior. Tune the bound with `-c`.
---
## ๐ Credits
- **Original safe-check author:** Ashraf Zaryouh โ [@0xBlackash](https://github.com/0xBlackash) ยท [original repository](https://github.com/0xBlackash/CVE-2026-42530)
- **Adapted & extended by:** **Renzi** โ multi-target file/stdin input, bounded async concurrency for mass scanning, corrected HTTP/3 event handling, structured result classification, and CSV/JSON reporting.
Thanks to the researchers credited in the original disclosure for their coordinated reporting.
---
## ๐ License
Released under the **MIT License**. See [`LICENSE`](LICENSE).
---
Built for defenders and authorized red teams. Scan responsibly. ๐