An input validation flaw in Nginx UI's logrotate configuration allows an authenticated user to submit a negative integer for the rotation interval. The backend fails to reject this value and instead enters an infinite loop or reaches an invalid state, causing the web interface to hang and become unresponsive. This results in a denial of service. The weakness maps to CWE‑20, which covers improper input validation.

The vulnerability affects the Nginx UI web interface published by 0xJacky. All releases prior to version 2.3.4 are impacted. Updating to version 2.3.4 or later resolves the flaw.

The CVSS v3.1 score of 6.9 indicates moderate to high severity. Because the flaw requires authenticated access, exploitation is limited to individuals who can log into the UI, such as administrators or compromised accounts. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, suggesting no publicly known exploits yet. Nevertheless, the possibility of a DoS remains significant, warranting prompt patching.