Description
OpenResty is a high performance web platform. From 1.29.2.1 to before 1.29.2.5, an out-of-bounds write vulnerability exists in the upstream PROXY protocol v2 implementation. When OpenResty is configured to send PROXY protocol version 2 headers to upstream servers, constructing the header in the stream proxy protocol v2 patch can write beyond the bounds of the allocated buffer, causing the worker process to crash and resulting in a denial of service. Only configurations that explicitly enable PROXY protocol v2 for upstream connections are impacted. This issue is fixed in version 1.29.2.5.
Published: 2026-07-10
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

OpenResty versions 1.29.2.1 through 1.29.2.4 contain an out‑of‑bounds write when building PROXY protocol v2 headers for upstream connections, which can cause a worker process to crash and trigger a temporary denial of service. This flaw is a classic example of CWE‑787.

Affected Systems

The vulnerability affects OpenResty deployments that are configured to send PROXY protocol v2 headers to upstream servers; any installation running OpenResty between versions 1.29.2.1 and 1.29.2.4 inclusive is impacted. Version 1.29.2.5 and later contain a fix that removes the overflow.

Risk and Exploitability

The CVSS score of 7.5 indicates a serious impact, and the EPSS score of less than 1 % suggests a very low probability of exploitation at present. The vulnerability is not listed in CISA KEV. The likely attack vector is exploitation through externally‑originated requests that trigger OpenResty to construct and send a PROXY protocol v2 header to an upstream server, causing the worker crash. No additional privileges are required beyond the ability to send traffic to the vulnerable instance.

Generated by OpenCVE AI on August 1, 2026 at 12:12 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update OpenResty to v1.29.2.5 or later to apply the bounding check patch
  • Reconfigure upstream connections to disable PROXY protocol v2, eliminating the vulnerable code path
  • Restart or reload worker processes to clear any that may have executed the vulnerable code path
  • Monitor worker processes for crashes that could indicate exploitation attempts

Generated by OpenCVE AI on August 1, 2026 at 12:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 10 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Openresty
Openresty openresty
Vendors & Products Openresty
Openresty openresty

Fri, 10 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
Description OpenResty is a high performance web platform. From 1.29.2.1 to before 1.29.2.5, an out-of-bounds write vulnerability exists in the upstream PROXY protocol v2 implementation. When OpenResty is configured to send PROXY protocol version 2 headers to upstream servers, constructing the header in the stream proxy protocol v2 patch can write beyond the bounds of the allocated buffer, causing the worker process to crash and resulting in a denial of service. Only configurations that explicitly enable PROXY protocol v2 for upstream connections are impacted. This issue is fixed in version 1.29.2.5.
Title OpenResty: Buffer overflow when writing PROXY protocol v2 header to upstream
Weaknesses CWE-787
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Openresty Openresty
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-13T18:10:43.893Z

Reserved: 2026-06-16T16:44:00.623Z

Link: CVE-2026-55233

cve-icon Vulnrichment

Updated: 2026-07-13T18:10:38.903Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-10T21:16:55.760

Modified: 2026-07-14T19:20:51.613

Link: CVE-2026-55233

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T12:15:03Z

Weaknesses