CVE-2026-33029: 
Nginx UI vulnerability analysis and mitigation

CVE-2026-33029 is an improper input validation vulnerability in nginx-ui that allows an authenticated user to cause a complete Denial of Service (DoS) by submitting a negative integer for the logrotate rotation interval. It affects nginx-ui versions up to and including 2.3.3, with version 2.3.4 containing the fix. The vulnerability was published on March 28, 2026 by researcher "dapickle" and added to the GitHub Advisory Database on March 30, 2026. It carries a CVSS v4 base score of 6.9 (Medium) and a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, nginx-ui Advisory).

The root cause is CWE-20 (Improper Input Validation): the logrotate.interval field in the POST /api/settings API endpoint accepts a signed integer without enforcing a lower-bound check. When a negative value (e.g., -1) is passed, the Go backend's scheduling or rotation-calculation logic enters a non-terminating loop, consuming CPU resources and blocking the web server from processing any further concurrent requests. Exploitation requires only valid authentication credentials and a single crafted HTTP POST request — no special privileges beyond a standard authenticated session are needed. A public proof-of-concept with step-by-step reproduction instructions is included in the security advisory (nginx-ui Advisory).

Successful exploitation results in a complete availability loss of the nginx-ui web interface, as the Go web server becomes unresponsive to all subsequent requests after the malicious payload is processed. There is no confidentiality or integrity impact — the vulnerability is purely a denial-of-service condition. Because nginx-ui is used to manage nginx configurations, a sustained DoS could prevent administrators from modifying or monitoring their nginx deployments, indirectly affecting the availability of services managed through the interface (Github Advisory, nginx-ui Advisory).

A public proof-of-concept is available within the official security advisory, providing concrete reproduction steps including the exact endpoint, HTTP method, and JSON payload required to trigger the DoS (nginx-ui Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.058% (0.08% per GitHub Advisory), placing it in the 24th percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Authenticate: Log in to the nginx-ui dashboard using any valid user account that has access to the settings panel.
2. Prepare the payload: Craft a JSON payload targeting the logrotate.interval field with a negative integer value:

{
  "logrotate": {
    "enabled": true,
    "cmd": "logrotate /etc/logrotate.d/nginx",
    "interval": -1
  }
}

3. Send the request: Submit a POST request to /api/settings with the crafted payload using a tool such as Burp Suite, Postman, or curl, including the authenticated session token or cookie.
4. Observe impact: The Go web server immediately enters a non-terminating loop processing the negative interval value, consuming CPU resources and rendering the nginx-ui web interface unresponsive to all subsequent requests (nginx-ui Advisory).

• Network: Unexpected POST requests to /api/settings from authenticated sessions, particularly with unusual or minimal JSON payloads; sudden cessation of HTTP responses from the nginx-ui service port (default 80/443 or 8080/8443 in Docker deployments).
• Logs: nginx-ui access logs showing a POST to /api/settings immediately followed by no further successful request processing; application logs may show a goroutine or scheduling loop that does not terminate.
• Process: Sustained high CPU utilization by the nginx-ui Go process (nginx-ui binary) without corresponding legitimate workload; the process remains running but unresponsive.
• Availability: The nginx-ui web dashboard becomes completely unreachable for all users following the malicious request, which can serve as a behavioral indicator of exploitation (nginx-ui Advisory).

Upgrade nginx-ui to version 2.3.4 or later, which includes a security patch for this vulnerability along with several other security fixes — the maintainer recommends all users update immediately (nginx-ui v2.3.4 Release). As a temporary workaround prior to patching, restrict access to the /api/settings endpoint via network-level controls (e.g., firewall rules, reverse proxy ACLs) to limit exposure to trusted administrators only. Additionally, implement backend input validation to enforce a positive lower bound on the logrotate.interval parameter and consider rate-limiting POST requests to /api/settings to reduce abuse potential.