CVE-2026-33029 Nginx UI: DoS via Negative Integer Input in Logrotate Interval

What is CVE-2026-33029?

CVE-2026-33029 is a medium-severity denial of service vulnerability in 0xJacky nginx-ui, published on 30 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, an input validation vulnerability in the logrotate configuration allows an authenticated user to cause a complete Denial of Service (DoS). By submitting a negative integer for the rotation interval, the backend enters an infinite loop or an invalid state, rendering the web interface unresponsive. This issue has been patched in version 2.3.4.

Weakness: CWE-20

Which versions are affected by CVE-2026-33029?

3 open source packages ship an affected version, including github.com/0xJacky/Nginx-UI. It affects 1 product.

Products include Nginxui Nginx Ui.

How do I fix CVE-2026-33029?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-33029 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33029 exists.

Other vulnerabilities in 0xJacky nginx-ui

• CVE-2026-33032 Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover Critical 9.8
• CVE-2026-27944 Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure Critical 9.8
• CVE-2024-23827 Nginx-UI arbitrary file write through the Import Certificate feature Critical 9.8
• CVE-2026-107806 Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite Critical 9.4
• CVE-2026-33026 nginx-ui Backup Restore Allows Tampering with Encrypted Backups Critical 9.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cp8r-8jvw-v3qg, GO-2026-4902.