CVE-2026-108981: ngx_cache_purge 2.4.0 through 2.5.6, 3.0.0 to before 3.0.4

Affected technology

ngx_cache_purge · 2.4.0 through 2.5.6, 3.0.0 to before 3.0.4
denji

Description’s affected range: before 3.0.4 can

Component: purge_all, partial/wildcard key purge, asynchronous purge queue, vary-aware variant deletion
Function: ngx_http_cache_purge_all, ngx_http_cache_purge_partial, ngx_http_cache_purge_process_queue, ngx_http_cache_purge_delete_variants
File: ngx_cache_purge_module.c

Attack conditions (Vendor/CNA, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.1 assessment (base score 3.6/10) rates confidentiality impact as none; integrity and availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.