CVE-2026-42055 | CVE-2026-42530 | API Developer Portal Security Vulnerabilities

Products

• CA API Developer Portal

Issue/Introduction

Security vulnerability scans performed on our API Developer Portal environment managed on Docker Swarm have identified the following findings:
CVE-2026-42530
CVE-2026-42055

Could you please confirm whether API Developer Portal 5.3.2 is affected by these vulnerabilities?

Environment

API Developer Portal Version: 5.3.2

Resolution

1. CVE-2026-42055 (HTTP/2 & gRPC Buffer Overflow)
   Status: NOT EXPLOITABLE / NOT VULNERABLE
   Reasoning: Exploitability requires all three non-default conditions in the NGINX configuration:
   proxy_http_version 2 or grpc_pass (We use standard HTTP/1.1 upstreams)
   ignore_invalid_headers off (We use default on)
   large_client_header_buffers allocated > 2 MB (We use standard defaults)
   Action: No action required.
2. CVE-2026-42530 (HTTP/3 Use-After-Free)
   Status: NOT AFFECTED
   Reasoning: Limited strictly to NGINX versions 1.31.0 through 1.31.1 running the HTTP/3 (QUIC) module. Our current software version (1.27.3) falls outside this affected range.
   Action: No action required.

Summary: Both CVEs can be marked as Not Applicable / Mitigated by Configuration in security tracking tools. No emergency patching or configuration changes are needed at this time.