CVE-2026-9256
published 2026-05-22CVE-2026-9256: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex…
PriorityP261high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
2.70%
85.8th percentile
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected
44 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| f5 | dos | — | — |
| f5 | dos | 4.3.0 – 4.7.0 | — |
| f5 | nginx_gateway_fabric | 1.3.0 – 1.6.2 | — |
| f5 | nginx_gateway_fabric | >= 2.0.0 < 2.6.2 | 2.6.2 |
| f5 | nginx_ingress_controller | 3.5.0 – 3.7.2 | — |
| f5 | nginx_ingress_controller | 4.0.0 – 4.0.1 | — |
| f5 | nginx_ingress_controller | >= 5.0.0 < 5.4.3 | 5.4.3 |
| f5 | nginx_instance_manager | >= 2.17.0 < 2.22.1 | 2.22.1 |
| f5 | nginx_open_source | — | — |
| f5 | nginx_open_source | >= 0.1.17 < * | * |
| f5 | nginx_open_source | 0.1.17 – 0.9.7 | — |
| f5 | nginx_open_source | >= 1.0.0 < 1.30.2 | 1.30.2 |
| f5 | nginx_open_source | >= 1.30.0 < 1.30.2 | 1.30.2 |
| f5 | nginx_open_source | >= 1.31.0 < 1.31.1 | 1.31.1 |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Vulnerability is only exploitable when a rewrite directive uses a regex pattern with distinct, overlapping PCRE captures (e.g., ^/((.*))$) and a replacement string referencing multiple such captures (e.g., $1$2) in a redirect or arguments context — audit nginx configs for this pattern ↗
- →Attack vector is crafted HTTP requests sent by an unauthenticated remote attacker; monitor NGINX worker process for unexpected restarts as a sign of exploitation attempts (heap buffer overflow causes worker restart) ↗
- →Code execution is achievable on systems with ASLR disabled or where ASLR can be bypassed — flag NGINX deployments running without ASLR as higher-risk targets ↗
- →Scan nginx.conf and included config files for rewrite directives combining unnamed overlapping PCRE capture groups with multi-capture replacement strings (e.g., rewrite ^/users/([0-9]+)/profile/(.*)$ /profile.php?id=$1&tab=$2) as the vulnerable configuration pattern ↗
- ·Mitigation (without patching): replace unnamed PCRE capture groups ($1, $2, …) with named captures in all rewrite directives to eliminate the vulnerable code path ↗
- ·On Red Hat systems, default OS mitigations (SELinux, ASLR, NX stack) significantly raise the bar for code execution, reducing practical impact even on vulnerable configurations ↗
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.2CRITICALCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
cvelistv5v3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat8.1HIGH
vendor_ubuntu6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
nginx vulnerabilities
vendor_ubuntu·2026-06-03·CVSS 6.3
CVE-2026-1642 [MEDIUM] nginx vulnerabilities
Title: nginx vulnerabilities
Summary: Several security issues were fixed in nginx.
It was discovered that the nginx ngx_mail_smtp_module module incorrectly
handled certain memory operations when doing SMTP authentication. This
could possibly result in sensitive information being sent to the
authentication server. (CVE-2025-53859)
It was discovered that nginx incorrectly handled proxying to upstream TLS
servers. An attacker could possibly use this issue to insert plain text
data into the response from an upstream proxied server. (CVE-2026-1642)
It was discovered that the nginx ngx_mail_auth_http_module module
incorrectly handled certain requests. An attacker could possibly use this
issue to cause nginx to crash, resulting in a denial of service.
(CVE-2026-27651)
It was discovered that
Ubuntu
nginx vulnerabilities
vendor_ubuntu·2026-06-01·CVSS 6.9
CVE-2026-9256 [MEDIUM] nginx vulnerabilities
Title: nginx vulnerabilities
Summary: Several security issues were fixed in nginx.
It was discovered that nginx did not properly validate source addresses in
the HTTP/3 QUIC module. A remote attacker could possibly use this issue to
bypass authorization checks or rate limiting. This issue only affected
Ubuntu 25.04 and Ubuntu 25.10. (CVE-2026-40460)
It was discovered that nginx contained a use-after-free vulnerability in
the ngx_http_ssl_module module when client certificate verification and
OCSP validation were enabled. A remote attacker could use this issue to
cause nginx to crash, resulting in a denial of service, or possibly modify
data in memory. (CVE-2026-40701)
It was discovered that nginx did not properly handle certain proxied
responses in the ngx_http_charset_module module. A
Red Hat
nginx: ngx_http_rewrite_module: code execution and denial of service
vendor_redhat·2026-05-22·CVSS 8.1
CVE-2026-9256 [HIGH] CWE-122 nginx: ngx_http_rewrite_module: code execution and denial of service
nginx: ngx_http_rewrite_module: code execution and denial of service
A flaw was found in the ngx_http_rewrite_module module of NGINX. When a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures and a replacement string that references multiple such captures in a redirect or arguments context, an unauthenticated attacker can send crafted HTTP requests and cause a heap-based buffer overflow in the worker process, potentially allowing code execution or a denial of service by forcing the process to restart.
Statement: To exploit this vulnerability, a rewrite directive must be configured with a regex pattern that uses distinct, overlapping PCRE captures and a replacement string referencing multiple such captures, limiting its exp
F5
CVE-2026-9256: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module
vendor_f5·2026-05-22·CVSS 8.1
CVE-2026-9256 [HIGH] CWE-122 CVE-2026-9256: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module
CVE-2026-9256: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Ra
GHSA
GHSA-h78r-86c6-jgp4: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module
ghsa_unreviewed·2026-05-26
CVE-2026-9256 [CRITICAL] CWE-122 GHSA-h78r-86c6-jgp4: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Note: Software versions which have reach
VulDB
F5 NGINX Plus/NGINX Open Source prior 37.0.1.1/R32 P7/R36 P5 ngx_http_rewrite_module heap-based overflow (K000161377)
vuldb·2026-05-22
CVE-2026-9256 [CRITICAL] F5 NGINX Plus/NGINX Open Source prior 37.0.1.1/R32 P7/R36 P5 ngx_http_rewrite_module heap-based overflow (K000161377)
A vulnerability marked as critical has been reported in F5 NGINX Plus and NGINX Open Source. Affected by this issue is some unknown functionality of the component ngx_http_rewrite_module. The manipulation leads to heap-based buffer overflow.
This vulnerability is documented as CVE-2026-9256. The attack can be initiated remotely. There is not any exploit available.
It is suggested to upgrade the affected component.
CVEList
NGINX ngx_http_rewrite_module vulnerability
cvelistv5·2026-05-22·CVSS 8.1
CVE-2026-9256 [HIGH] CWE-122 NGINX ngx_http_rewrite_module vulnerability
NGINX ngx_http_rewrite_module vulnerability
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASL
No detection rules found.
No public exploits indexed.
Hackernews
Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution
blogs_hackernews·2026-07-20·CVSS 8.1
CVE-2026-42533 [HIGH] Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution
CVE-2026-42533
Triggering it can crash or restart the worker, causing a denial of service; where ASLR is disabled or can be bypassed, F5 says it may also allow remote code execution.
map
Under that pattern the engine's two-pass evaluation comes apart. The first pass measures how many bytes the result needs and allocates a buffer to fit; the second pass writes the bytes in. Both read the same shared capture state, and evaluating the map's regex in between the two passes overwrites it.
$1
This does not hit every nginx server; exposure depend
Hackernews
⚡ Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets, and Supply Chain Chaos
blogs_hackernews·2026-05-25
CVE-2026-46333 ⚡ Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets, and Supply Chain Chaos
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets, and Supply Chain Chaos
Monday recap. Same mess, new week.
A sketchy dev tool got people pwned, old bugs came back from the dead, and security products somehow needed protecting from themselves. A bunch of companies spent the week checking old boxes and forgotten servers they should've patched years ago. Good times.
Phishing crews are getting smarter too - less obvious scam junk, more targeted stuff that actually looks real. Meanwhile, botnets are grabbing anything exposed to the internet like it's free candy. The Internet's still a dumpster fire.
Let’s get into
Bugzilla
CVE-2026-9256 nginx: code execution and denial of service [fedora-all]
bugzilla·2026-05-25
CVE-2026-9256 [HIGH] CVE-2026-9256 nginx: code execution and denial of service [fedora-all]
CVE-2026-9256 nginx: code execution and denial of service [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-da68d7bf53 (nginx-1.30.2-1.fc44, nginx-mod-brotli-1.0.0~rc-10.fc44, and 6 more) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-da68d7bf53
---
FEDORA-2026-dd9cd16b18 (nginx-1.30.2-1.fc43, nginx-mod-brotli-1.0.0~rc-10.fc43, and 5 more) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-dd9cd16b18
Bugzilla
CVE-2026-9256 nginx: ngx_http_rewrite_module: code execution and denial of service
bugzilla·2026-05-22
CVE-2026-9256 [HIGH] CVE-2026-9256 nginx: ngx_http_rewrite_module: code execution and denial of service
CVE-2026-9256 nginx: ngx_http_rewrite_module: code execution and denial of service
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disab
https://my.f5.com/manage/s/article/K000161377http://www.openwall.com/lists/oss-security/2026/05/22/14https://lists.debian.org/debian-lts-announce/2026/06/msg00023.htmlhttps://access.redhat.com/errata/RHSA-2026:20351https://access.redhat.com/errata/RHSA-2026:28212https://access.redhat.com/errata/RHSA-2026:28921https://access.redhat.com/errata/RHSA-2026:28973https://access.redhat.com/errata/RHSA-2026:29151https://access.redhat.com/errata/RHSA-2026:29874https://access.redhat.com/errata/RHSA-2026:33313https://access.redhat.com/errata/RHSA-2026:44481https://access.redhat.com/errata/RHSA-2026:58981https://access.redhat.com/security/cve/CVE-2026-9256https://bugzilla.redhat.com/show_bug.cgi?id=2480746https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9256.json
2026-05-22
Published