Skip to main content

NGINX EUVDEUVD-2026-31444

| CVE-2026-9256 CRITICAL
Heap-based Buffer Overflow (CWE-122)
2026-05-22 f5 GHSA-h78r-86c6-jgp4
Buffer Overflow Heap Overflow Nginx Nginx Open Source Nginx Plus F5
9.2
CVSS 4.0 · Vendor: f5
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify NGINX endpoint with vulnerable rewrite rule
  2. Delivery
    Craft HTTP request matching overlapping-capture pattern
  3. Exploit
    Trigger heap overflow in ngx_http_rewrite_module
  4. Execution
    Corrupt worker process heap
  5. Persist
    Crash worker (DoS) or hijack control flow
  6. Impact
    Execute code in worker context when ASLR absent

Vulnerability Assessment

Weakness
CWE
CWE-122
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the target NGINX configuration to contain a rewrite directive whose PCRE pattern uses distinct overlapping captures (e.g., ^/((.*))$) and whose replacement string references multiple such captures (e.g., $1$2) within a redirect or arguments context - this is a non-default configuration choice that the attacker cannot influence, which is precisely why the CVSS 4.0 vector carries AC:H and AT:P. No authentication or user interaction is required (PR:N/UI:N), and the attack is delivered over the network as ordinary HTTP. Reliable arbitrary code execution further depends on ASLR being disabled on the host or the attacker possessing a separate means to bypass it; without that, impact is limited to worker process crash/restart.
Impact

Signals point in conflicting directions and require careful interpretation. The CVSS 4.0 vector AV:N/AC:H/AT:P/PR:N/UI:N with VC/VI/VA:H produces a 9.2 score, but AC:H plus AT:P signals significant attack-requirement preconditions - notably the vendor's own wording that exploitation requires 'conditions beyond their control,' i.e., a specific vulnerable rewrite-directive configuration. SSVC reinforces this with Exploitation:none and Automatable:no, while EPSS sits at 0.15% (35th percentile) and the CVE is not in CISA KEV, so widespread or automated abuse is not currently observed. Counterbalancing factors: publicly available exploit code exists (GitHub PoC), the worker-crash path is reliably reachable to cause DoS, and code execution is feasible where ASLR is disabled or bypassable - making this a credible targeted-threat issue rather than mass-exploitation risk. Prioritize for internet-facing NGINX deployments that use complex rewrite rules; deprioritize relative to KEV-listed flaws on otherwise hardened fleets.
Exploit ScenarioDerived

An attacker enumerates an internet-facing NGINX server, identifies (via the published PoC at github.com/friparia/NGINX_RIFT_SCAN_CVE_2026_42945) a URI path handled by a vulnerable rewrite directive with overlapping captures, and issues a crafted HTTP request whose path triggers the heap overflow during replacement-string construction. The simplest outcome is repeated worker-process crashes producing intermittent denial of service; on hosts with ASLR disabled or where the attacker has chained an info-leak, the same primitive yields arbitrary code execution in the worker context.
Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jun 16, 2026

Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module can be triggered by unauthenticated remote attackers sending crafted HTTP requests that target rewrite directives using overlapping PCRE captures (e.g., $1$2 referencing ^/((.*))$) in redirect or arguments contexts. Impact ranges from worker process crash/restart to arbitrary code execution where ASLR is disabled or bypassed; publicly available exploit code exists, though EPSS exploitation probability is low (0.15%, 35th percentile) and the issue is not in CISA KEV.

Earlier versions of this analysis (2)
v2 Jun 16, 2026 - 20:12 cvss changed CVSS 9.2

Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows remote unauthenticated attackers to crash worker processes and, when ASLR is disabled or bypassed, achieve code execution by sending crafted HTTP requests against configurations using overlapping PCRE captures in rewrite directives. Publicly available exploit code exists but EPSS is low (0.15%) and SSVC reports no observed exploitation, indicating the bug is realistically constrained by the non-default config pattern and 'conditions beyond the attacker's control' noted by F5.

v1 May 22, 2026 - 14:45 CVSS 8.1

Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows unauthenticated remote attackers to crash worker processes and potentially achieve code execution via crafted HTTP requests targeting servers using rewrite directives with overlapping PCRE captures. The flaw affects a core HTTP module shipped in default builds, making widespread exposure plausible wherever vulnerable rewrite rules are configured, though exploitation requires specific configuration prerequisites and ASLR bypass for full RCE. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

RemediationAI

Vendor-released patches available: upgrade NGINX Open Source to 1.30.2 or 1.31.1 (or newer), NGINX Plus to R32 P7, R36 P5, or 37.0.1.1 per F5 advisory https://my.f5.com/manage/s/article/K000161377; Ubuntu users should apply USN-8354-1 (https://ubuntu.com/security/notices/USN-8354-1). If patching must be deferred, audit nginx.conf and included files for rewrite directives that combine PCRE patterns containing overlapping captures (e.g., ^/((.*))$) with replacement strings referencing multiple captures (e.g., $1$2) inside redirect or args contexts, and rewrite them to use a single non-overlapping capture group - this fully removes the trigger but may require URL-handling logic changes. As an interim control, place a WAF rule in front of NGINX to block requests targeting the specific URI paths handled by vulnerable rewrite rules; ensure ASLR remains enabled on the host to keep impact bounded to worker restart rather than code execution, accepting that repeated crashes still degrade availability.

Affected VersionsENISA

NGINX Open Source 1.30.0 <1.30.2
NGINX Open Source 0.1.17 <*
NGINX Plus R32 <R32 P7
NGINX Plus 37.0 <37.0.1.1
NGINX Plus R36 <R36 P5
NGINX Open Source 1.31.0 <1.31.1

Affected Packages

euvd nginx_open_source fix: 1.30.2, 1.31.1
euvd nginx_plus fix: 37.0.1.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

NGINX's ngx_http_rewrite_module compiles PCRE patterns from rewrite directives and performs variable substitution against captured groups. CWE-122 (Heap-based Buffer Overflow) applies here: when a configuration uses distinct yet overlapping captures and the replacement string concatenates multiple capture references in a redirect/args context, NGINX miscomputes the destination buffer size and writes beyond the heap allocation in the worker process. CPE strings (cpe:2.3:a:f5:nginx_plus and cpe:2.3:a:f5:nginx_open_source) confirm both the commercial F5 distribution and the upstream open-source web server/reverse-proxy are affected across multiple branches.

Know when Nginx Plus gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (f5) PRIMARY 9.2 CRITICAL
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
vuln.today AI 8.1 HIGH

Network-reachable HTTP request with no auth or interaction, but AC:H because exploitation requires a non-default vulnerable rewrite configuration and ASLR-bypass for code execution; full CIA impact on the worker.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat 8.1 HIGH

Primary rating from Vendor (f5).

CVSS VectorVendor: f5

Attack Vector
Network
Attack Complexity
High
Attack Requirements
Present
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
High
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

5
Analysis Updated
Jun 16, 2026 - 20:13 vuln.today
v3 - CVSS changed
Analysis Updated
Jun 16, 2026 - 20:12 vuln.today
v2 - CVSS changed
Severity Changed
Jun 16, 2026 - 20:07 NVD
HIGH CRITICAL
CVSS changed
Jun 16, 2026 - 20:07 NVD
8.1 (HIGH) 9.2 (CRITICAL)
Patch available
May 26, 2026 - 14:16 EUVD

DescriptionCVE.org

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Articles & Coverage 1

POC NGINX Rift: Heap Buffer Overflow in ngx_http_rewrite_module Affects Versions 0.6.27-1.30.1 (CVE-2026-42945, CVE-2026-9256) May 27, 2026

Executive ViewAI

Why It Matters

A critical vulnerability in NGINX web servers (CVE-2026-9256) can be exploited by remote, unauthenticated attackers, threatening application availability and security. Publicly available exploit code exists for this vulnerability; however, actual exploitation probability remains low (0.1% EPSS). Organizations must patch urgently to protect customer-facing services from operational disruption and potential unauthorized access.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.1%
Top 65% exploitable
Exploit
POC
Public exploit code exists
Social Media
7
Sightings
Data Quality
9 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC Yes
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity + public POC available
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

66
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +46
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

More in Nginx Plus

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2026-42945 CRITICAL POC
9.2 May 13

Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows remote attackers to crash worker
CVE-2026-42055 CRITICAL POC
9.2 Jun 17

Heap-based buffer overflow in NGINX Plus and NGINX Open Source affects deployments that proxy HTTP/2 or gRPC traffic ups
CVE-2026-42533 CRITICAL POC
9.2 Jul 15

Heap buffer overflow in NGINX Plus and NGINX Open Source lets unauthenticated remote attackers crash worker processes (D
CVE-2026-93479 CRITICAL POC
9.2 Oct 14

Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by crafted HTTP requests when a non-default ma
CVE-2026-15176 CRITICAL POC
9.2 Oct 14

Heap buffer overflow in NGINX Plus and NGINX Open Source can be triggered by unauthenticated remote attackers through cr
CVE-2026-97205 CRITICAL POC
9.2 Oct 14

Unauthenticated remote attackers can trigger a use-after-free in NGINX's ngx_http_core_module when asynchronous file I/O
CVE-2026-60005 HIGH
8.8 Jul 15

Limited memory disclosure and worker-process restart in NGINX Plus and NGINX Open Source arise when the optional ngx_htt
CVE-2026-27654 HIGH POC
8.8 Mar 24

Buffer overflow in NGINX's DAV module allows remote attackers to crash worker processes or manipulate file names outside
CVE-2026-27651 HIGH
8.7 Mar 24

NGINX worker process crashes via null pointer dereference in the mail authentication module when CRAM-MD5 or APOP authen
CVE-2024-39792 HIGH
8.7 Aug 14

When the NGINX Plus is configured to use the MQTT pre-read module, undisclosed requests can cause an increase in memory

CVE-2026-32647 HIGH
8.5 Mar 24

NGINX Open Source and NGINX Plus contain a buffer over-read or over-write vulnerability in the ngx_http_mp4_module that

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2026-94127 CRITICAL POC
9.3
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 Fixed
SUSE Linux Enterprise Server 16.1 Fixed

References

Advisories & patches
ADVISORY http://www.openwall.com/lists/oss-security/2026/05/22/14 ADVISORY https://my.f5.com/manage/s/article/K000161377 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-9256 ADVISORY https://ubuntu.com/security/notices/USN-8354-1 ADVISORY https://vuldb.com/vuln/365202 REF https://access.redhat.com/errata/RHSA-2026:20351 REF https://access.redhat.com/errata/RHSA-2026:28212 REF https://access.redhat.com/errata/RHSA-2026:28921 REF https://access.redhat.com/errata/RHSA-2026:28973 REF https://access.redhat.com/errata/RHSA-2026:29151 REF https://access.redhat.com/errata/RHSA-2026:29874 REF https://access.redhat.com/errata/RHSA-2026:33313 REF https://access.redhat.com/errata/RHSA-2026:44481 REF https://access.redhat.com/errata/RHSA-2026:58981 REF https://access.redhat.com/security/cve/CVE-2026-9256 REF https://bugzilla.redhat.com/show_bug.cgi?id=2480746 REF https://lists.debian.org/debian-lts-announce/2026/06/msg00023.html REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9256.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy