CRITICAL🇵🇱 Wersja polska

CVE-2026-9256

CVSS 9.2v4.0pub. 2026-05-22upd. 2026-08-25

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

The vulnerability is triggered when a rewrite directive uses a regex pattern containing overlapping PCRE capture groups (e.g., ^/((.*))$), and the replacement string references multiple such groups simultaneously (e.g., $1$2) in a redirect or argument context. An unauthenticated attacker, provided that conditions beyond their control are met (e.g., appropriate server configuration), can send a crafted HTTP request that triggers a heap buffer overflow in the NGINX worker process. This results in worker process restart, and without ASLR or with ASLR bypassed — the possibility of remote code execution (RCE).

Impact

An attacker can cause an NGINX worker process to restart (DoS effect), and in cases where ASLR is disabled or can be bypassed — remote code execution (RCE) on the vulnerable server.

Mitigation & patch

Apply patches available from the vendor according to the references (https://my.f5.com/manage/s/article/K000161377). Additionally, until the fix is deployed, ensure that ASLR is enabled on systems hosting NGINX, and review the configuration of rewrite directives for the use of overlapping PCRE groups with multiple references in replacement strings.

Who is affected

F5 NGINX Plus and F5 NGINX Open Source — versions specified in vendor references (versions under End of Technical Support are not evaluated).

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Debian
OS
Debian
11.0
F5 Dos
APP
F5
4.9.04.3.0 – 4.7.0
F5 nginx Gateway Fabric
APP
F5
2.0.0 – 2.6.2 (excl.)1.3.0 – 1.6.2
F5 nginx Ingress Controller
APP
F5
5.0.0 – 5.4.3 (excl.)4.0.0 – 4.0.13.5.0 – 3.7.2
F5 nginx Instance Manager
APP
F5
2.17.0 – 2.22.1 (excl.)
F5 nginx Open Source
APP
F5
1.31.00.1.17 – 0.9.71.0.0 – 1.30.2 (excl.)
F5 nginx Plus
APP
F5
37.0.0.1r32r36r33 – r36 (excl.)
F5 Waf
APP
F5
4.10.0 – 4.16.05.2.0 – 5.8.05.9.0 – 5.13.0
Red Hat Discovery
APP
Redhat
all versions
Red Hat Enterprise Linux
OS
Redhat
10.08.09.0
Red Hat Hardened Images
APP
Redhat
all versions
Red Hat Update Infrastructure
APP
Redhat
5.0 – 5.2 (excl.)