CVE-2026-9256

EUVD-2026-31444

22.05.2026, 15:16

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.1 HIGH	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 95.22%

Affected Products (NVD)

Vendor	Product	Version
f5	nginx_open_source	0.1.17 ≤ 𝑥 ≤ 0.9.7
f5	nginx_open_source	1.0.0 ≤ 𝑥 < 1.30.2
f5	nginx_open_source	1.31.0
f5	nginx_plus	r33 ≤ 𝑥 < r36
f5	nginx_plus	37.0.0.1
f5	dos	4.3.0 ≤ 𝑥 ≤ 4.7.0
f5	dos	4.9.0
f5	nginx_gateway_fabric	1.3.0 ≤ 𝑥 ≤ 1.6.2
f5	nginx_gateway_fabric	2.0.0 ≤ 𝑥 < 2.6.2
f5	nginx_ingress_controller	3.5.0 ≤ 𝑥 ≤ 3.7.2
f5	nginx_ingress_controller	4.0.0 ≤ 𝑥 ≤ 4.0.1
f5	nginx_ingress_controller	5.0.0 ≤ 𝑥 < 5.4.3
f5	nginx_instance_manager	2.17.0 ≤ 𝑥 < 2.22.1
f5	waf	4.10.0 ≤ 𝑥 ≤ 4.16.0
f5	waf	5.2.0 ≤ 𝑥 ≤ 5.8.0
f5	waf	5.9.0 ≤ 𝑥 ≤ 5.13.0
redhat	discovery	-
redhat	hardened_images	-
redhat	update_infrastructure	5.0 ≤ 𝑥 < 5.2
debian	debian_linux	11.0
redhat	enterprise_linux	8.0
redhat	enterprise_linux	9.0
redhat	enterprise_linux	10.0

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
Red Hat	Red Hat Enterprise Linux 10	2:1.26.3-6.el10_2.4 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 8	8100020260611094050.489197e6 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9	9080020260610161820.9 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9	2:1.20.1-28.el9_8.3 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Enterprise Linux 9	9080020260609152155.9 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Discovery 2	1782756541 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Hardened Images	1.30.2-1.hum1 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Update Infrastructure 5	1784794818 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Update Infrastructure 5	1784794778 ≤ 𝑥 < *	ADP
Red Hat	Red Hat Update Infrastructure 5	1784795076 ≤ 𝑥 < *	ADP

Debian Releases

Debian Product

Codename

nginx

bookworm	1.22.1-9+deb12u9 fixed
bookworm (security)	1.22.1-9+deb12u9 fixed
bullseye	vulnerable
bullseye (security)	1.18.0-6.1+deb11u8 fixed
forky	1.30.4-3 fixed
sid	1.30.4-5 fixed
trixie	1.26.3-3+deb13u7 fixed
trixie (security)	1.26.3-3+deb13u7 fixed

Ubuntu Releases

Ubuntu Product

Codename

nginx

bionic	Fixed 1.14.0-0ubuntu1.11+esm2 released
focal	Fixed 1.18.0-0ubuntu1.7+esm1 released
jammy	Fixed 1.18.0-6ubuntu14.12 released
noble	Fixed 1.24.0-2ubuntu7.9 released
questing	Fixed 1.28.0-6ubuntu1.4 released
resolute	Fixed 1.28.3-2ubuntu1.2 released
trusty	Fixed 1.4.6-1ubuntu3.9+esm6 released
xenial	Fixed 1.10.3-0ubuntu0.16.04.5+esm7 released

openSUSE / SLES Releases

openSUSE Product

Release

nginx

suse enterprise sap 15 SP4	1.21.5-150400.3.20.1 fixed
suse enterprise sap 15 SP5	1.21.5-150400.3.20.1 fixed
suse enterprise sap 15 SP7	1.21.5-150600.10.21.1 fixed
suse enterprise server 15 SP4	1.21.5-150400.3.20.1 fixed
suse enterprise server 15 SP5	1.21.5-150400.3.20.1 fixed
suse enterprise server 15 SP6	1.21.5-150600.10.21.1 fixed
suse enterprise server 15 SP7	1.21.5-150600.10.21.1 fixed

nginx-source

suse enterprise sap 15 SP4	1.21.5-150400.3.20.1 fixed
suse enterprise sap 15 SP5	1.21.5-150400.3.20.1 fixed
suse enterprise sap 15 SP7	1.21.5-150600.10.21.1 fixed
suse enterprise server 15 SP4	1.21.5-150400.3.20.1 fixed
suse enterprise server 15 SP5	1.21.5-150400.3.20.1 fixed
suse enterprise server 15 SP6	1.21.5-150600.10.21.1 fixed
suse enterprise server 15 SP7	1.21.5-150600.10.21.1 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

nginx

RHEL 9

2:1.20.1-28.el9_8.3

fixed

nginx-all-modules

RHEL 9

2:1.20.1-28.el9_8.3

fixed

nginx-core

RHEL 9

2:1.20.1-28.el9_8.3

fixed

nginx-filesystem

RHEL 9

2:1.20.1-28.el9_8.3

fixed

nginx-mod-devel

RHEL 9

2:1.20.1-28.el9_8.3

fixed

nginx-mod-http-image-filter

RHEL 9

2:1.20.1-28.el9_8.3

fixed

nginx-mod-http-perl

RHEL 9

2:1.20.1-28.el9_8.3

fixed

nginx-mod-http-xslt-filter

RHEL 9

2:1.20.1-28.el9_8.3

fixed

nginx-mod-mail

RHEL 9

2:1.20.1-28.el9_8.3

fixed

nginx-mod-stream

RHEL 9

2:1.20.1-28.el9_8.3

fixed

Amazon Linux Releases

Amazon Package

Release

nginx

Amazon Linux 2023

1:1.30.2-1.amzn2023.0.1

fixed

nginx-all-modules

Amazon Linux 2023

1:1.30.2-1.amzn2023.0.1

fixed

nginx-core

Amazon Linux 2023

1:1.30.2-1.amzn2023.0.1

fixed

nginx-core-debuginfo

Amazon Linux 2023

1:1.30.2-1.amzn2023.0.1

fixed

nginx-debuginfo

Amazon Linux 2023

1:1.30.2-1.amzn2023.0.1

fixed

nginx-debugsource

Amazon Linux 2023

1:1.30.2-1.amzn2023.0.1

fixed

nginx-filesystem

Amazon Linux 2023

1:1.30.2-1.amzn2023.0.1

fixed

nginx-mod-devel

Amazon Linux 2023

1:1.30.2-1.amzn2023.0.1

fixed

nginx-mod-http-image-filter

Amazon Linux 2023

1:1.30.2-1.amzn2023.0.1

fixed

nginx-mod-http-image-filter-debuginfo

Amazon Linux 2023

1:1.30.2-1.amzn2023.0.1

fixed

nginx-mod-http-perl

Amazon Linux 2023

1:1.30.2-1.amzn2023.0.1

fixed

nginx-mod-http-perl-debuginfo

Amazon Linux 2023

1:1.30.2-1.amzn2023.0.1

fixed

nginx-mod-http-xslt-filter

Amazon Linux 2023

1:1.30.2-1.amzn2023.0.1

fixed

nginx-mod-http-xslt-filter-debuginfo

Amazon Linux 2023

1:1.30.2-1.amzn2023.0.1

fixed

nginx-mod-mail

Amazon Linux 2023

1:1.30.2-1.amzn2023.0.1

fixed

nginx-mod-mail-debuginfo

Amazon Linux 2023

1:1.30.2-1.amzn2023.0.1

fixed

nginx-mod-stream

Amazon Linux 2023

1:1.30.2-1.amzn2023.0.1

fixed

nginx-mod-stream-debuginfo

Amazon Linux 2023

1:1.30.2-1.amzn2023.0.1

fixed

Azure Linux Releases

Azure Package

Release

nginx

Azure Linux 3.0

0:1.28.3-4.azl3

fixed

Common Weakness Enumeration

CWE-122 - Heap-based Buffer Overflow
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Vulnerability Media Exposure

[GERMAN] Splunk SOAR: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Splunk SOAR ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, und um beliebigen Programmcode auszuführen.
Published: 2026-08-19T22:00:00+00:00

References

https://my.f5.com/manage/s/article/K000161377

http://www.openwall.com/lists/oss-security/2026/05/22/14

https://lists.debian.org/debian-lts-announce/2026/06/msg00023.html

https://access.redhat.com/errata/RHSA-2026:20351

https://access.redhat.com/errata/RHSA-2026:28212

https://access.redhat.com/errata/RHSA-2026:28921

https://access.redhat.com/errata/RHSA-2026:28973

https://access.redhat.com/errata/RHSA-2026:29151

https://access.redhat.com/errata/RHSA-2026:29874

https://access.redhat.com/errata/RHSA-2026:33313

https://access.redhat.com/errata/RHSA-2026:44481

https://access.redhat.com/security/cve/CVE-2026-9256

https://bugzilla.redhat.com/show_bug.cgi?id=2480746

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9256.json