NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests.
This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 37
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
F5 Nginx_Open_Source
cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:*
|
0.1.17
|
<= 0.9.7
|
|
F5 Nginx_Open_Source
cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:*
|
1.0.0
|
<= 1.30.1
|
|
F5 Nginx_Open_Source
cpe:2.3:a:f5:nginx_open_source:1.31.0:*:*:*:*:*:*:*
|
— | — |
|
F5 Nginx_Plus
cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:*
|
37.0.0
|
37.0.1.1
|
|
F5 Nginx_Plus
cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:*
|
r32
|
<= r36
|
|
F5 Nginx_Plus
cpe:2.3:a:f5:nginx_plus:*:*:*:*:continuous_releases:*:*:*
|
r33
|
r36
|
|
F5 Nginx_Plus
cpe:2.3:a:f5:nginx_plus:37.0.0.1:*:*:*:long-term_support:*:*:*
|
— | — |
|
F5 Nginx_Plus
cpe:2.3:a:f5:nginx_plus:r32:-:*:*:continuous_releases:*:*:*
|
— | — |
|
F5 Nginx_Plus
cpe:2.3:a:f5:nginx_plus:r32:p1:*:*:continuous_releases:*:*:*
|
— | — |
|
F5 Nginx_Plus
cpe:2.3:a:f5:nginx_plus:r32:p2:*:*:continuous_releases:*:*:*
|
— | — |
|
F5 Nginx_Plus
cpe:2.3:a:f5:nginx_plus:r32:p3:*:*:continuous_releases:*:*:*
|
— | — |
|
F5 Nginx_Plus
cpe:2.3:a:f5:nginx_plus:r32:p4:*:*:continuous_releases:*:*:*
|
— | — |
|
F5 Nginx_Plus
cpe:2.3:a:f5:nginx_plus:r32:p5:*:*:continuous_releases:*:*:*
|
— | — |
|
F5 Nginx_Plus
cpe:2.3:a:f5:nginx_plus:r32:p6:*:*:continuous_releases:*:*:*
|
— | — |
|
F5 Nginx_Plus
cpe:2.3:a:f5:nginx_plus:r36:-:*:*:continuous_releases:*:*:*
|
— | — |
|
F5 Nginx_Plus
cpe:2.3:a:f5:nginx_plus:r36:p1:*:*:continuous_releases:*:*:*
|
— | — |
|
F5 Nginx_Plus
cpe:2.3:a:f5:nginx_plus:r36:p2:*:*:continuous_releases:*:*:*
|
— | — |
|
F5 Nginx_Plus
cpe:2.3:a:f5:nginx_plus:r36:p3:*:*:continuous_releases:*:*:*
|
— | — |
|
F5 Nginx_Plus
cpe:2.3:a:f5:nginx_plus:r36:p4:*:*:continuous_releases:*:*:*
|
— | — |
|
F5 Dos
cpe:2.3:a:f5:dos:*:*:*:*:*:nginx:*:*
|
4.3.0
|
<= 4.7.0
|
|
F5 Dos
cpe:2.3:a:f5:dos:4.9.0:*:*:*:*:nginx:*:*
|
— | — |
|
F5 Nginx_Gateway_Fabric
cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*
|
1.3.0
|
<= 1.6.2
|
|
F5 Nginx_Gateway_Fabric
cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*
|
2.0.0
|
2.6.2
|
|
F5 Nginx_Ingress_Controller
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:continuous_releases:*:*:*
|
3.5.0
|
<= 3.7.2
|
|
F5 Nginx_Ingress_Controller
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:continuous_releases:*:*:*
|
4.0.0
|
<= 4.0.1
|
|
F5 Nginx_Ingress_Controller
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:continuous_releases:*:*:*
|
5.0.0
|
5.4.3
|
|
F5 Nginx_Instance_Manager
cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:*
|
2.17.0
|
2.22.1
|
|
F5 Waf
cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:*
|
4.10.0
|
<= 4.16.0
|
|
F5 Waf
cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:*
|
5.2.0
|
<= 5.8.0
|
|
F5 Waf
cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:*
|
5.9.0
|
<= 5.13.0
|
|
Redhat Discovery
cpe:2.3:a:redhat:discovery:-:*:*:*:*:*:*:*
|
— | — |
|
Redhat Hardened_Images
cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*
|
— | — |
|
Redhat Update_Infrastructure
cpe:2.3:a:redhat:update_infrastructure:*:*:*:*:*:*:*:*
|
5.0
|
5.2
|
|
Debian Debian_Linux
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
|
— | — |
|
Redhat Enterprise_Linux
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
|
— | — |
|
Redhat Enterprise_Linux
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
|
— | — |
|
Redhat Enterprise_Linux
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
|
— | — |
References 14
https://my.f5.com/manage/s/article/K000161377
f5sirt@f5.com
http://www.openwall.com/lists/oss-security/2026/05/22/14
af854a3a-2127-422b-91ae-364da2661108
https://lists.debian.org/debian-lts-announce/2026/06/msg00023.html
af854a3a-2127-422b-91ae-364da2661108
https://access.redhat.com/errata/RHSA-2026:20351
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://access.redhat.com/errata/RHSA-2026:28212
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://access.redhat.com/errata/RHSA-2026:28921
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://access.redhat.com/errata/RHSA-2026:28973
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://access.redhat.com/errata/RHSA-2026:29151
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://access.redhat.com/errata/RHSA-2026:29874
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://access.redhat.com/errata/RHSA-2026:33313
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://access.redhat.com/errata/RHSA-2026:44481
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://access.redhat.com/security/cve/CVE-2026-9256
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://bugzilla.redhat.com/show_bug.cgi?id=2480746
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9256.json
0b0ca135-0b70-47e7-9f44-1890c2a1c46c