LiveActive security incident?Get immediate response
CVE Record

CVE-2026-9256: NGINX ngx_http_rewrite_module vulnerability

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CriticalCVSS 9.2Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A specially crafted web request can crash an NGINX worker when a vulnerable rewrite rule combines overlapping regex captures and reuses multiple captures. Under less common conditions—ASLR disabled or bypassed—the flaw may permit code execution. Internet-facing systems with matching configurations deserve urgent review, although exploitation requires specific conditions.

Executive priority

Treat as an urgent, targeted remediation. Immediately identify internet-facing NGINX systems, then prioritize those with the vulnerable rewrite pattern. The 9.2 score and potential code execution justify rapid action, while the configuration and ASLR preconditions make indiscriminate emergency shutdowns unwarranted.

Technical view

CVE-2026-9256 is a CWE-122 heap buffer overflow in ngx_http_rewrite_module. It requires distinct, overlapping PCRE captures and a replacement referencing multiple captures in a redirect or arguments context. Unauthenticated crafted requests can restart a worker; code execution additionally requires disabled or bypassed ASLR. CVSS 4.0 is 9.2.

Likely exposure

Exposure is configuration-dependent, not established by product presence alone. Prioritize internet-facing NGINX Plus and NGINX Open Source instances using rewrite directives with overlapping captures and multiple capture references. The supplied version data is ambiguous, so confirm applicability through F5 or operating-system vendor guidance.

Exploitation context

The bundle does not establish active exploitation, and the CVE is not listed as KEV. Network access and no authentication are required, but attack complexity is high and additional conditions apply. Worker crashes are the clearest expected impact; code execution depends on ASLR being disabled or bypassed.

Researcher notes

The vulnerable path requires overlapping PCRE captures, multiple capture substitutions, and redirect or arguments processing. The public bundle does not provide exploit telemetry or explicit fixed-version details. Avoid inferring exposure solely from the listed versions; validate configuration reachability, package provenance, ASLR posture, and vendor applicability.

Mitigation direction

  • Review F5 advisory K000161377 for applicable fixed releases and configuration guidance.
  • Apply relevant F5 or operating-system vendor security updates after testing.
  • Replace affected rewrite expressions with non-overlapping capture patterns where operationally feasible.
  • Keep ASLR enabled as defense-in-depth; it does not eliminate the crash risk.
  • Restrict unnecessary public access until exposed instances are assessed and remediated.

Validation and detection

  • Inventory NGINX Plus and NGINX Open Source versions on all reachable systems.
  • Search configurations for rewrite directives containing nested or overlapping PCRE capture groups.
  • Identify replacements referencing multiple captures in redirect or arguments contexts.
  • Confirm installed packages against F5, Debian, or Red Hat advisories.
  • Verify ASLR is enabled and investigate unexplained NGINX worker restarts.
  • Retest configuration behavior and service stability after remediation.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-122: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-9256 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.2 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

3CVSS vectors
5Timeline events
3ADP providers
15Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: total

CVSS vector scores

3 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.2CVSS 4.0CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——f5
8.1CVSS 3.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H2.25.9f5
8.1CVSS 3.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H2.25.9redhat-SADP

Vulnerability scoring details

Base CVSS 4.0 score

9.2Critical
CVSS 4.0 vector shape for CVE-2026-9256Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. ADP timelineredhat-SADP

    Made public.

  3. CVE publishedCVE Program

    The CVE record was published.

  4. ADP timelineredhat-SADP

    Reported to Red Hat.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container
redhat-SADPnginx: ngx_http_rewrite_module: code execution and denial of service
other:Red Hat severity ratingcvssV3_1
  • 2026-05-22T15:00:55.131Z: Reported to Red Hat.
  • 2026-05-22T14:11:41.877Z: Made public.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
F5NGINX Plus37.0, R36, R32unknown
F5NGINX Open Source1.31.0, 1.30.0, 0.1.17unaffected
Weakness

CWE details

CWE-122

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-122 · source CWE mapping

Heap-based Buffer Overflow

Heap-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs