LiveActive security incident?Get immediate response
CVE Record

CVE-2026-9256: NGINX ngx_http_rewrite_module vulnerability

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CriticalCVSS 9.2Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A specially crafted web request can crash a vulnerable NGINX worker when a narrowly defined rewrite rule is configured. Repeated crashes could disrupt web services. Code execution may be possible only where ASLR is disabled or bypassed. Exploitation requires the specific rewrite pattern and additional conditions, so exposure is configuration-dependent.

Executive priority

Treat as an urgent, configuration-led investigation. Immediately identify exposed NGINX services and the vulnerable rewrite pattern, then follow vendor remediation guidance. Prioritize confirmed matches because service disruption is remotely triggerable and code execution is conditionally possible. Avoid assuming every NGINX installation is affected.

Technical view

CVE-2026-9256 is a CWE-122 heap buffer overflow in ngx_http_rewrite_module. It occurs when distinct, overlapping PCRE captures are referenced multiple times in a replacement used for redirects or arguments. An unauthenticated remote request may restart the worker. The supplied CVSS 4.0 score is 9.2, with high attack complexity and a required attack condition.

Likely exposure

Highest risk applies to internet-facing NGINX instances using the specified overlapping-capture rewrite construction. The bundle’s version metadata is ambiguous: listed NGINX Plus releases have unknown default status, while listed Open Source releases show unaffected despite the description naming Open Source. Confirm applicability through F5 or distribution guidance.

Exploitation context

The supplied evidence does not establish active exploitation, and the CVE is not listed as KEV in the bundle. Exploitation is remote and unauthenticated but requires a vulnerable rewrite configuration and conditions partly beyond attacker control. Worker crashes are the direct outcome; code execution additionally requires disabled or bypassed ASLR.

Researcher notes

Version applicability cannot be resolved confidently from the supplied structured data because its product descriptions and default statuses conflict. The precise configuration prerequisite materially narrows exposure. Testing should remain controlled and defensive; corroborate affected ranges, fixed releases, and package backports with the cited vendor and distribution sources.

Mitigation direction

  • Review F5 and operating-system vendor advisories for confirmed affected versions and available updates.
  • Prioritize updating confirmed vulnerable, internet-facing NGINX deployments using vendor-supported packages.
  • Identify and revise rewrite rules using overlapping captures referenced multiple times in redirects or arguments.
  • Maintain ASLR and other platform exploit mitigations; do not treat them as substitutes for remediation.
  • Restrict unnecessary public access while affected configurations await vendor-directed remediation.

Validation and detection

  • Inventory NGINX Plus, NGINX Open Source, and distribution-packaged NGINX versions.
  • Search active configuration for rewrite directives containing nested or overlapping capture groups.
  • Check whether replacements reference multiple overlapping captures in redirect or argument contexts.
  • Confirm package status against F5, Debian, Red Hat, or the relevant distribution advisory.
  • Review worker restarts, crashes, and abnormal requests without assuming they prove exploitation.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-122: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-9256 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.2 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

3CVSS vectors
5Timeline events
3ADP providers
14Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: total

CVSS vector scores

3 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.2CVSS 4.0CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——f5
8.1CVSS 3.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H2.25.9f5
8.1CVSS 3.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H2.25.9redhat-SADP

Vulnerability scoring details

Base CVSS 4.0 score

9.2Critical
CVSS 4.0 vector shape for CVE-2026-9256Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. ADP timelineredhat-SADP

    Made public.

  3. CVE publishedCVE Program

    The CVE record was published.

  4. ADP timelineredhat-SADP

    Reported to Red Hat.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container
redhat-SADPnginx: ngx_http_rewrite_module: code execution and denial of service
other:Red Hat severity ratingcvssV3_1
  • 2026-05-22T15:00:55.131Z: Reported to Red Hat.
  • 2026-05-22T14:11:41.877Z: Made public.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
F5NGINX Plus37.0, R36, R32unknown
F5NGINX Open Source1.31.0, 1.30.0, 0.1.17unaffected
Weakness

CWE details

CWE-122

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-122 · source CWE mapping

Heap-based Buffer Overflow

Heap-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs