CVE-2026-9256NGINX ngx_http_rewrite_module vulnerability
Updated under an hour ago ()
Does this affect you?
It affects F5 NGINX Plus and 14 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- CVSS
- 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-122
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- f5
- NVD analysis
- Modified
- Record last updated
- Aug 25, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
F5 NGINX Plus f5:nginx_plus (from the name) | from 37.0 before 37.0.1.1; from R36 before R36 P5; from R32 before R32 P7 | CNA record |
F5 NGINX Open Source f5:nginx_open_source (from the name) | from 1.31.0 before 1.31.1; from 1.30.0 before 1.30.2; from 0.1.17 through 0.9.7 | CNA record |
Red Hat Red Hat Enterprise Linux 10 redhat:enterprise_linux | from 2:1.26.3-6.el10_2.4 not affected | CISA ADP |
Red Hat Red Hat Discovery 2 redhat:discovery | from 1782756541 not affected | CISA ADP |
Red Hat Red Hat Hardened Images redhat:hummingbird | from 1.30.2-1.hum1 not affected | CISA ADP |
Red Hat Red Hat Update Infrastructure 5 redhat:rhui | from 1784794818 not affected | CISA ADP |
Red Hat Red Hat Lightspeed proxy 1 redhat:insights_proxy | 1 | CISA ADP |
f5 nginx_open_source f5:nginx_open_source | from 0.1.17 through 0.9.7; from 1.0.0 before 1.30.2; 1.31.0 | NVD |
f5 nginx_plus f5:nginx_plus | from r33 before r36; 37.0.0.1; r32; r32; r32; r32; r32; r32; and 6 more ranges | NVD |
f5 dos f5:dos | from 4.3.0 through 4.7.0; 4.9.0 | NVD |
f5 nginx_gateway_fabric f5:nginx_gateway_fabric | from 1.3.0 through 1.6.2; from 2.0.0 before 2.6.2 | NVD |
f5 nginx_ingress_controller f5:nginx_ingress_controller | from 3.5.0 through 3.7.2; from 4.0.0 through 4.0.1; from 5.0.0 before 5.4.3 | NVD |
f5 nginx_instance_manager f5:nginx_instance_manager | from 2.17.0 before 2.22.1 | NVD |
f5 waf f5:waf | from 4.10.0 through 4.16.0; from 5.2.0 through 5.8.0; from 5.9.0 through 5.13.0 | NVD |
redhat discovery redhat:discovery | all versions | NVD |
redhat hardened_images redhat:hardened_images | all versions | NVD |
redhat update_infrastructure redhat:update_infrastructure | from 5.0 before 5.2 | NVD |
debian debian_linux debian:debian_linux | 11.0 | NVD |
redhat enterprise_linux redhat:enterprise_linux | 8.0; 9.0; 10.0 | NVD |
References
- https://my.f5.com/manage/s/article/K000161377vendor-advisory, mitigation
- http://www.openwall.com/lists/oss-security/2026/05/22/14mailing-list
- https://lists.debian.org/debian-lts-announce/2026/06/msg00023.htmlmailing-list, third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:20351third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:28212third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:28921third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:28973third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:29151third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:29874third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:33313third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:44481third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:58981
- https://access.redhat.com/security/cve/CVE-2026-9256third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2480746issue-tracking, third-party-advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9256.jsonthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.