CoreCVE
Back

CRITICAL

NGINX ngx_http_rewrite_module vulnerability

Published May 22, 2026

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

Remediation

Red Hat statement

To exploit this vulnerability, a rewrite directive must be configured with a regex pattern that uses distinct, overlapping PCRE captures and a replacement string referencing multiple such captures, limiting its exposure as this is not the default configuration. This issue allows an attacker to potentially execute arbitrary code or cause a denial of service by forcing the worker process to restart. Default Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability. Due to these reasons, this flaw has been rated with an important severity.

Red Hat mitigation

To mitigate this vulnerability, use named captures instead of unnamed captures in rewrite definitions. For example, the following rewrite directive uses unnamed PCRE capture groups, $1 and $2: ~~~ rewrite ^/users/([0-9]+)/profile/(.*)$ /profile.php?id=$1&tab=$2 last; ~~~ To mitigate this vulnerability for this example, replace $1 and $2 with the appropriate named captures, $user_id and $section: ~~~ rewrite ^/users/(?<user_id>[0-9]+)/profile/(?<section>.*)$ /profile.php?id=$user_id&tab=$section last; ~~~

Weaknesses (1)

CWE-122

References (17)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner f5
Published May 22, 2026
Updated Aug 25, 2026
Reserved May 21, 2026
Link CVE-2026-9256
CISA Vulnrichment
Updated May 22, 2026
NVD
Status Modified
Modified Aug 25, 2026
Link CVE-2026-9256
Red Hat
Severity Important
Public date May 22, 2026
Links CVE-2026-9256 - Bugzilla