CVE-2026-9256 for nginx, vulnerability in 'ngx_http_rewrite_module'

Vulnerabilities
,
1

CVSSv3: 8.1

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Patched in the latest main and stable releases, but AFAICT not yet in distribution packages.

In addition, there’s a second vulnerability named ‘nginx-poolslip’, which does not have a patch available yet, and which can bypass ASLR, according to this article, which also contains a link to the original drop on X;

2 Likes
2

Great catch, and thank you so much for the formatting and tagging!

2 Likes
3

Credit to @Emily as well, she posted about the CSN link on Mastodon :grinning_face_with_smiling_eyes:

1 Like
4

Apparently these are two (2) different vulnerabilities; one with a patch in the nginx main and stable branches (CVE-2026-9256), and one labeled ‘nginx-poolslip’ that has yet to be assigned a CVE, and for which a patch is not available.

Will update the post.

5

Fixes are now available for Debian, just started showing up a few hours ago;

nginx (1.26.3-3+deb13u6) trixie-security; urgency=medium

  * Apply both patches to fix CVE-2026-42946. In the previous version,
    only one part of the patch was applied, so the fix was incomplete.
    This really fixes CVE-2026-42946, thanks to charles@debian.org for
    pointing it out.
    * d/p/CVE-2026-42946.patch rename to d/p/CVE-2026-42946.2.patch
    * d/p/CVE-2026-42946.1.patch add
  * backport fix for buffer overflow vulnerability in the
    ngx_http_rewrite_module (CVE-2026-9256) from upstream 1.30.2 nginx.
    * d/p/CVE-2026-9256.patch add
  * backport max_headers directive from upstream nginx. It limits the number
    of request headers accepted from clients. Fixes remote denial-of-service
    exploit.
    And move max_headers from core module to the ngx_http_header_count_module
    to avoid potential ABI breakage and keep all the 3rd party modules
    compatible with the new version of nginx without recompilation.
    A big thanks to Miao Wang for preparing the modification.
    Fixes TEMP-1138794-BADE22.
    * d/p/FIX-HTTP2bomb.patch add

 -- Jan Mojžíš <janmojzis@debian.org>  Fri, 05 Jun 2026 12:22:02 +0000
1 Like