High severity8.1NVD Advisory· Published May 22, 2026· Updated Jun 16, 2026

CVE-2026-9256

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

F5, Inc./Nginx Plusllm-fuzzy
osv-coords30 versions
pkg:apk/chainguard/nginx-mainline pkg:apk/chainguard/nginx-stable pkg:apk/wolfi/nginx-mainline pkg:apk/wolfi/nginx-stable pkg:bitnami/nginx pkg:bitnami/nginx-gateway pkg:rpm/almalinux/nginx pkg:rpm/almalinux/nginx-all-modules pkg:rpm/almalinux/nginx-core pkg:rpm/almalinux/nginx-filesystem pkg:rpm/almalinux/nginx-mod-devel pkg:rpm/almalinux/nginx-mod-http-image-filter pkg:rpm/almalinux/nginx-mod-http-perl pkg:rpm/almalinux/nginx-mod-http-xslt-filter pkg:rpm/almalinux/nginx-mod-mail pkg:rpm/almalinux/nginx-mod-stream pkg:rpm/opensuse/nginx&distro=openSUSE%20Tumbleweed pkg:rpm/suse/nginx&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/nginx&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/nginx&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/nginx&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/nginx&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP7 pkg:rpm/suse/nginx&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/nginx&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/nginx&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS pkg:rpm/suse/nginx&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/nginx&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/nginx&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/nginx&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6 pkg:rpm/suse/nginx&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0
< 1.31.1-r2+ 29 more
- (no CPE)range: < 1.31.1-r2
- (no CPE)range: < 1.30.2-r0
- (no CPE)range: < 1.31.1-r2
- (no CPE)range: < 1.30.2-r0
- (no CPE)range: >= 0.1.17, < 1.24.0
- (no CPE)range: >= 0.1.17, < 2.2.1
- (no CPE)range: < 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1
- (no CPE)range: < 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1
- (no CPE)range: < 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1
- (no CPE)range: < 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1
- (no CPE)range: < 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1
- (no CPE)range: < 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1
- (no CPE)range: < 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1
- (no CPE)range: < 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1
- (no CPE)range: < 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1
- (no CPE)range: < 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1
- (no CPE)range: < 1.31.1-1.1
- (no CPE)range: < 1.21.5-150400.3.20.1
- (no CPE)range: < 1.21.5-150400.3.20.1
- (no CPE)range: < 1.21.5-150400.3.20.1
- (no CPE)range: < 1.21.5-150400.3.20.1
- (no CPE)range: < 1.21.5-150600.10.21.1
- (no CPE)range: < 1.21.5-150400.3.20.1
- (no CPE)range: < 1.21.5-150400.3.20.1
- (no CPE)range: < 1.21.5-150600.10.21.1
- (no CPE)range: < 1.27.2-160000.5.1
- (no CPE)range: < 1.21.5-150400.3.20.1
- (no CPE)range: < 1.21.5-150400.3.20.1
- (no CPE)range: < 1.21.5-150600.10.21.1
- (no CPE)range: < 1.27.2-160000.5.1

Patches

Vulnerability mechanics

References

www.openwall.com/lists/oss-security/2026/05/22/14nvdMailing ListThird Party Advisory
my.f5.com/manage/s/article/K000161377nvdMitigationVendor Advisory

News mentions

⚡ Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets, and Supply Chain Chaos
The Hacker News · May 25, 2026
Nginx-poolslip Vulnerability Enables DoS and Code Execution Attacks — Patch Now!
Cyber Security News · May 23, 2026

Severity

HighCVSS v3.1

8.1/ 10

CVSS v49.2

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector: Network
Complexity: High
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

Probability of exploitation in the next 30 days.

4.26%

VYPR risk score

Composite of severity, exploitation, and reach.

0.53high

cvss	0.526
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

Weaknesses

CWE-122
Heap-based Buffer Overflow

CVE ID

CVE-2026-9256

Credits

"A
"F5 acknowledges Mufeed VH of Winfunc Research, Nebula Security (@nebusecurity), and Vexera AI for bringing this issue to our attention and following the highest standards of coordinated disclosure."
reporter