High severity8.1NVD Advisory· Published May 22, 2026· Updated Aug 11, 2026

CVE-2026-9256

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Red Hat/Discovery
cpe:2.3:a:redhat:discovery:-:*:*:*:*:*:*:*
Red Hat/Hardened Images
cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*
Red Hat/Update Infrastructure
cpe:2.3:a:redhat:update_infrastructure:*:*:*:*:*:*:*:*
Range: >=5.0,<5.2
Debian/linux
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server3 versions
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
osv-coords31 versions
pkg:rpm/suse/nginx&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/nginx&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0 pkg:apk/chainguard/nginx-mainline pkg:apk/chainguard/nginx-stable pkg:apk/wolfi/nginx-mainline pkg:apk/wolfi/nginx-stable pkg:bitnami/nginx pkg:bitnami/nginx-gateway pkg:rpm/suse/nginx&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS pkg:rpm/suse/nginx&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6 pkg:rpm/suse/nginx&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP7 pkg:rpm/suse/nginx&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/nginx&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/nginx&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/nginx&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/nginx&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/nginx&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/nginx&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/nginx&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/opensuse/nginx&distro=openSUSE%20Tumbleweed pkg:rpm/almalinux/nginx-mod-http-image-filter pkg:rpm/almalinux/nginx-mod-http-xslt-filter pkg:rpm/almalinux/nginx-mod-mail pkg:rpm/almalinux/nginx pkg:rpm/almalinux/nginx-all-modules pkg:rpm/almalinux/nginx-core pkg:rpm/almalinux/nginx-filesystem pkg:rpm/almalinux/nginx-mod-devel pkg:rpm/almalinux/nginx-mod-http-perl pkg:rpm/almalinux/nginx-mod-stream pkg:rpm/opensuse/nginx&distro=openSUSE%20Leap%2016.0
< 1.27.2-160000.5.1+ 30 more
- (no CPE)range: < 1.27.2-160000.5.1
- (no CPE)range: < 1.27.2-160000.5.1
- (no CPE)range: < 1.31.1-r0
- (no CPE)range: < 1.30.2-r0
- (no CPE)range: < 1.31.1-r0
- (no CPE)range: < 1.30.2-r0
- (no CPE)range: >= 0.1.17, < 1.24.0
- (no CPE)range: >= 0.1.17, < 2.2.1
- (no CPE)range: < 1.21.5-150600.10.21.1
- (no CPE)range: < 1.21.5-150600.10.21.1
- (no CPE)range: < 1.21.5-150600.10.21.1
- (no CPE)range: < 1.21.5-150400.3.20.1
- (no CPE)range: < 1.21.5-150400.3.20.1
- (no CPE)range: < 1.21.5-150400.3.20.1
- (no CPE)range: < 1.21.5-150400.3.20.1
- (no CPE)range: < 1.21.5-150400.3.20.1
- (no CPE)range: < 1.21.5-150400.3.20.1
- (no CPE)range: < 1.21.5-150400.3.20.1
- (no CPE)range: < 1.21.5-150400.3.20.1
- (no CPE)range: < 1.31.1-1.1
- (no CPE)range: < 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1
- (no CPE)range: < 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1
- (no CPE)range: < 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1
- (no CPE)range: < 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1
- (no CPE)range: < 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1
- (no CPE)range: < 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1
- (no CPE)range: < 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1
- (no CPE)range: < 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1
- (no CPE)range: < 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1
- (no CPE)range: < 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1
- (no CPE)range: < 1.27.2-160000.5.1
Nginx/NGINX Plusllm-fuzzy
Nginx/NGINX Open Sourcellm-fuzzy

Patches

Vulnerability mechanics

References

access.redhat.com/errata/RHSA-2026:20351nvdThird Party Advisory
access.redhat.com/errata/RHSA-2026:28212nvdThird Party Advisory
access.redhat.com/errata/RHSA-2026:28921nvdThird Party Advisory
access.redhat.com/errata/RHSA-2026:28973nvdThird Party Advisory
access.redhat.com/errata/RHSA-2026:29151nvdThird Party Advisory
access.redhat.com/errata/RHSA-2026:29874nvdThird Party Advisory
access.redhat.com/errata/RHSA-2026:33313nvdThird Party Advisory
access.redhat.com/errata/RHSA-2026:44481nvdThird Party Advisory
access.redhat.com/security/cve/CVE-2026-9256nvdThird Party Advisory
bugzilla.redhat.com/show_bug.cginvdIssue TrackingThird Party Advisory
lists.debian.org/debian-lts-announce/2026/06/msg00023.htmlnvdMailing ListThird Party Advisory
my.f5.com/manage/s/article/K000161377nvdMitigationVendor Advisory
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9256.jsonnvdThird Party Advisory
www.openwall.com/lists/oss-security/2026/05/22/14nvdMailing List

News mentions

15-Year-Old NGINX Vulnerability Lets Attackers Crash Workers and Achieve Remote Code Execution
Cyber Security News · Jul 20, 2026
Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution
The Hacker News · Jul 19, 2026
⚡ Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets, and Supply Chain Chaos
The Hacker News · May 25, 2026
Nginx-poolslip Vulnerability Enables DoS and Code Execution Attacks — Patch Now!
Cyber Security News · May 23, 2026

Severity

HighCVSS v3.1

8.1/ 10

CVSS v49.2

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack vector: Network
Complexity: High
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

Probability of exploitation in the next 30 days.

9.96%

VYPR risk score

Composite of severity, exploitation, and reach.

0.53high

cvss	0.526
epss	0.008
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

Weaknesses

CWE-122
Heap-based Buffer Overflow

CVE ID

CVE-2026-9256

Credits

"A
"F5 acknowledges Mufeed VH of Winfunc Research, Nebula Security (@nebusecurity), and Vexera AI for bringing this issue to our attention and following the highest standards of coordinated disclosure."
reporter