CVE-2026-9256 NGINX ngx_http_rewrite_module vulnerability
An unauthenticated attacker can trigger a heap buffer overflow in NGINX via crafted requests, causing a restart or potentially executing code if ASLR is disabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-9256?
CVE-2026-9256 is a critical memory corruption vulnerability in Debian Debian Linux, published on 22 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Weakness: CWE-122
Which versions are affected by CVE-2026-9256?
2 open source packages ship an affected version, including nginx and nginx-gateway. It affects 12 products.
| Package | Affected | Fixed in |
|---|---|---|
nginx Bitnami | From 0.1.17 | 1.24.0, 1.30.2, 1.31.1 |
nginx-gateway Bitnami | From 0.1.17 | 2.2.1 |
Linux distribution packages (38)
nginx AlmaLinux:10 | All versions | 2:1.26.3-6.el10_2.4 |
nginx-all-modules AlmaLinux:10 | All versions | 2:1.26.3-6.el10_2.4 |
nginx-core AlmaLinux:10 | All versions | 2:1.26.3-6.el10_2.4 |
nginx-filesystem AlmaLinux:10 | All versions | 2:1.26.3-6.el10_2.4 |
nginx-mod-devel AlmaLinux:10 | All versions | 2:1.26.3-6.el10_2.4 |
nginx-mod-http-image-filter AlmaLinux:10 | All versions | 2:1.26.3-6.el10_2.4 |
nginx-mod-http-perl AlmaLinux:10 | All versions | 2:1.26.3-6.el10_2.4 |
nginx-mod-http-xslt-filter AlmaLinux:10 | All versions | 2:1.26.3-6.el10_2.4 |
nginx-mod-mail AlmaLinux:10 | All versions | 2:1.26.3-6.el10_2.4 |
nginx-mod-stream AlmaLinux:10 | All versions | 2:1.26.3-6.el10_2.4 |
nginx AlmaLinux:8 | All versions | 1:1.24.0-3.module_el8.10.0+4200+fea3b4c7.2.alma.1 |
nginx-all-modules AlmaLinux:8 | All versions | 1:1.24.0-3.module_el8.10.0+4200+fea3b4c7.2.alma.1 |
nginx-filesystem AlmaLinux:8 | All versions | 1:1.24.0-3.module_el8.10.0+4200+fea3b4c7.2.alma.1 |
nginx-mod-devel AlmaLinux:8 | All versions | 1:1.24.0-3.module_el8.10.0+4200+fea3b4c7.2.alma.1 |
nginx-mod-http-image-filter AlmaLinux:8 | All versions | 1:1.24.0-3.module_el8.10.0+4200+fea3b4c7.2.alma.1 |
nginx-mod-http-perl AlmaLinux:8 | All versions | 1:1.24.0-3.module_el8.10.0+4200+fea3b4c7.2.alma.1 |
nginx-mod-http-xslt-filter AlmaLinux:8 | All versions | 1:1.24.0-3.module_el8.10.0+4200+fea3b4c7.2.alma.1 |
nginx-mod-mail AlmaLinux:8 | All versions | 1:1.24.0-3.module_el8.10.0+4200+fea3b4c7.2.alma.1 |
nginx-mod-stream AlmaLinux:8 | All versions | 1:1.24.0-3.module_el8.10.0+4200+fea3b4c7.2.alma.1 |
nginx AlmaLinux:9 | All versions | 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1 |
nginx AlmaLinux:9 | All versions | 2:1.20.1-28.el9_8.3.alma.1 |
nginx AlmaLinux:9 | All versions | 2:1.26.3-9.module_el9.8.0+260+95b8e5ed.1 |
nginx-all-modules AlmaLinux:9 | All versions | 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1 |
nginx-all-modules AlmaLinux:9 | All versions | 2:1.20.1-28.el9_8.3.alma.1 |
nginx-all-modules AlmaLinux:9 | All versions | 2:1.26.3-9.module_el9.8.0+260+95b8e5ed.1 |
nginx-core AlmaLinux:9 | All versions | 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1 |
nginx-core AlmaLinux:9 | All versions | 2:1.20.1-28.el9_8.3.alma.1 |
nginx-core AlmaLinux:9 | All versions | 2:1.26.3-9.module_el9.8.0+260+95b8e5ed.1 |
nginx-filesystem AlmaLinux:9 | All versions | 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1 |
nginx-filesystem AlmaLinux:9 | All versions | 2:1.20.1-28.el9_8.3.alma.1 |
nginx-filesystem AlmaLinux:9 | All versions | 2:1.26.3-9.module_el9.8.0+260+95b8e5ed.1 |
nginx-mod-devel AlmaLinux:9 | All versions | 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1 |
nginx-mod-devel AlmaLinux:9 | All versions | 2:1.20.1-28.el9_8.3.alma.1 |
nginx-mod-devel AlmaLinux:9 | All versions | 2:1.26.3-9.module_el9.8.0+260+95b8e5ed.1 |
nginx-mod-http-image-filter AlmaLinux:9 | All versions | 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1 |
nginx-mod-http-image-filter AlmaLinux:9 | All versions | 2:1.20.1-28.el9_8.3.alma.1 |
nginx-mod-http-image-filter AlmaLinux:9 | All versions | 2:1.26.3-9.module_el9.8.0+260+95b8e5ed.1 |
nginx-mod-http-perl AlmaLinux:9 | All versions | 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1 |
Products include Debian Debian Linux, F5 Dos, F5 Nginx Gateway Fabric, F5 Nginx Ingress Controller, F5 Nginx Instance Manager, F5 Nginx Open Source and 6 more.
How do I fix CVE-2026-9256?
Upgrade nginx to a fixed version for your release line: 1.24.0, 1.30.2 or 1.31.1.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-9256 being exploited?
There is no known exploitation of CVE-2026-9256 in the wild and no public exploit code.
Public exploit code: 4 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2026-9256, ALSA-2026:28212, ALSA-2026:28921, ALSA-2026:28973, ALSA-2026:29151, ALSA-2026:29874 and 39 more.