F5 NGINX Plus - NGINX ngx_http_rewrite_module Vulnerability
Title source: ruleExploitation Summary
EIP tracks 6 public exploits for CVE-2026-9256. PoCs published by friparia, y198nt, 06-ux.
AI-analyzed exploit summary This repository contains a scanner for detecting the CVE-2026-42945 vulnerability in NGINX configurations. It checks for specific rewrite and capture patterns that could lead to a heap buffer overflow.
Description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Exploits (6)
This repository contains a scanner for detecting the CVE-2026-42945 vulnerability in NGINX configurations. It checks for specific rewrite and capture patterns that could lead to a heap buffer overflow.
This repository contains a functional exploit for CVE-2026-9256, demonstrating an ASLR-independent remote code execution (RCE) chain targeting nginx 1.30.0. The exploit combines two vulnerabilities (PoolSlip and rift) to leak libc and heap addresses, then perform a partial overwrite of a cleanup pointer to achieve arbitrary command execution.
This repository contains a functional PoC for CVE-2026-9256, demonstrating a heap buffer overflow in Nginx 1.30.1 via crafted URI paths. The exploit includes heap pointer leakage and crash triggers, with a Docker setup for testing.
This repository contains functional exploit code demonstrating a heap buffer overflow in nginx's ngx_http_rewrite_module (CVE-2026-9256). The PoC includes three stages: heap pointer leak, libc pointer leak, and a DoS crash via controlled overflow.
This repository contains a functional PoC for CVE-2026-9256, a heap buffer overflow in the NGINX ngx_http_rewrite_module. The script sends a crafted request with a large number of '+' characters to trigger the vulnerability and verifies remote worker crashes via connection drops and keepalive probes.
This repository is a comprehensive technical analysis and tracking page for CVE-2026-9256, a heap buffer overflow vulnerability in nginx's ngx_http_rewrite_module. It includes detailed information on affected versions, distribution status, mitigation strategies, and verification steps.
References (2)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H