Vulnerability · Published May 22, 2026 · Assigned by f5
CVE-2026-9256NGINX ngx_http_rewrite_module vulnerability
High 8.1
In plain English
A high-severity heap buffer overflow in NGINX Open Source from F5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 10.9% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)10.9%top 4.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | nginx | 2:1.26.3-6.el10_2.4 | ALSA-2026:29874 |
| AlmaLinux:8 | nginx | 1:1.24.0-3.module_el8.10.0+4200+fea3b4c7.2.alma.1 | ALSA-2026:28921 |
| AlmaLinux:9 | nginx | 2:1.20.1-28.el9_8.3.alma.1 | ALSA-2026:28973 |
| AlmaLinux:9 | nginx | 2:1.26.3-9.module_el9.8.0+260+95b8e5ed.1 | ALSA-2026:29151 |
| AlmaLinux:9 | nginx | 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1 | ALSA-2026:28212 |
| AlmaLinux:10 | nginx-all-modules | 2:1.26.3-6.el10_2.4 | ALSA-2026:29874 |
| AlmaLinux:8 | nginx-all-modules | 1:1.24.0-3.module_el8.10.0+4200+fea3b4c7.2.alma.1 | ALSA-2026:28921 |
| AlmaLinux:9 | nginx-all-modules | 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1 | ALSA-2026:28212 |
| AlmaLinux:9 | nginx-all-modules | 2:1.26.3-9.module_el9.8.0+260+95b8e5ed.1 | ALSA-2026:29151 |
| AlmaLinux:9 | nginx-all-modules | 2:1.20.1-28.el9_8.3.alma.1 | ALSA-2026:28973 |
| AlmaLinux:10 | nginx-core | 2:1.26.3-6.el10_2.4 | ALSA-2026:29874 |
| AlmaLinux:9 | nginx-core | 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1 | ALSA-2026:28212 |
| AlmaLinux:9 | nginx-core | 2:1.20.1-28.el9_8.3.alma.1 | ALSA-2026:28973 |
| AlmaLinux:9 | nginx-core | 2:1.26.3-9.module_el9.8.0+260+95b8e5ed.1 | ALSA-2026:29151 |
| AlmaLinux:10 | nginx-filesystem | 2:1.26.3-6.el10_2.4 | ALSA-2026:29874 |
| AlmaLinux:8 | nginx-filesystem | 1:1.24.0-3.module_el8.10.0+4200+fea3b4c7.2.alma.1 | ALSA-2026:28921 |
| AlmaLinux:9 | nginx-filesystem | 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1 | ALSA-2026:28212 |
| AlmaLinux:9 | nginx-filesystem | 2:1.26.3-9.module_el9.8.0+260+95b8e5ed.1 | ALSA-2026:29151 |
| AlmaLinux:9 | nginx-filesystem | 2:1.20.1-28.el9_8.3.alma.1 | ALSA-2026:28973 |
| AlmaLinux:10 | nginx-mod-devel | 2:1.26.3-6.el10_2.4 | ALSA-2026:29874 |
| AlmaLinux:8 | nginx-mod-devel | 1:1.24.0-3.module_el8.10.0+4200+fea3b4c7.2.alma.1 | ALSA-2026:28921 |
| AlmaLinux:9 | nginx-mod-devel | 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1 | ALSA-2026:28212 |
| AlmaLinux:9 | nginx-mod-devel | 2:1.26.3-9.module_el9.8.0+260+95b8e5ed.1 | ALSA-2026:29151 |
| AlmaLinux:9 | nginx-mod-devel | 2:1.20.1-28.el9_8.3.alma.1 | ALSA-2026:28973 |
| AlmaLinux:10 | nginx-mod-http-image-filter | 2:1.26.3-6.el10_2.4 | ALSA-2026:29874 |
| AlmaLinux:8 | nginx-mod-http-image-filter | 1:1.24.0-3.module_el8.10.0+4200+fea3b4c7.2.alma.1 | ALSA-2026:28921 |
| AlmaLinux:9 | nginx-mod-http-image-filter | 2:1.26.3-9.module_el9.8.0+260+95b8e5ed.1 | ALSA-2026:29151 |
| AlmaLinux:9 | nginx-mod-http-image-filter | 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1 | ALSA-2026:28212 |
| AlmaLinux:9 | nginx-mod-http-image-filter | 2:1.20.1-28.el9_8.3.alma.1 | ALSA-2026:28973 |
| AlmaLinux:10 | nginx-mod-http-perl | 2:1.26.3-6.el10_2.4 | ALSA-2026:29874 |
| AlmaLinux:8 | nginx-mod-http-perl | 1:1.24.0-3.module_el8.10.0+4200+fea3b4c7.2.alma.1 | ALSA-2026:28921 |
| AlmaLinux:9 | nginx-mod-http-perl | 2:1.20.1-28.el9_8.3.alma.1 | ALSA-2026:28973 |
| AlmaLinux:9 | nginx-mod-http-perl | 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1 | ALSA-2026:28212 |
| AlmaLinux:9 | nginx-mod-http-perl | 2:1.26.3-9.module_el9.8.0+260+95b8e5ed.1 | ALSA-2026:29151 |
| AlmaLinux:10 | nginx-mod-http-xslt-filter | 2:1.26.3-6.el10_2.4 | ALSA-2026:29874 |
| AlmaLinux:8 | nginx-mod-http-xslt-filter | 1:1.24.0-3.module_el8.10.0+4200+fea3b4c7.2.alma.1 | ALSA-2026:28921 |
| AlmaLinux:9 | nginx-mod-http-xslt-filter | 2:1.20.1-28.el9_8.3.alma.1 | ALSA-2026:28973 |
| AlmaLinux:9 | nginx-mod-http-xslt-filter | 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1 | ALSA-2026:28212 |
| AlmaLinux:9 | nginx-mod-http-xslt-filter | 2:1.26.3-9.module_el9.8.0+260+95b8e5ed.1 | ALSA-2026:29151 |
| AlmaLinux:10 | nginx-mod-mail | 2:1.26.3-6.el10_2.4 | ALSA-2026:29874 |
| AlmaLinux:8 | nginx-mod-mail | 1:1.24.0-3.module_el8.10.0+4200+fea3b4c7.2.alma.1 | ALSA-2026:28921 |
| AlmaLinux:9 | nginx-mod-mail | 2:1.20.1-28.el9_8.3.alma.1 | ALSA-2026:28973 |
| AlmaLinux:9 | nginx-mod-mail | 2:1.26.3-9.module_el9.8.0+260+95b8e5ed.1 | ALSA-2026:29151 |
| AlmaLinux:9 | nginx-mod-mail | 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1 | ALSA-2026:28212 |
| AlmaLinux:10 | nginx-mod-stream | 2:1.26.3-6.el10_2.4 | ALSA-2026:29874 |
| AlmaLinux:8 | nginx-mod-stream | 1:1.24.0-3.module_el8.10.0+4200+fea3b4c7.2.alma.1 | ALSA-2026:28921 |
| AlmaLinux:9 | nginx-mod-stream | 1:1.24.0-7.module_el9.8.0+259+a3b861bb.2.alma.1 | ALSA-2026:28212 |
| AlmaLinux:9 | nginx-mod-stream | 2:1.20.1-28.el9_8.3.alma.1 | ALSA-2026:28973 |
| AlmaLinux:9 | nginx-mod-stream | 2:1.26.3-9.module_el9.8.0+260+95b8e5ed.1 | ALSA-2026:29151 |
| Alpine:v3.21 | nginx | 1.26.3-r1 | ALPINE-CVE-2026-9256 |
| Alpine:v3.22 | nginx | 1.28.3-r2 | ALPINE-CVE-2026-9256 |
| Alpine:v3.23 | nginx | 1.28.3-r2 | ALPINE-CVE-2026-9256 |
| Alpine:v3.24 | nginx | 1.30.2-r0 | ALPINE-CVE-2026-9256 |
| Debian:12 | nginx | 1.22.1-9+deb12u8 | DEBIAN-CVE-2026-9256 |
| Debian:13 | nginx | 1.26.3-3+deb13u6 | DEBIAN-CVE-2026-9256 |
| Debian:14 | nginx | 1.30.1-3 | DEBIAN-CVE-2026-9256 |
| Rocky Linux:10 | nginx | 2:1.26.3-6.el10_2.4 | RLSA-2026:29874 |
| Rocky Linux:8 | nginx | 1:1.24.0-3.module+el8.10.0+40187+52bedf24.1 | RLSA-2026:28921 |
| Rocky Linux:8 | nginx | 1:1.24.0-3.module+el8.10.0+40144+38158758 | RLSA-2026:28921 |
| Rocky Linux:9 | nginx | 1:1.24.0-7.module+el9.8.0+40193+7b2d11e4.1.rocky.0.1 | RLSA-2026:28212 |
| Rocky Linux:9 | nginx | 2:1.26.3-9.module+el9.8.0+40194+40adfc1b | RLSA-2026:29151 |
| Ubuntu:22.04:LTS | nginx | 1.18.0-6ubuntu14.12 | UBUNTU-CVE-2026-9256 |
| Ubuntu:24.04:LTS | nginx | 1.24.0-2ubuntu7.9 | UBUNTU-CVE-2026-9256 |
| Ubuntu:25.10 | nginx | 1.28.0-6ubuntu1.4 | UBUNTU-CVE-2026-9256 |
| Ubuntu:26.04:LTS | nginx | 1.28.3-2ubuntu1.2 | UBUNTU-CVE-2026-9256 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| F5 | NGINX Plus | 37.0 – before 37.0.1.1R36 – before R36 P5R32 – before R32 P7 |
| F5 | NGINX Open Source | 1.31.0 – before 1.31.11.30.0 – before 1.30.20.1.17 – through 0.9.7 |
Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://my.f5.com/manage/s/article/K000161377 vendor-advisory
- http://www.openwall.com/lists/oss-security/2026/05/22/14
- https://lists.debian.org/debian-lts-announce/2026/06/msg00023.html
- https://access.redhat.com/security/cve/CVE-2026-9256 vdb-entry, x_refsource_REDHAT
- RHBZ#2480746 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9256.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:29874 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:28921 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:28212 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:28973 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:29151 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33313 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:20351 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:44481 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:58981 vendor-advisory, x_refsource_REDHAT