Loading vulnerability…
CVE-2026-27654 is a heap-based buffer overflow in NGINX Open Source and NGINX Plus affecting ngx_http_dav_module during WebDAV COPY and MOVE request processing. The flaw occurs in configurations that use a prefix location together with the alias directive and permit DAV COPY or MOVE methods. Available technical analysis attributes the bug to an unsigned underflow in ngx_http_map_uri_to_path() that is reached from ngx_http_dav_copy_move_handler() when the Destination header is shorter than the configured location prefix, leading to incorrect buffer size calculation and an out-of-bounds heap write in the worker process. Successful exploitation can crash the NGINX worker process and can also corrupt source or destination path handling so that file names are modified outside the intended document root or alias-mapped directory constraints.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Small standalone Python exploit repository for CVE-2026-27654 targeting nginx ngx_http_dav_module alias path handling. Repository contains one main code file (exploit.py), a README with usage and vulnerability background, and a minimal requirements.txt listing requests and colorama. The exploit is not part of a larger framework. The script is an operational PoC rather than a simple detector. It builds crafted WebDAV MOVE/COPY requests with attacker-controlled Destination paths to trigger the documented size_t underflow/heap overflow condition in vulnerable nginx DAV alias configurations. It supports a crash/check mode for vulnerability validation and additional delivery-oriented modes: write-file, cron-shell, and cron-cmd. Those extended modes indicate the author is attempting to leverage path traversal/alias misrouting to place arbitrary content at attacker-chosen filesystem paths in permissive lab setups, including writing cron jobs under /etc/cron.d for delayed command execution or reverse shell launch. Code structure includes: argument parsing and interactive menu logic; URL normalization helpers; a requests-based HTTP client with stdlib http.client fallback; existence checks using HEAD/GET; crash testing logic; delivery logic for crafted DAV requests; and post-action checks/waits for worker respawn or cron execution. Proxy support is implemented when requests is available, with fallback mode explicitly warning that proxying is unsupported. Fingerprintable observables are limited and mostly user-supplied: target host/URL, optional proxy URL, default test filename testfile.txt, and example paths/URLs in the README such as /etc/cron.d/, /tmp/owned, /tmp/payload, and http://attacker.com/payload. Overall purpose: exploit or validate a remotely reachable nginx WebDAV vulnerability that can reliably crash workers and, in certain writable/misconfigured environments, facilitate arbitrary file write and cron-based command execution.
This repository is a small standalone Python proof-of-concept for CVE-2026-27654, a heap buffer overflow in nginx's ngx_http_dav_module. The repo contains three files: LICENSE, README.md, and the main exploit script poc.py. README.md documents the vulnerability, affected/fixed versions, required nginx configuration, and expected crash behavior. The only code file, poc.py, is the entry point and implements the full exploit flow. The exploit is network/web-based and targets nginx DAV endpoints exposed over HTTP. It first checks target reachability, then optionally uploads a file using HTTP PUT to /uploads/triggerfile.txt. After that it sends a crafted HTTP MOVE request for that file with a Destination header pointing to an absolute URI whose path is /x. The script is explicitly designed around a vulnerable configuration where the DAV location prefix is /uploads/ and nginx uses alias /data/files/. Because the destination path is shorter than the location prefix, nginx performs an unsigned length subtraction that underflows, leading to a wrapped allocation size and an oversized copy, causing heap corruption and typically a worker crash. Capabilities are limited to vulnerability triggering and validation rather than post-exploitation. There is no shell payload, persistence, credential theft, or lateral movement logic. The practical result is remote denial of service against a vulnerable nginx worker, with the script also reporting likely patched behavior (HTTP 400), timeout/restart conditions, or connection reset indicating a crash. Overall, this is a genuine PoC exploit focused on reliable crash reproduction for defensive testing and verification.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An NGINX ngx_http_dav_module vulnerability mentioned only in a historical summary.
A high-severity heap buffer overflow in nginx WebDAV COPY/MOVE handling with the alias directive, caused by a size_t underflow in path buffer calculation.
A heap buffer overflow vulnerability in NGINX’s DAV COPY/MOVE handling under specific alias configuration.
A heap buffer overflow in nginx WebDAV handling that can escape the WebDAV root and allow remote attackers to read or write files accessible to the worker UID under specific non-default configurations.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.