Loading vulnerability…
NGINX Rift
NGINX Rift is a heap-based buffer overflow vulnerability in the ngx_http_rewrite_module module of NGINX Plus and NGINX Open Source. It affects configurations involving a rewrite directive followed by a rewrite, if, or set directive, unnamed Perl-Compatible Regular Expression (PCRE) captures such as $1 or $2, and a replacement string containing a question mark. An unauthenticated remote attacker can send crafted HTTP requests that, subject to additional conditions beyond the attacker's control, corrupt heap memory in an NGINX worker process. Exploitation can cause worker termination and restart, and may enable arbitrary code execution when Address Space Layout Randomization (ASLR) is disabled or bypassed. The vulnerability also affects products embedding vulnerable NGINX components. Public remote-code-execution proof-of-concept code and exploitation in the wild have been reported.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can crash and restart NGINX worker processes, disrupting HTTP service availability. When ASLR is disabled or bypassed, memory corruption may permit arbitrary code execution with the privileges of the affected worker process, potentially compromising accessible data and service integrity. Privileged code execution is possible in deployments where the affected process has elevated privileges; privilege escalation is not an inherent consequence of the vulnerability.
If you can’t patch tonight, do this now.
Ensure ASLR is enabled to reduce code-execution risk; this does not prevent the underlying overflow or worker crashes and is insufficient if ASLR can be bypassed. Restrict network access to affected interfaces wherever operationally possible. For affected HPE Aruba products, isolate management interfaces on a dedicated Layer 2 segment or VLAN and enforce Layer 3 or higher firewall policies. These measures reduce exposure but do not replace patching. A validated configuration-specific workaround for this CVE is not available in the supplied details.
Patch, then assume compromise.
Install vendor-provided NGINX security updates or distribution packages containing the fix. Exact fixed upstream NGINX versions are not available in the supplied vulnerability details. Update embedded NGINX through the relevant product vendor's supported releases. Specific fixes include HPE Aruba Networking AirWave 8.3.0.7 or later, Private 5G Management Dashboard 1.25.2.2 or later, VMware Tanzu PHP Buildpack 4.6.80, and Staticfile Buildpack 1.6.81. For SAP Commerce Cloud public-cloud deployments with NGINX, apply SAP Security Note 3773203. Move unsupported product branches to supported releases; software beyond End of Technical Support was not evaluated.
26 exploits validated by Mallory's analysis. Hidden: 29 rejected by Mallory's analysis as not a working exploit; 4 not yet analyzed, such as Exploit-DB entries. Showing the 25 most capable, earliest first.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
368 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.