Loading vulnerability…
CVE-2026-9256 is a heap-based buffer overflow in NGINX Open Source and NGINX Plus within ngx_http_rewrite_module. The flaw is triggered when a rewrite directive uses distinct but overlapping PCRE capture groups and the replacement string references multiple overlapping captures in a redirect or arguments context. A representative pattern is a nested capture structure where one referenced capture contains another, causing overlapping bytes to be processed more than once during output construction. The vulnerable behavior arises from incorrect buffer size calculation in the rewrite script engine during handling of URI-escaped output: the implementation budgets escaping overhead incorrectly for overlapping captures, so the copy phase can write more data than was allocated. Public technical analysis also describes the issue as affecting processing associated with regex start and rewrite-script evaluation paths, leading to corruption of heap memory in the worker process. In addition to process instability, the flaw can create an out-of-bounds read or disclosure condition in some scenarios, exposing adjacent heap data that may assist further exploitation.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (6 hidden).
Repository is a compact, self-contained exploit lab for chaining two nginx rewrite-engine vulnerabilities into ASLR-independent remote command execution against stock official nginx:1.30.0. Structure is simple: README.md documents the chain and usage; nginx.conf defines the intentionally vulnerable target configuration; run.sh launches a Dockerized nginx lab and a slow local upstream; exp_official.py performs the exploit. The main exploit logic is in exp_official.py. It first abuses the /search rewrite path to trigger the PoolSlip over-read and recover leaked heap/libc pointers from the reflected degraded search response. It then computes libc base, heap base, and libc system(). Next it uses repeated POST requests to /api/upload to spray heap chunks containing fake cleanup records and a command buffer. It opens and times multiple TCP connections to groom nginx connection pools, then sends a crafted GET to /api/v1/... to trigger the rift overflow and partially overwrite the low 2 bytes of a limit_conn cleanup pointer with URL-safe bytes only. Finally, by closing/freeing connections in a controlled order, nginx walks the corrupted cleanup list during pool destruction and invokes system(cmd). The exploit is operational rather than a mere PoC: it contains full leak, address derivation, heap spray, grooming, overwrite, and trigger stages, with a user-supplied command via --cmd. It is not framework-based. The target is specifically nginx OSS on Linux, demonstrated on Debian/glibc 2.41 in the official nginx:1.30.0 container. Fingerprintable target routes are /search, /lookup, /api/v1, /api/upload, and /healthz, with local upstreams at 127.0.0.1:8080 and 127.0.0.1:9200 in the lab.
This repository is a small standalone proof-of-concept for CVE-2026-9256, described as an Nginx heap buffer overflow. It contains four files: a minimal README, a docker-compose file to launch a reproducible Nginx 1.30.1 environment, a custom nginx.conf that defines the suspected vulnerable rewrite behavior, and a Python PoC script. The exploit logic is entirely in poc.py. The script targets http://localhost:8080 and sends crafted GET requests with paths made of repeated '+' characters. In leak_heap(), it sends a shorter payload, disables redirect following, and inspects the returned Location header for hexadecimal values matching pointer patterns (0x...). In crash(), it sends a larger payload intended to trigger a crash, treating request failure/exception as success. The nginx.conf is central to the exploit setup: requests to '/' are rewritten using the regex ^/((.*))$ into /redirect/$1$2? with an HTTP redirect, which may cause malformed handling of attacker-controlled URI data and expose memory contents in the redirect header or trigger memory corruption. Overall, this is a network/web-targeted PoC for local reproduction and validation of information disclosure and denial-of-service behavior, not a full weaponized exploit and not tied to a larger exploitation framework.
This repository is a real exploit/PoC set for a heap buffer overflow in nginx's ngx_http_rewrite_module caused by undercounting escaped output size when nested overlapping regex capture groups are referenced multiple times in a static rewrite target. The repo is small and purpose-built: three Python PoCs (heap_leak.py, libc_leak.py, crash_verify.py), a Docker lab environment under env/, and a detailed README explaining root cause, trigger conditions, and expected results. Exploit capability is staged rather than full end-to-end RCE. Stage 1 (heap_leak.py) sends crafted HTTP GET requests to /echo/%25...A and parses reflected query output to recover heap pointers from ngx_http_script_engine_t fields such as e->ip, e->sp, and e->request. Stage 2 (libc_leak.py) targets /leak2/%25...A and relies on proxy_pass plus add_header to surface raw overflow bytes in the X-Leak-Y response header, scanning for a 0x7f... pointer consistent with a libc-region address; this requires ASLR to be disabled for reliability. Stage 3 (crash_verify.py) targets /leak9/ with a deeply nested capture pattern and a controlled number of encoded '+' characters to produce a larger overflow that corrupts heap metadata and crashes the nginx worker, confirming DoS. The included nginx.conf is central to the exploitability: it defines the vulnerable rewrite routes, an internal backend on 127.0.0.1:19322 for the proxy_pass leak stage, and tuning such as request_pool_size 7920 to make the overwrite deterministic. The Dockerfile and compose file create a reproducible lab based on nginx:1.31.0, exposing port 19321 and optionally allowing ASLR-disabled execution via setarch in entrypoint_aslr_off.sh. Overall, this is an operational exploit lab demonstrating unauthenticated remote web-triggered memory corruption in nginx, with practical primitives for heap disclosure, libc-range disclosure, and worker crash/DoS. It does not include a final shell or command-execution payload, but it clearly aims to support exploit development toward code execution under favorable memory-layout conditions.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
59 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Another vulnerability mentioned only in passing as a prior fix unrelated to the newly disclosed flaw.
A separate rewrite-module capture handling flaw in NGINX mentioned as related background/comparison to the primary vulnerability.
Another nginx vulnerability mentioned only as background; fixes for it do not address CVE-2026-42533.
Another CVE mentioned only for comparison; its fixes do not address CVE-2026-42533.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.