Loading vulnerability…
CVE-2026-9256, also called PoolSlip, is a heap-based buffer overflow in the ngx_http_rewrite_module of NGINX Open Source and NGINX Plus. Vulnerable rewrite directives use distinct overlapping PCRE capture groups and reference multiple overlapping captures in a redirect or arguments replacement. In the regex_start_code fast path, buffer sizing can account for URI-escaping expansion only once while the copy pass escapes overlapping bytes separately for each referenced capture, overrunning the allocation. Crafted unauthenticated HTTP requests can trigger worker-process restarts and potentially code execution when ASLR is disabled or bypassed. An exploit demonstration additionally characterizes PoolSlip as an arguments-buffer over-read exposing heap and libc pointers and chains it with CVE-2026-42945 for code execution; that outcome is not a demonstration of standalone exploitation.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (6 hidden).
Repository is a compact, self-contained exploit lab for chaining two nginx rewrite-engine vulnerabilities into ASLR-independent remote command execution against stock official nginx:1.30.0. Structure is simple: README.md documents the chain and usage; nginx.conf defines the intentionally vulnerable target configuration; run.sh launches a Dockerized nginx lab and a slow local upstream; exp_official.py performs the exploit. The main exploit logic is in exp_official.py. It first abuses the /search rewrite path to trigger the PoolSlip over-read and recover leaked heap/libc pointers from the reflected degraded search response. It then computes libc base, heap base, and libc system(). Next it uses repeated POST requests to /api/upload to spray heap chunks containing fake cleanup records and a command buffer. It opens and times multiple TCP connections to groom nginx connection pools, then sends a crafted GET to /api/v1/... to trigger the rift overflow and partially overwrite the low 2 bytes of a limit_conn cleanup pointer with URL-safe bytes only. Finally, by closing/freeing connections in a controlled order, nginx walks the corrupted cleanup list during pool destruction and invokes system(cmd). The exploit is operational rather than a mere PoC: it contains full leak, address derivation, heap spray, grooming, overwrite, and trigger stages, with a user-supplied command via --cmd. It is not framework-based. The target is specifically nginx OSS on Linux, demonstrated on Debian/glibc 2.41 in the official nginx:1.30.0 container. Fingerprintable target routes are /search, /lookup, /api/v1, /api/upload, and /healthz, with local upstreams at 127.0.0.1:8080 and 127.0.0.1:9200 in the lab.
This repository is a small standalone proof-of-concept for CVE-2026-9256, described as an Nginx heap buffer overflow. It contains four files: a minimal README, a docker-compose file to launch a reproducible Nginx 1.30.1 environment, a custom nginx.conf that defines the suspected vulnerable rewrite behavior, and a Python PoC script. The exploit logic is entirely in poc.py. The script targets http://localhost:8080 and sends crafted GET requests with paths made of repeated '+' characters. In leak_heap(), it sends a shorter payload, disables redirect following, and inspects the returned Location header for hexadecimal values matching pointer patterns (0x...). In crash(), it sends a larger payload intended to trigger a crash, treating request failure/exception as success. The nginx.conf is central to the exploit setup: requests to '/' are rewritten using the regex ^/((.*))$ into /redirect/$1$2? with an HTTP redirect, which may cause malformed handling of attacker-controlled URI data and expose memory contents in the redirect header or trigger memory corruption. Overall, this is a network/web-targeted PoC for local reproduction and validation of information disclosure and denial-of-service behavior, not a full weaponized exploit and not tied to a larger exploitation framework.
This repository is a real exploit/PoC set for a heap buffer overflow in nginx's ngx_http_rewrite_module caused by undercounting escaped output size when nested overlapping regex capture groups are referenced multiple times in a static rewrite target. The repo is small and purpose-built: three Python PoCs (heap_leak.py, libc_leak.py, crash_verify.py), a Docker lab environment under env/, and a detailed README explaining root cause, trigger conditions, and expected results. Exploit capability is staged rather than full end-to-end RCE. Stage 1 (heap_leak.py) sends crafted HTTP GET requests to /echo/%25...A and parses reflected query output to recover heap pointers from ngx_http_script_engine_t fields such as e->ip, e->sp, and e->request. Stage 2 (libc_leak.py) targets /leak2/%25...A and relies on proxy_pass plus add_header to surface raw overflow bytes in the X-Leak-Y response header, scanning for a 0x7f... pointer consistent with a libc-region address; this requires ASLR to be disabled for reliability. Stage 3 (crash_verify.py) targets /leak9/ with a deeply nested capture pattern and a controlled number of encoded '+' characters to produce a larger overflow that corrupts heap metadata and crashes the nginx worker, confirming DoS. The included nginx.conf is central to the exploitability: it defines the vulnerable rewrite routes, an internal backend on 127.0.0.1:19322 for the proxy_pass leak stage, and tuning such as request_pool_size 7920 to make the overwrite deterministic. The Dockerfile and compose file create a reproducible lab based on nginx:1.31.0, exposing port 19321 and optionally allowing ASLR-disabled execution via setarch in entrypoint_aslr_off.sh. Overall, this is an operational exploit lab demonstrating unauthenticated remote web-triggered memory corruption in nginx, with practical primitives for heap disclosure, libc-range disclosure, and worker crash/DoS. It does not include a final shell or command-execution payload, but it clearly aims to support exploit development toward code execution under favorable memory-layout conditions.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
73 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A network-exploitable vulnerability requiring high attack complexity but no privileges or user interaction. The supplied CVSS vectors indicate high confidentiality, integrity, and availability impacts. Exploits and an official patch are available; the technical flaw and affected product are not identified.
A network-accessible, high-impact vulnerability affecting Unity Linux systems, with high confidentiality, integrity, and availability impact according to the supplied CVSS v3 vector. Exploits are stated to be available.
A Unity Linux security advisory vulnerability tracked as CVE-2026-9256, rated as a high-impact network-accessible flaw in the supplied plugin metadata. The CVSS vectors indicate high impact to confidentiality, integrity, and availability, with high attack complexity and no privileges or user interaction required.
A vulnerability addressed by a Unity Linux security update; the supplied CVSS vectors characterize it as a network-reachable, high-impact confidentiality, integrity, and availability issue with high attack complexity and no required privileges or user interaction.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.