Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

nginx may restart or be compromised by crafted requests

published 5 months ago
Summary

Versions of nginx before 1.28.3-4 can crash and restart when they process specially crafted web requests that use certain rewrite patterns. In some cases, an attacker could run their own code on the server if additional protections are missing. Update nginx to the latest version and review any rewrite rules that use complex regular expressions.

What to do
  • Update azure nginx to version 1.28.3-4.
Affected software
Ecosystem VendorProductAffected versions
Azure Linux:3 azure nginx < 1.28.3-4
Fix: upgrade to 1.28.3-4
Original advisory text
CVE-2026-9256 affecting package nginx for versions less than 1.28.3-4
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
References
Timeline
Published22 May 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-88116 · OSV
Track software like this
Free during beta