Shortly after the discovery of an 18-year-old potential RCE, another one was found CVE-2026-9256, this time lasting even longer—21 years, starting from version 0.1.17, released in early 2005.
Exploitation of the vulnerability requires the presence of the rewrite directive in the server's config, where:
- the first argument has overlapping highlighted regex parameters,
- the second uses two or more of them, but does not use variables,
- and either the type 'redirect' is specified, or the parameters in the second argument are placed after the question mark.
Examples:
rewrite ^\/((.*))$ http:\/\/127.0.0.1:8080\/$1$2 redirect;
rewrite ^\/((.*))$ http:\/\/127.0.0.1:8080\/?$1$2;
Both will experience a buffer overflow when processing the request "/++++++++++++++++++++++++++++++".
As with the previous vulnerability, in this case, the calculated buffer length may not match the actual amount of data written to it—the length calculation did not fully consider possible escaping.
The above can lead to a crash of the nginx worker process, and in the absence of ASLR, an RCE. As a mitigating factor, it is noted that there is an even lower probability of encountering vulnerable constructs in the config than last time.
The bug has been fixed in versions 1.30.2 and 1.31.1 (commit fixing).
Source: linux.org.ru
