{"id":181731,"date":"2026-05-25T20:48:17","date_gmt":"2026-05-25T18:48:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/novaya-uyazvimost-v-rewrite-module-nginx"},"modified":"2026-05-25T20:48:17","modified_gmt":"2026-05-25T18:48:17","slug":"novaya-uyazvimost-v-rewrite-module-nginx","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/novaya-uyazvimost-v-rewrite-module-nginx","title":{"rendered":"New vulnerability in the nginx rewrite module","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex>      <\/p>\n<p>Shortly after the discovery <a rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/news\/security\/18295901\">of an 18-year-old<\/a> potential RCE, another one was found <a rel=\"nofollow\" href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-9256\">CVE-2026-9256<\/a>, this time lasting even longer \u2014 21 years, beginning with version 0.1.17 released in early 2005.<\/noindex><br \/>\nExploitation of the vulnerability requires the presence of the rewrite directive in the server's config, where:\n<\/p>\n<ul>\n<li> the first argument has overlapping highlighted regex parameters,\n<\/li>\n<li> the second uses two or more of them, but does not use variables,\n<\/li>\n<li> in this case, either the type 'redirect' is specified, or the parameters in the second argument are located after the question mark.\n<\/li>\n<\/ul>\n<p>\nExamples:<br \/>\nrewrite ^\\\/((.*))$ http:\\\/\\\/127.0.0.1:8080\\\/$1$2 redirect;<br \/>\nrewrite ^\\\/((.*))$ http:\\\/\\\/127.0.0.1:8080\\\/?$1$2;<\/p>\n<p>Both will encounter a buffer overflow when processing the request ' \/++++++++++++++++++++++++++++++ '.<\/p>\n<p>As in the previous vulnerability, in this case, the calculated buffer length may not match the actual number of bytes written to it \u2014 the length calculation did not always consider possible escaping.<\/p>\n<p>The above can lead to a crash of the nginx worker process, and in the absence of ASLR \u2014 to RCE. As a mitigating factor, it's worth noting that there is even less likelihood of encountering vulnerable constructs in the config than last time.<\/p>\n<p>The bug has been fixed in versions 1.30.2 and 1.31.1 (<a rel=\"nofollow\" href=\"https:\/\/github.com\/nginx\/nginx\/commit\/ca4f92a27464ae6c2082245e4f67048c633aa032\">commit fixing<\/a>).\n<\/p>\n<p>Source: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/news\/security\/18300022\">linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412\u0441\u043a\u043e\u0440\u0435 \u043f\u043e\u0441\u043b\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f 18-\u043b\u0435\u0442\u043d\u0435\u0433\u043e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e RCE \u0431\u044b\u043b\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043e \u0435\u0449\u0451 \u043e\u0434\u043d\u043e, CVE-2026-9256, \u043d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u043f\u0440\u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u0432\u0448\u0435\u0435 \u0435\u0449\u0451 \u0434\u043e\u043b\u044c\u0448\u0435&nbsp;&mdash; 21 \u0433\u043e\u0434, \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 0.1.17, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 \u0432 \u043d\u0430\u0447\u0430\u043b\u0435 2005 \u0433\u043e\u0434\u0430. \u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u0438\u0440\u0435\u043a\u0442\u0438\u0432\u044b rewrite, \u0443 \u043a\u043e\u0442\u043e\u0440\u043e\u0439: \u0432 \u043f\u0435\u0440\u0432\u043e\u043c \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u0435 \u0438\u043c\u0435\u044e\u0442\u0441\u044f \u043f\u0435\u0440\u0435\u043a\u0440\u044b\u0432\u0430\u044e\u0449\u0438\u0435\u0441\u044f \u0432\u044b\u0434\u0435\u043b\u044f\u0435\u043c\u044b\u0435 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e\u0433\u043e \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u044f, \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u0432\u0430 \u0438\u043b\u0438 \u0431\u043e\u043b\u044c\u0448\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181731","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412\u0441\u043a\u043e\u0440\u0435 \u043f\u043e\u0441\u043b\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f 18-\u043b\u0435\u0442\u043d\u0435\u0433\u043e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e RCE \u0431\u044b\u043b\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043e \u0435\u0449\u0451 \u043e\u0434\u043d\u043e,\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Erik Peterson\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/en\/blog\/news\/novaya-uyazvimost-v-rewrite-module-nginx\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 rewrite-\u043c\u043e\u0434\u0443\u043b\u0435 nginx | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412\u0441\u043a\u043e\u0440\u0435 \u043f\u043e\u0441\u043b\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f 18-\u043b\u0435\u0442\u043d\u0435\u0433\u043e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e RCE \u0431\u044b\u043b\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043e \u0435\u0449\u0451 \u043e\u0434\u043d\u043e,\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/en\/blog\/news\/novaya-uyazvimost-v-rewrite-module-nginx\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-05-25T18:48:17+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-05-25T18:48:17+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47New vulnerability in the nginx rewrite module | ProHoster","description":"Shortly after the discovery of an 18-year-old potential RCE, another one was found","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/novaya-uyazvimost-v-rewrite-module-nginx","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 rewrite-\u043c\u043e\u0434\u0443\u043b\u0435 nginx | ProHoster","og:description":"\u0412\u0441\u043a\u043e\u0440\u0435 \u043f\u043e\u0441\u043b\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f 18-\u043b\u0435\u0442\u043d\u0435\u0433\u043e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e RCE \u0431\u044b\u043b\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043e \u0435\u0449\u0451 \u043e\u0434\u043d\u043e,","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/novaya-uyazvimost-v-rewrite-module-nginx","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-25T18:48:17+00:00","article:modified_time":"2026-05-25T18:48:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/181731","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=181731"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/181731\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=181731"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=181731"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=181731"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}