Intel

CVE-2026-9256

Red Hat Security Advisory: Red Hat Update Infrastructure 5.3 Technology Preview security update

criticalPoCEPSS 11 %

Beschreibung

NGINX Plus und NGINX Open Source weisen eine Schwachstelle im Modul ngx_http_rewrite_module auf. Diese Schwachstelle tritt auf, wenn ein Rewrite-Befehl ein Regex-Muster mit unterschiedlichen, sich überschneidenden Perl-kompatiblen regulären Ausdrücken (PCRE) verwendet (zum Beispiel ^/((.*))$) und eine Ersetzungskette mehrere solche Erfassungen referenziert (zum Beispiel $1$2) im Kontext einer Umleitung oder Argumente. Ein unauthentifizierter Angreifer kann diese Schwachstelle ausnutzen, indem er speziell gestaltete HTTP-Anfragen sendet, unter Bedingungen, die außerhalb seiner Kontrolle liegen. Dies könnte zu einem Heap-Überlauf im NGINX-Arbeitsprozess führen und einen Neustart verursachen. Zusätzlich können Angreifer Code auf Systemen ausführen, bei denen Address Space Layout Randomization (ASLR) deaktiviert ist oder wenn der Angreifer ASLR umgehen kann. Hinweis: Softwareversionen, die das Ende der technischen Unterstützung (EoTS) erreicht haben, werden nicht bewertet.

Quelle: BSIBSI_CSAFREDHAT_CSAFBSIBSI_CSAFUBUNTU_USNBSIBSI_CSAFREDHAT_CSAFMSRCDEBIAN_DSAUBUNTU_USNCVELISTV5OSVOSVNVDREDHAT_CSAFCVEORGEUVDF5_ASKF5

Metriken

Severity
critical
Priority-Score
138.56
KEV-Status
—
Exploit-Reife
PoC (öffentlich gemeldet)
XIEM Effective CVSS
9.2
Quelle: nvd-v4
CVSS v3
8.1
CVSS v4
9.2
EPSS-Perzentil
95.6 %
Kritisch — CVE liegt im obersten Fünftel aller heute bewerteten CVEs (Rang ≥ 80 %).
EPSS-Score
10.9 %
Erhöht — Modell schätzt 10-50 % Ausnutzungs-Wahrscheinlichkeit.
Veröffentlicht
2026-08-24 11:15 UTC
CWE
CWE-122

Weakness-Klassen (CWE)

  • CWE-122Variant

    Heap-based Buffer Overflow

    A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

    cwe.mitre.org →

Re-Analyse & Statuswechsel

Chronologie der NVD-Audit-Events für diese CVE — Reanalyses, CVSS-Updates, CPE-Diffs.

  1. CVE Modified2026-08-25 13:19 UTC· 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
    • Reference: https://access.redhat.com/errata/RHSA-2026:58981
    • Affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 (+8) → Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 (+10)
  2. Modified Analysis2026-08-11 14:48 UTC· nvd@nist.gov
    • CPE Configuration: OR *cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:* versions from (including) 1.3.0 up to (including) 1.6.2 *cpe:2.3:a:f5:dos:*:*:*:*:*:nginx:*:* versions from (including) 4.3.0 up to (including) 4.7.0 *cpe:2.3:a:f5:dos:4.9.0:*:*:*:*:nginx:*:* *cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:* versions from (including) 4.10.0 up to (including) 4.16.0 *cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:* versions from (including) 5.2.0 up to (including) 5.8.0 *cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:continuous_releases:*:*:* versions from (including) 3.5.0 up to (including) 3.7.2 *cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:* versions from (including) 2.17.0 up to (excluding) 2.22.1 *cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:* versions from (including) 5.9.0 up to (including) 5.13.0 *cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:* versions from (including) 2.0.0 up to (excluding) 2.6.2 *cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:continuous_releases:*:*:* versions from (including) 4.0.0 up to (including) 4.0.1 *cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:continuous_releases:*:*:* versions from (including) 5.0.0 up to (excluding) 5.4.3
    • CPE Configuration: OR *cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* *cpe:2.3:a:redhat:discovery:-:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* *cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:* *cpe:2.3:a:redhat:update_infrastructure:*:*:*:*:*:*:*:* versions from (including) 5.0 up to (excluding) 5.2
    • CPE Configuration: OR *cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:* versions from (including) r32 up to (including) r36 *cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:* versions from (including) 0.1.17 up to (including) 0.9.7 *cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:* versions from (including) 1.0.0 up to (including) 1.30.1 *cpe:2.3:a:f5:nginx_open_source:1.31.0:*:*:*:*:*:*:* *cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:* versions from (including) 37.0.0 up to (excluding) 37.0.1.1 → OR *cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:* versions from (including) 0.1.17 up to (including) 0.9.7 *cpe:2.3:a:f5:nginx_open_source:1.31.0:*:*:*:*:*:*:* *cpe:2.3:a:f5:nginx_plus:*:*:*:*:continuous_releases:*:*:* versions from (including) r33 up to (excluding) r36 *cpe:2.3:a:f5:nginx_plus:37.0.0.1:*:*:*:long-term_support:*:*:* *cpe:2.3:a:f5:nginx_plus:r32:-:*:*:continuous_releases:*:*:* *cpe:2.3:a:f5:nginx_plus:r32:p1:*:*:continuous_releases:*:*:* *cpe:2.3:a:f5:nginx_plus:r32:p2:*:*:continuous_releases:*:*:* *cpe:2.3:a:f5:nginx_plus:r32:p3:*:*:continuous_releases:*:*:* *cpe:2.3:a:f5:nginx_plus:r32:p4:*:*:continuous_releases:*:*:* *cpe:2.3:a:f5:nginx_plus:r32:p5:*:*:continuous_releases:*:*:* *cpe:2.3:a:f5:nginx_plus:r32:p6:*:*:continuous_releases:*:*:* *cpe:2.3:a:f5:nginx_plus:r36:-:*:*:continuous_releases:*:*:* *cpe:2.3:a:f5:nginx_plus:r36:p1:*:*:continuous_releases:*:*:* *cpe:2.3:a:f5:nginx_plus:r36:p2:*:*:continuous_releases:*:*:* *cpe:2.3:a:f5:nginx_plus:r36:p3:*:*:continuous_releases:*:*:* *cpe:2.3:a:f5:nginx_plus:r36:p4:*:*:continuous_releases:*:*:* *cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:* versions from (including) 1.0.0 up to (excluding) 1.30.2
    • Reference Type: CVE: http://www.openwall.com/lists/oss-security/2026/05/22/14 Types: Mailing List, Third Party Advisory → CVE: http://www.openwall.com/lists/oss-security/2026/05/22/14 Types: Mailing List
  3. CVE Modified2026-07-24 13:18 UTC· 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
    • Reference: https://access.redhat.com/errata/RHSA-2026:44481
    • Affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 (+5) → Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 (+8)
  4. CVE Translated2026-07-23 12:10 UTC· nvd@nist.gov
    • Translation: Title: NGINX Plus y NGINX Open Source de F5, Description: NGINX Plus y NGINX Open Source tienen una vulnerabilidad en el módulo ngx_http_rewrite_module. Esta vulnerabilidad existe cuando una directiva de reescritura utiliza un patrón de expresión regular (regex) con capturas de expresiones regulares compatibles con Perl (PCRE) distintas y superpuestas (por ejemplo, ^/((.*))$) y una cadena de reemplazo que hace referencia a múltiples de dichas capturas (por ejemplo, $1$2) en un contexto de redirección o de argumentos. Un atacante no autenticado, junto con condiciones fuera de su control, puede explotar esta vulnerabilidad enviando solicitudes HTTP manipuladas. Esto puede causar un desbordamiento de búfer de pila en el proceso de trabajador de NGINX, lo que lleva a un reinicio. Además, los atacantes pueden ejecutar código en sistemas con la aleatorización del espacio de direcciones (ASLR) deshabilitada o cuando el atacante puede eludir ASLR. Nota: Las versiones de software que han alcanzado el fin del soporte técnico (EoTS) no se evalúan.
  5. Initial Analysis2026-06-16 19:59 UTC· nvd@nist.gov
    • CPE Configuration: OR *cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:* versions from (including) r32 up to (including) r36 *cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:* versions from (including) 0.1.17 up to (including) 0.9.7 *cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:* versions from (including) 1.0.0 up to (including) 1.30.1 *cpe:2.3:a:f5:nginx_open_source:1.31.0:*:*:*:*:*:*:* *cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:* versions from (including) 37.0.0 up to (excluding) 37.0.1.1
    • Reference Type: CVE: http://www.openwall.com/lists/oss-security/2026/05/22/14 Types: Mailing List, Third Party Advisory
    • Reference Type: F5 Networks: https://my.f5.com/manage/s/article/K000161377 Types: Mitigation, Vendor Advisory

Betroffene Betriebssysteme

  • linux

    ubuntu / coreutilsjammy

  • linux

    ubuntu / coreutilsnoble

  • linux

    ubuntu / coreutilsresolute

  • linux

    debian / debian_linux11.0

  • linux

    redhat / enterprise_linux10.0

  • linux

    redhat / enterprise_linux10.2

  • linux

    redhat / enterprise_linux6.0

  • linux

    redhat / enterprise_linux7.0

  • linux

    redhat / enterprise_linux8.0

  • linux

    redhat / enterprise_linux9.0

  • linux

    redhat / enterprise_linux9.8

  • linux

    redhat / enterprise_linux_for_els10.2

  • linux

    redhat / enterprise_linux_for_els8.10

  • linux

    redhat / enterprise_linux_for_els9.8

  • linux

    redhat / enterprise_linux_for_eus10.2

  • linux

    redhat / enterprise_linux_for_eus9.8

  • linux

    redhat / enterprise_linux_for_ibm_z_systems10.2

  • linux

    redhat / enterprise_linux_for_ibm_z_systems8.0_s390x

  • linux

    redhat / enterprise_linux_for_ibm_z_systems9.0_s390x

  • linux

    redhat / enterprise_linux_for_ibm_z_systems_els10.2

  • linux

    redhat / enterprise_linux_for_ibm_z_systems_els8.10

  • linux

    redhat / enterprise_linux_for_ibm_z_systems_els9.8

  • linux

    redhat / enterprise_linux_for_ibm_z_systems_eus10.2

  • linux

    redhat / enterprise_linux_for_ibm_z_systems_eus9.8

Betroffene Produkte

Aus der Hersteller-/CERT-Meldung extrahierte Produkte und Versionsbereiche. Ein Version-Range wie „<4.14.6“ impliziert die Update-Empfehlung „auf 4.14.6 oder höher aktualisieren“.

  • Apple

    iOS18.7.10

  • Apple

    iOS26.6.1

  • Apple

    iPadOS18.7.10

  • Apple

    iPadOS26.6.1

  • Apple

    macOSTahoe 26.6.2

  • bitnami

    jre1.9.0

  • bitnami

    nginx-gateway0.1.17

  • bitnami

    nginx-gateway-fabric1.3.0

  • bitnami

    postgresql15.0.0

  • bitnami

    postgresql16.0.0

  • bitnami

    postgresql17.0.0

  • bitnami

    postgresql18.0.0

  • bitnami

    python-min3.10.0

  • bitnami

    python-min3.11.0

  • bitnami

    python-min3.12.0

  • bitnami

    python-min3.13.0

  • bitnami

    python-min3.14.0

  • f5

    dos4.3.0 – 4.7.0

  • f5

    dos

  • f5

    nginx_gateway_fabric1.3.0 – 1.6.2

  • f5

    nginx_gateway_fabric2.0.0 – 2.5.1

  • f5

    nginx_ingress_controller3.5.0 – 3.7.2

  • f5

    nginx_ingress_controller4.0.0 – 4.0.1

  • f5

    nginx_ingress_controller5.0.0 – 5.4.1

Quellen & Referenzen

Verknüpfte CVEs

93 weitere CVEs anzeigen
IDCVE-2026-9256
Red Hat Security Advisory: Red Hat Update Infrastructure 5.3 Technology Preview security update — CVE-2026-9256 | NEOSEC Intel