AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-122

https://access.redhat.com/errata/RHSA-2026:20351

https://access.redhat.com/errata/RHSA-2026:28212

https://access.redhat.com/errata/RHSA-2026:28921

https://access.redhat.com/errata/RHSA-2026:28973

https://access.redhat.com/errata/RHSA-2026:29151

https://access.redhat.com/errata/RHSA-2026:29874

https://access.redhat.com/errata/RHSA-2026:33313

https://access.redhat.com/security/cve/CVE-2026-9256

https://bugzilla.redhat.com/show_bug.cgi?id=2480746

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9256.json

[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream (v. 10)","defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux:10.2"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream (v. 8)","defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream (v. 9)","defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)","defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux:10.2"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)","defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux:9::crb"]},{"vendor":"Red Hat","product":"Red Hat Discovery 2","defaultStatus":"affected","cpes":["cpe:/a:redhat:discovery:2::el9"]},{"vendor":"Red Hat","product":"Red Hat Hardened Images","defaultStatus":"affected","cpes":["cpe:/a:redhat:hummingbird:1"]},{"vendor":"Red Hat","product":"Red Hat Lightspeed proxy 1","defaultStatus":"affected","cpes":["cpe:/a:redhat:insights_proxy:1"]}]

https://lists.debian.org/debian-lts-announce/2026/06/msg00023.html

{"timestamp":"2026-05-22T00:00:00+00:00","id":"CVE-2026-9256","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"F5","product":"NGINX Plus","defaultStatus":"unknown","modules":["ngx_http_rewrite_module"],"versions":[{"version":"37.0","lessThan":"37.0.1.1","versionType":"custom","status":"affected"},{"version":"R36","lessThan":"R36 P5","versionType":"custom","status":"affected"},{"version":"R32","lessThan":"R32 P7","versionType":"custom","status":"affected"}]},{"vendor":"F5","product":"NGINX Open Source","defaultStatus":"unaffected","modules":["ngx_http_rewrite_module"],"versions":[{"version":"1.31.0","lessThan":"1.31.1","versionType":"custom","status":"affected"},{"version":"1.30.0","lessThan":"1.30.2","versionType":"custom","status":"affected"},{"version":"0.1.17","lessThanOrEqual":"0.9.7","versionType":"custom","status":"affected"}]}]

OR
          *cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:* versions from (including) r32 up to (including) r36
          *cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:* versions from (including) 0.1.17 up to (including) 0.9.7
          *cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:* versions from (including) 1.0.0 up to (including) 1.30.1
          *cpe:2.3:a:f5:nginx_open_source:1.31.0:*:*:*:*:*:*:*
          *cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:* versions from (including) 37.0.0 up to (excluding) 37.0.1.1

CVE: http://www.openwall.com/lists/oss-security/2026/05/22/14 Types: Mailing List, Third Party Advisory

F5 Networks: https://my.f5.com/manage/s/article/K000161377 Types: Mitigation, Vendor Advisory

http://www.openwall.com/lists/oss-security/2026/05/22/14

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures (for example, ^/((.*))$) and a replacement string that references multiple such captures (for example, $1$2) in a redirect or arguments context. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-122

https://my.f5.com/manage/s/article/K000161377