Описание
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Impact:
This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
A flaw was found in nginx. A remote, unauthenticated attacker can trigger a heap-based buffer overflow by sending crafted HTTP requests to a server configured with specific alias and rewrite directives that reference the request filename variable. Successful exploitation may allow an attacker to achieve arbitrary code execution or cause a Denial of Service (DoS) by crashing worker processes.
Отчет
An IMPORTANT severity heap-based buffer overflow was found in nginx (ngx_http_core_module), affecting the nginx component in Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS, Red Hat Hardened Images, and Red Hat's services management platform (cloud.redhat.com). A remote, unauthenticated attacker can send crafted HTTP requests to trigger a heap-based buffer overflow in the nginx worker process on servers configured with a location that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable, or where the $request_filename variable is used in an access log format directive. Exploitation requires this specific configuration and conditions beyond the attacker's control; a successful attack crashes the worker process, causing a denial of service, and may allow code execution on systems with ASLR disabled or where the attacker can bypass ASLR. This is a data plane issue with no control plane exposure. Red Hat rates this flaw as IMPORTANT (CVSS 3.1 score 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), which is lower than the upstream CVSS 4.0 rating of 9.2 CRITICAL, because exploitation depends on a specific server configuration. A fix is being pursued for the affected products.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | nginx | Affected | ||
| Red Hat Enterprise Linux 8 | nginx | Not affected | ||
| Red Hat Enterprise Linux 8 | nginx:1.24/nginx | Affected | ||
| Red Hat Enterprise Linux 9 | nginx | Affected | ||
| Red Hat Enterprise Linux 9 | nginx:1.24/nginx | Affected | ||
| Red Hat Enterprise Linux 9 | nginx:1.26/nginx | Affected | ||
| Red Hat Hardened Images | php | Not affected | ||
| Red Hat Hardened Images | nginx-main-1.30.6-1.hum1 | Fixed | RHSA-2026:83427 | 15.10.2026 |
Показывать по
Дополнительная информация
Статус:
8.1 High
CVSS3
Связанные уязвимости
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Suppo...
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Sup
A vulnerability exists in NGINX Plus and NGINX Open Source when a loca ...
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical ...
8.1 High
CVSS3