CVE-2026-42945

NGINX ngx_http_rewrite_module vulnerability

CRITICAL 9.2

En bref

Source: NVD
EPSS: EPSS 68.05 % · centile 99 (2026-10-28)
État: PUBLISHED
Publiée: 2026-05-13 14:12 UTC
Mise à jour: 2026-09-10 12:04 UTC
Attribuée par: f5
Statut NVD: Modified

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Faiblesses (CWE)

CWE-122 — Débordement de tampon sur le tas
CWE-131 — Calcul incorrect de la taille d'un tampon

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	f5
CVSS 4.0	CRITICAL 9.2	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	f5
CVSS 3.1	HIGH 8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	redhat-SADP
CVSS 4.0	CRITICAL 9.2	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · f5sirt@f5.com (Secondary)
CVSS 3.1	HIGH 8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · f5sirt@f5.com (Secondary)
CVSS 3.1	HIGH 8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary)

Références européennes

ENISA EUVD · EUVD-2026-30010
GCVE · GCVE-0-2026-42945

Avis du CERT-FR

CERTFR-2026-AVI-1056 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
CERTFR-2026-AVI-0998 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
CERTFR-2026-AVI-0750 — Vulnérabilité dans les produits HPE Aruba Networking · cert.ssi.gouv.fr
CERTFR-2026-AVI-0612 — Multiples vulnérabilités dans les produits Microsoft · cert.ssi.gouv.fr
CERTFR-2026-AVI-0591 — Multiples vulnérabilités dans les produits F5 · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:f5:dos:*:*:*:*:*:nginx:*:* ≥ 4.3.0 ≤ 4.7.0
cpe:2.3:a:f5:dos:4.8.0:*:*:*:*:nginx:*:*
cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:* ≥ 1.3.0 ≤ 1.6.2
cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:* ≥ 2.0.0 ≤ 2.5.1
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:* ≥ 3.5.0 ≤ 3.7.2
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:* ≥ 4.0.0 ≤ 4.0.1
cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:* ≥ 5.0.0 ≤ 5.4.1
cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:* ≥ 2.16.0 ≤ 2.21.1
cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:* ≥ 0.6.27 ≤ 1.30.0
cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:* ≥ r32 ≤ r36
cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:* ≥ 4.9.0 ≤ 4.16.0
cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:* ≥ 5.1.0 ≤ 5.8.0
cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:* ≥ 5.9.0 ≤ 5.12.1

Produits affectés

Produit	Versions
F5 · NGINX Plus	unaffected R37 < * ; affected R36 < R36 P4 ; affected R32 < R32 P6
F5 · NGINX Open Source	unaffected 1.31.0 < * ; affected 0.6.27 < 1.30.1

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD