39 matches found
nginx: NGINX: Arbitrary code execution via crafted HTTP requests
A flaw was found in NGINX. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests when the map directive uses regular expression regex matching and references regex capture variables before referencing the map output variable. This can lead to a heap...
nginx: NGINX: Arbitrary code execution via crafted HTTP requests
A flaw was found in NGINX. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests when the map directive uses regular expression regex matching and references regex capture variables before referencing the map output variable. This can lead to a heap...
nginx: NGINX: Arbitrary code execution via crafted HTTP requests
A flaw was found in NGINX. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests when the map directive uses regular expression regex matching and references regex capture variables before referencing the map output variable. This can lead to a heap...
CVE-2026-42533
CVE-2026-42533 — nginx 堆缓冲区溢出 PoC 漏洞利用 通过双遍捕获覆写实现未认证远程代码执行 公开 PoC 已于 2026-07-27 发布 — 不要再等待，请立即修补。 | ---|--- CVE| CVE-2026-42533 CVSS 4.0| 9.2（严重） 类型| 堆缓冲区溢出（CWE-122） 影响版本| nginx 0.9.6 – 1.30.3（稳定版），0.9.6 – 1.31.2（主线版） 修复版本| nginx 1.30.4 / 1.31.3，NGINX Plus R36 P7 / 37.0.3.1 披露时间| 2026-07-15（F5 /...
nginx: NGINX: Arbitrary code execution via crafted HTTP requests
A flaw was found in NGINX. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests when the map directive uses regular expression regex matching and references regex capture variables before referencing the map output variable. This can lead to a heap...
nginx-map-risk-audit
CVE-2026-42533：NGINX Map 正则表达式风险审查 关于 CVE-2026-42533 的防御性研究笔记，该漏洞是 NGINX 请求处理中的堆缓冲区溢出，与带有正则表达式捕获的 map 指令及某些变量求值模式有关。 用通俗的话说：NGINX 是 Web 服务器和反向代理软件。它通常位于网站和 API 前面，接收 Web 请求并决定将其发送到何处。map 规则是 NGINX 配置的一项功能，表示“如果这个请求值看起来像 X，就将这个变量设为 Y”。正则表达式捕获是从模式匹配中提取出的文本片段。 这个 CVE 之所以重要，是因为某些较旧的 NGINX 版本会错误地处理特定类...
nginx: NGINX: Arbitrary code execution via crafted HTTP requests
A flaw was found in NGINX. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests when the map directive uses regular expression regex matching and references regex capture variables before referencing the map output variable. This can lead to a heap...
CVE-2026-42533
NGINX Vulnerability Checker 一个用于以非侵入式 方式检查 NGINX 安装是否可能受到漏洞 CVE-2026-42533 影响的脚本。 重要提示： 本项目不会利用该漏洞 。它仅对已安装版本和服务器配置执行本地检查，以识别可能存在的暴露风险。 功能特性 检测 NGINX 是否已安装。 获取已安装的版本。 将当前版本与已修复版本进行比较。 查找使用了 map 指令的配置。 检测配置文件中对正则表达式（ 和 ）的使用。 生成包含安装状态的摘要。 要求 Linux Bash 已安装 NGINX 对 /etc/nginx 的读取权限 使用方法 赋予执行权限：...
openSUSE 16 Security Update : nginx (openSUSE-SU-2026:21524-1)
The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21524-1 advisory. This update for nginx fixes the following issue - CVE-2026-42533: map directive and regex matching vulnerability bsc1271514. Tenable has extracted the...
Security update for nginx (important)
openSUSE security update: security update for nginx ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21524-1 Rating: important References: bsc1271514 Cross-References: CVE-2026-42533 CVSS scores: CVE-2026-42533 SUSE : 8.1...
SUSE-SU-2026:23140-1 Security update for nginx
This update for nginx fixes the following issue - CVE-2026-42533: map directive and regex matching vulnerability bsc1271514...
SUSE-SU-2026:23118-1 Security update for nginx
This update for nginx fixes the following issue - CVE-2026-42533: map directive and regex matching vulnerability bsc1271514...
OPENSUSE-SU-2026:21524-1 Security update for nginx
This update for nginx fixes the following issue - CVE-2026-42533: map directive and regex matching vulnerability bsc1271514...
SUSE SLES15 Security Update : nginx (SUSE-SU-2026:3448-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3448-1 advisory. - CVE-2026-42055: heap buffer overflow in the ngxhttpproxyv2module and ngxhttpgrpcmodule modules bsc1268492. - CVE-2026-42533: heap...
Important: nginx
Issue Overview: A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a...
Security update for nginx
This update for nginx fixes the following issues: CVE-2026-42055: heap buffer overflow in the ngxhttpproxyv2module and ngxhttpgrpcmodule modules bsc1268492. CVE-2026-42533: heap buffer overflow in the map directive and regex matching bsc1271514. CVE-2026-48142: heap buffer overread in the...
SUSE-SU-2026:3448-1 Security update for nginx
This update for nginx fixes the following issues: - CVE-2026-42055: heap buffer overflow in the ngxhttpproxyv2module and ngxhttpgrpcmodule modules bsc1268492. - CVE-2026-42533: heap buffer overflow in the map directive and regex matching bsc1271514. - CVE-2026-48142: heap buffer overread in the...
MGASA-2026-0301 Updated nginx packages fix security vulnerabilities
CVE-2026-42533: Heap buffer overflow might occur in a worker process when using the map directive with regex matching if the map variable was included in a string expression after a capture affected by this map; a similar issue might happen when using a non-cacheable variable in a string...
