15 matches found
CVE-2026-42533-nginx
CVE-2026-42533 nginx This repository contains a Go-based scanner for identifying nginx configuration patterns associated with the complexvalue two-pass capture-clobbering issue described in CVE-2026-42533. Overview The tool analyzes nginx configuration files and directories to detect risky...
CVE-2026-42533-POC
CVE-2026-42533 Pre-auth heap buffer overflow and heap information leak in nginx, caused by missing save/restore of PCRE capture state across the two passes of the script engine. A regex map variable evaluated between two capture references overwrites r-captures, so the LEN pass and the VALUE pass...
CVE-2026-42533-Config-Scanner
nginx capture-clobber scanner A read-only static scanner that flags nginx configurations vulnerable to the complexvalue two-pass capture-clobbering bug class F5/nginx SIRT advisory, July 2026. It parses your config and reports the vulnerable pattern with the reason and location. It does not explo...
USN-8563-3: nginx vulnerability
USN-8563-1 fixed vulnerabilities in nginx. The fix for CVE-2026-42533 was backed out in USN-8563-2 because it could cause a regression. This update includes a better fix for CVE-2026-42533. We apologize for the inconvenience. Original advisory details: It was discovered that nginx incorrectly...
TencentOS Server 4: nginx (TSSA-2026:0673)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0673 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...
nginx 1.15.8 < 1.30.4 / 1.31.2 < 1.31.3 Memory Disclosure
According to its Server response header, the installed version of nginx is 1.30.0 prior to 1.30.4, or 1.31.2 prior to 1.31.3. It is, therefore, affected by memory disclosure vulnerability: - NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpslicemodule module. When the slice...
nginx: NGINX: Arbitrary code execution via crafted HTTP requests
A flaw was found in NGINX. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests when the map directive uses regular expression regex matching and references regex capture variables before referencing the map output variable. This can lead to a heap...
CLSA-2026-1784888515 nginx: Fix of CVE-2026-42533
CVE-2026-42533: add script engine buffer-overrun protection to fix heap overflow and info-leak via regex map capture variables...
CLSA-2026-1784800978 nginx: Fix of CVE-2026-42533
CVE-2026-42533: add script engine buffer-overrun protection to fix heap overflow and info-leak via regex map capture variables...
CLSA-2026-1784800609 nginx: Fix of CVE-2026-42533
CVE-2026-42533: add script engine buffer-overrun protection to fix heap overflow and info-leak via regex map capture variables...
CLSA-2026-1784800112 nginx: Fix of CVE-2026-42533
CVE-2026-42533: add script engine buffer-overrun protection to fix heap overflow and info-leak via regex map capture variables...
CLSA-2026-1784715967 Fix CVE(s): CVE-2026-42533
SECURITY UPDATE: heap buffer overflow and info-leak via regex map capture variables - debian/patches/CVE-2026-42533.patch: add script engine buffer-overrun protection - CVE-2026-42533...
CLSA-2026-1784632234 Fix CVE(s): CVE-2026-42533
SECURITY UPDATE: heap buffer overflow and info-leak via regex map capture variables - debian/patches/CVE-2026-42533.patch: add script engine buffer-overrun protection - CVE-2026-42533...
CVE-2026-42533
A flaw was found in NGINX. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests when the map directive uses regular expression regex matching and references regex capture variables before referencing the map output variable. This can lead to a heap...
