CVE-2026-42533

CVE-2026-42533 — nginx 堆缓冲区溢出 PoC 漏洞利用 通过双遍捕获覆写实现未认证远程代码执行 公开 PoC 已于 2026-07-27 发布 — 不要再等待，请立即修补。 | ---|--- CVE| CVE-2026-42533 CVSS 4.0| 9.2（严重） 类型| 堆缓冲区溢出（CWE-122） 影响版本| nginx 0.9.6 – 1.30.3（稳定版），0.9.6 – 1.31.2（主线版） 修复版本| nginx 1.30.4 / 1.31.3，NGINX Plus R36 P7 / 37.0.3.1 披露时间| 2026-07-15（F5 /...

CVE-2026-42533

CVE-2026-42533 — nginx 2パスキャプチャ上書き（two-pass capture clobbering） nginx（0.9.6–1.30.3 / mainline ≤1.31.2）の複雑値スクリプトエンジンにおける認証前ヒープオーバーフロー + 情報漏洩；CVSS 9.2。同一の根本原因には2つのトリガー面がある：HTTP （regex location + regex map）と stream （sslpreread + SNI + regex map）。 詳細な技術分析と訂正については ANALYSIS.md を参照。 プロジェクト構成 . ├──...

CVE-2026-42533

CVE-2026-42533 实验环境 — NGINX 两遍捕获覆盖 RCE CVSS 9.2（严重） — nginx 中的预认证堆缓冲区溢出 + 信息泄露 受影响版本：nginx 0.9.6 – 1.30.3 / 1.31.2 | 已修复版本：1.30.4 / 1.31.3 架构 ┌─────────────────────────────────────┐ │ 宿主机 │ │ │ PoC 脚本 ─────────┤ :8080 ──► nginx-vuln 1.26.x │ │ │ 存在漏洞 │ │ ▼ │ │ backend Python echo │ │ ▲ │ │ │ │ │...

Nginx-Rift

NGINX Rift RCE 概念验证，针对 CVE-2026-42945 ——这是 NGINX ngxhttprewritemodule 中一个于 2008 年引入的严重堆缓冲区溢出漏洞。该漏洞使得攻击者能够对使用 rewrite 和 set 指令的服务器进行未经认证的远程代码执行。 该漏洞与另外三个内存破坏问题（CVE-2026-42946、CVE-2026-40701、CVE-2026-42934）一同，由 depthfirst 的安全分析系统在单击一次接入 NGINX 源码后自动发现。...

CVE-2026-42945-POC

CVE-2026-42945 CVE-2026-42945 的 RCE 概念验证，这是一个于 2008 年引入的 NGINX ngxhttprewritemodule 中的严重堆缓冲区溢出漏洞。该漏洞允许攻击者针对使用 rewrite 和 set 指令的服务器进行未经身份验证的远程代码执行。 该漏洞与另外三个内存破坏问题（CVE-2026-42946、CVE-2026-40701、CVE-2026-42934）一样，都是由 depthfirst 的安全分析系统在只需单击一次即可导入 NGINX 源代码后自主发现的。 漏洞（TL;DR） NGINX...

CVE-2026-42533-Config-Scanner

nginx capture-clobber scanner A read-only static scanner that flags nginx configurations vulnerable to the complexvalue two-pass capture-clobbering bug class F5/nginx SIRT advisory, July 2026. It parses your config and reports the vulnerable pattern with the reason and location. It does not explo...

CVE-2026-42533

CVE-2026-42533 — nginx map/regex 捕获覆盖跟踪站点 CVE-2026-42533 补丁状态跟踪器的源文件：一个单页站点， 记录各发行版是否已发布针对 nginx map/regex 捕获覆盖堆溢出的修复。 事实所在之处 关于该漏洞的一切——受影响版本与已修复版本、上游修复、 发现与披露致谢，以及当前各发行版的补丁状态——都属于跟踪页面， 而非本 README： 渲染页面： https://kimmo.cloud/CVE-2026-42533/ 源文件： site/content/index.md 编辑该文件；本仓库中的其他所有内容都是构建基础设施。...

Exploit for Heap-based Buffer Overflow in F5 Nginx_Gateway_Fabric

CVE-2026-42533 Lab — NGINX Two-Pass Capture Clobbering RCE...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power of the local static private key x without any range or subgroup-membership check, while...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power of the local static private key x without any range or subgroup-membership check, while...

Improper Input Validation

Overview org.bouncycastle:bcprov-debug-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power of the local static private key x without any range or subgroup-membership check, while...

Improper Input Validation

Overview org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power o...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power of the local static private key x without any range or subgroup-membership check, while...

FreeBSD Security Advisory - FreeBSD-SA-26:55.elf

FreeBSD Security Advisory - The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them. A process sharing the address space via rfork2 can mutate the map between the two...

CVE-2026-56722 Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not...

CVE-2026-55717

In NLnet Labs Unbound 1.10.0 up to and including 1.25.1, when 'serve-expired: yes' is set together with a 'response-ip: redirect' /'response-ip-data: CNAME ' rule or the RPZ 'rpz-cname-override' equivalent, a remote client who controls any delegated domain can crash the daemon. The...

Exploit for CVE-2026-42533

nginx capture-clobber scanner A read-only static scanner that...

GHSA-4XGF-CPJX-PC3J pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size

Summary NestedSecretsSettingsSource reads secret values from files in a configured secretsdir. When secretsnestedsubdir=True, a directory entry inside secretsdir that is a symbolic link pointing outside secretsdir is followed, so files outside the configured directory are read into settings value...

Sveltia CMS: Stored XSS in Markdown/RichText preview via unsandboxed same-origin iframe

Impact A stored cross-site scripting XSS vulnerability affected the Markdown/RichText field preview renderer in Sveltia CMS. The DOMPurify sanitization configuration used for Markdown previews explicitly permitted iframe elements without enforcing a sandbox attribute or restricting iframe sources...