Fedora Account System
Red Hat Associate
Red Hat Customer
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Additional information: According to The Hacker News, the researcher plans to publish a PoC 21 days after the patch release, around August 5, 2026. https://thehackernews.com/2026/07/critical-nginx-vulnerability-can-crash.html
https://access.redhat.com/security/cve/cve-2026-42533 It seems you rated this as "Moderate", because you changed the Confidentiality and Integrity Impact to "Low" from "High" -- for a RCE, is that correct?
Additional information: A public PoC/exploit was released on July 27, 2026, earlier than the previously announced August 5 date. The repository demonstrates an unauthenticated nginx worker crash and claims a working pre-auth RCE chain on Ubuntu 24.04. https://github.com/imbas007/cve-2026-42533
Additional information: A separate exploit implementation for CVE-2026-42533 has now been published by DepthFirst Disclosures. Unlike the previously referenced HTTP/map-based repository, this PoC uses the stream ssl_preread script-engine path. It demonstrates command execution and a reverse shell in the supplied local Docker environment. The exploit offsets are explicitly calibrated for the provided Docker image, so this should not be interpreted as a generally reliable exploit against arbitrary nginx deployments. https://github.com/DepthFirstDisclosures/Nginx-Rift/tree/main/CVE-2026-42533
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:66542 https://access.redhat.com/errata/RHSA-2026:66542
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:67283 https://access.redhat.com/errata/RHSA-2026:67283
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:67315 https://access.redhat.com/errata/RHSA-2026:67315
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:67308 https://access.redhat.com/errata/RHSA-2026:67308
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:67314 https://access.redhat.com/errata/RHSA-2026:67314
This comment was flagged as spam, view the edit history to see the original text if required.