https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 19 Aug 2026 12:22:55 +0000 https://vulnerability.circl.lu/sighting/2734ae7d-fbc2-4187-b30b-92d16fcbe100/export {"uuid": "2734ae7d-fbc2-4187-b30b-92d16fcbe100", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42533", "type": "seen", "source": "https://gist.github.com/alon710/655c244f0d667e1d7ba0e5f0781413ad", "content": "# CVE-2026-42533: CVE-2026-42533: NGINX Map Directive and Regex Matching Pre-Auth Heap Buffer Overflow & Info Leak\n\n> **CVSS Score:** 9.2\n> **Published:** 2026-07-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-42533\n\n## Summary\nCVE-2026-42533 is a critical security vulnerability discovered in NGINX Open Source, NGINX Plus, NGINX Ingress Controller, and related products, referred to as the 'Two-Pass Capture-Clobbering' bug. The flaw is situated within NGINX's internal evaluation engine when handling complex variables, exposing a heap-based buffer overflow and information leak when a configuration chains regular expression-based map directives with numbered capture groups. An unauthenticated remote attacker can exploit this weakness by transmitting crafted HTTP requests to trigger remote code execution or defeat ASLR.\n\n## TL;DR\nA pre-authentication heap buffer overflow and ASLR bypass in NGINX caused by regex capture state clobbering, permitting remote code execution under specific map configurations.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-119 / CWE-122\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v3.1 Score**: 8.1 (High)\n- **CVSS v4.0 Score**: 9.2 (Critical)\n- **Exploit Status**: Proof-of-Concept / Weaponized Exploit Available\n- **CISA KEV**: No\n\n## Affected Systems\n\n- NGINX Open Source (Stable and Mainline)\n- NGINX Plus\n- NGINX Ingress Controller\n- NGINX WAF\n- NGINX Gateway Fabric\n- **NGINX Open Source (Stable)**: 0.9.6 to 1.30.3 (Fixed in: `1.30.4`)\n- **NGINX Open Source (Mainline)**: 0.9.6 to 1.31.2 (Fixed in: `1.31.3`)\n- **NGINX Plus**: R33 to R36 (up to P6) (Fixed in: `R36 P7 / 37.0.3.1`)\n\n## Mitigation\n\n- Upgrade NGINX binaries to the patched versions immediately.\n- Refactor NGINX configurations to utilize named capture groups rather than numbered capture groups within regular expressions.\n- Monitor system error logs for NGINX worker process exit signals, particularly SIGABRT (signal 6) and SIGSEGV (signal 11).\n\n**Remediation Steps:**\n1. Scan existing NGINX configuration files for regex-based map directives containing numbered capture references.\n2. Verify matches against the complex-value sink criteria where map variables and numbered captures are combined.\n3. Apply updates to stable/mainline packages or deploy patched vendor containers.\n4. In situations where updating is delayed, rewrite configurations to utilize named groups like (?...) to bypass the vulnerable global captures array.\n5. Reload the NGINX configuration using 'nginx -s reload' and verify functionality.\n\n## References\n\n- [Official NGINX Advisory & F5 SIRT Portal](https://my.f5.com/manage/s/article/K000162097)\n- [0xCyberstan Technical Deep Dive & Exploitation Writeup](https://cyberstan.co.uk/nginx-rce/)\n- [0xCyberstan Static Configuration Vulnerability Scanner](https://github.com/0xCyberstan/CVE-2026-42533-Config-Scanner)\n- [Open Source Vulnerabilities (OSV) Record](https://osv.dev/vulnerability/CVE-2026-42533)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-42533) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-19T12:02:10.200334Z"} {"uuid": "2734ae7d-fbc2-4187-b30b-92d16fcbe100", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42533", "type": "seen", "source": "https://gist.github.com/alon710/655c244f0d667e1d7ba0e5f0781413ad", "content": "# CVE-2026-42533: CVE-2026-42533: NGINX Map Directive and Regex Matching Pre-Auth Heap Buffer Overflow & Info Leak\n\n> **CVSS Score:** 9.2\n> **Published:** 2026-07-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-42533\n\n## Summary\nCVE-2026-42533 is a critical security vulnerability discovered in NGINX Open Source, NGINX Plus, NGINX Ingress Controller, and related products, referred to as the 'Two-Pass Capture-Clobbering' bug. The flaw is situated within NGINX's internal evaluation engine when handling complex variables, exposing a heap-based buffer overflow and information leak when a configuration chains regular expression-based map directives with numbered capture groups. An unauthenticated remote attacker can exploit this weakness by transmitting crafted HTTP requests to trigger remote code execution or defeat ASLR.\n\n## TL;DR\nA pre-authentication heap buffer overflow and ASLR bypass in NGINX caused by regex capture state clobbering, permitting remote code execution under specific map configurations.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-119 / CWE-122\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v3.1 Score**: 8.1 (High)\n- **CVSS v4.0 Score**: 9.2 (Critical)\n- **Exploit Status**: Proof-of-Concept / Weaponized Exploit Available\n- **CISA KEV**: No\n\n## Affected Systems\n\n- NGINX Open Source (Stable and Mainline)\n- NGINX Plus\n- NGINX Ingress Controller\n- NGINX WAF\n- NGINX Gateway Fabric\n- **NGINX Open Source (Stable)**: 0.9.6 to 1.30.3 (Fixed in: `1.30.4`)\n- **NGINX Open Source (Mainline)**: 0.9.6 to 1.31.2 (Fixed in: `1.31.3`)\n- **NGINX Plus**: R33 to R36 (up to P6) (Fixed in: `R36 P7 / 37.0.3.1`)\n\n## Mitigation\n\n- Upgrade NGINX binaries to the patched versions immediately.\n- Refactor NGINX configurations to utilize named capture groups rather than numbered capture groups within regular expressions.\n- Monitor system error logs for NGINX worker process exit signals, particularly SIGABRT (signal 6) and SIGSEGV (signal 11).\n\n**Remediation Steps:**\n1. Scan existing NGINX configuration files for regex-based map directives containing numbered capture references.\n2. Verify matches against the complex-value sink criteria where map variables and numbered captures are combined.\n3. Apply updates to stable/mainline packages or deploy patched vendor containers.\n4. In situations where updating is delayed, rewrite configurations to utilize named groups like (?...) to bypass the vulnerable global captures array.\n5. Reload the NGINX configuration using 'nginx -s reload' and verify functionality.\n\n## References\n\n- [Official NGINX Advisory & F5 SIRT Portal](https://my.f5.com/manage/s/article/K000162097)\n- [0xCyberstan Technical Deep Dive & Exploitation Writeup](https://cyberstan.co.uk/nginx-rce/)\n- [0xCyberstan Static Configuration Vulnerability Scanner](https://github.com/0xCyberstan/CVE-2026-42533-Config-Scanner)\n- [Open Source Vulnerabilities (OSV) Record](https://osv.dev/vulnerability/CVE-2026-42533)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-42533) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-19T12:02:10.200334Z"} https://vulnerability.circl.lu/sighting/2734ae7d-fbc2-4187-b30b-92d16fcbe100/export Wed, 19 Aug 2026 12:02:10 +0000 https://vulnerability.circl.lu/sighting/b62d29c9-1b2c-4d5c-86ea-dc318af844ac/export {"uuid": "b62d29c9-1b2c-4d5c-86ea-dc318af844ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42530", "type": "seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3msy2tbbzza2z", "content": "Use-after-free in the QPACK encoder of nginx HTTP/3 - CVE-2026-42530", "creation_timestamp": "2026-08-13T16:28:43.093123Z"} {"uuid": "b62d29c9-1b2c-4d5c-86ea-dc318af844ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42530", "type": "seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3msy2tbbzza2z", "content": "Use-after-free in the QPACK encoder of nginx HTTP/3 - CVE-2026-42530", "creation_timestamp": "2026-08-13T16:28:43.093123Z"} https://vulnerability.circl.lu/sighting/b62d29c9-1b2c-4d5c-86ea-dc318af844ac/export Thu, 13 Aug 2026 16:28:43 +0000 https://vulnerability.circl.lu/sighting/3abfb907-d5fd-474b-a5e9-14a9c9754a04/export {"uuid": "3abfb907-d5fd-474b-a5e9-14a9c9754a04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-42534", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2007", "content": "", "creation_timestamp": "2026-08-13T08:47:08.674357Z"} {"uuid": "3abfb907-d5fd-474b-a5e9-14a9c9754a04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-42534", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2007", "content": "", "creation_timestamp": "2026-08-13T08:47:08.674357Z"} https://vulnerability.circl.lu/sighting/3abfb907-d5fd-474b-a5e9-14a9c9754a04/export Thu, 13 Aug 2026 08:47:08 +0000 https://vulnerability.circl.lu/sighting/c139a31e-0f82-49a1-a18a-0dfe744cbe27/export {"uuid": "c139a31e-0f82-49a1-a18a-0dfe744cbe27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42537", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msvlklxcdv25", "content": "CVE-2026-42537 - apache ranger\nApache Ranger versions 2.8.0 and below are vulnerable to a security issue that could allow attackers to execute malicious code on a server. This affects users who\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apacheranger #apachefoundation #CVE #infosec", "creation_timestamp": "2026-08-12T16:50:06.271284Z"} {"uuid": "c139a31e-0f82-49a1-a18a-0dfe744cbe27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42537", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msvlklxcdv25", "content": "CVE-2026-42537 - apache ranger\nApache Ranger versions 2.8.0 and below are vulnerable to a security issue that could allow attackers to execute malicious code on a server. This affects users who\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apacheranger #apachefoundation #CVE #infosec", "creation_timestamp": "2026-08-12T16:50:06.271284Z"} https://vulnerability.circl.lu/sighting/c139a31e-0f82-49a1-a18a-0dfe744cbe27/export Wed, 12 Aug 2026 16:50:06 +0000 https://vulnerability.circl.lu/sighting/9973c92f-1c78-4b55-a3b7-63702ab90ffa/export {"uuid": "9973c92f-1c78-4b55-a3b7-63702ab90ffa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-42534", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/f5-products-denial-of-service-vulnerability_20260811", "content": "", "creation_timestamp": "2026-08-11T04:45:05.899979Z"} {"uuid": "9973c92f-1c78-4b55-a3b7-63702ab90ffa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-42534", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/f5-products-denial-of-service-vulnerability_20260811", "content": "", "creation_timestamp": "2026-08-11T04:45:05.899979Z"} https://vulnerability.circl.lu/sighting/9973c92f-1c78-4b55-a3b7-63702ab90ffa/export Tue, 11 Aug 2026 04:45:05 +0000 https://vulnerability.circl.lu/sighting/1b686b75-1844-42ea-be56-1248b2186ccb/export {"uuid": "1b686b75-1844-42ea-be56-1248b2186ccb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42533", "type": "published-proof-of-concept", "source": "Telegram/zAJ5TWBIUoS-Z2Q79eIMtdFrdAnvwlKVqfHngA-3uEfDl5Y", "content": "", "creation_timestamp": "2026-08-08T00:08:31.530547Z"} {"uuid": "1b686b75-1844-42ea-be56-1248b2186ccb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42533", "type": "published-proof-of-concept", "source": "Telegram/zAJ5TWBIUoS-Z2Q79eIMtdFrdAnvwlKVqfHngA-3uEfDl5Y", "content": "", "creation_timestamp": "2026-08-08T00:08:31.530547Z"} https://vulnerability.circl.lu/sighting/1b686b75-1844-42ea-be56-1248b2186ccb/export Sat, 08 Aug 2026 00:08:31 +0000 https://vulnerability.circl.lu/sighting/ab2eef8e-dd05-4a29-ab46-ea0c0f9adc33/export {"uuid": "ab2eef8e-dd05-4a29-ab46-ea0c0f9adc33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42533", "type": "seen", "source": "Telegram/93z-LIlEULZWbnwEzYtTEAqd1z1QFNuHcbWGMZMdxRz5WQ4", "content": "", "creation_timestamp": "2026-08-08T00:06:20.473766Z"} {"uuid": "ab2eef8e-dd05-4a29-ab46-ea0c0f9adc33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42533", "type": "seen", "source": "Telegram/93z-LIlEULZWbnwEzYtTEAqd1z1QFNuHcbWGMZMdxRz5WQ4", "content": "", "creation_timestamp": "2026-08-08T00:06:20.473766Z"} https://vulnerability.circl.lu/sighting/ab2eef8e-dd05-4a29-ab46-ea0c0f9adc33/export Sat, 08 Aug 2026 00:06:20 +0000 https://vulnerability.circl.lu/sighting/cc950274-0c0a-46dc-bb50-dcfc3a5aec10/export {"uuid": "cc950274-0c0a-46dc-bb50-dcfc3a5aec10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42533", "type": "seen", "source": "Telegram/93z-LIlEULZWbnwEzYtTEAqd1z1QFNuHcbWGMZMdxRz5WQ4", "content": "", "creation_timestamp": "2026-08-07T10:17:15.436940Z"} {"uuid": "cc950274-0c0a-46dc-bb50-dcfc3a5aec10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42533", "type": "seen", "source": "Telegram/93z-LIlEULZWbnwEzYtTEAqd1z1QFNuHcbWGMZMdxRz5WQ4", "content": "", "creation_timestamp": "2026-08-07T10:17:15.436940Z"} https://vulnerability.circl.lu/sighting/cc950274-0c0a-46dc-bb50-dcfc3a5aec10/export Fri, 07 Aug 2026 10:17:15 +0000 https://vulnerability.circl.lu/sighting/537011e4-9918-42da-888b-d8b5952e8a42/export {"uuid": "537011e4-9918-42da-888b-d8b5952e8a42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42533", "type": "seen", "source": "Telegram/zAJ5TWBIUoS-Z2Q79eIMtdFrdAnvwlKVqfHngA-3uEfDl5Y", "content": "", "creation_timestamp": "2026-08-07T10:17:15.136149Z"} {"uuid": "537011e4-9918-42da-888b-d8b5952e8a42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42533", "type": "seen", "source": "Telegram/zAJ5TWBIUoS-Z2Q79eIMtdFrdAnvwlKVqfHngA-3uEfDl5Y", "content": "", "creation_timestamp": "2026-08-07T10:17:15.136149Z"} https://vulnerability.circl.lu/sighting/537011e4-9918-42da-888b-d8b5952e8a42/export Fri, 07 Aug 2026 10:17:15 +0000 https://vulnerability.circl.lu/sighting/8f85a474-12ac-4ddb-a0e9-abb5dce43eb1/export {"uuid": "8f85a474-12ac-4ddb-a0e9-abb5dce43eb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42533", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/96807", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-42533-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xCyberstan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-05 18:23:02\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-42533: pre-auth nginx heap overflow and info leak from PCRE capture clobbering in the map/script engine, chained to RCE.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-06T00:00:24.105398Z"} {"uuid": "8f85a474-12ac-4ddb-a0e9-abb5dce43eb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42533", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/96807", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-42533-POC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a 0xCyberstan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-08-05 18:23:02\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-42533: pre-auth nginx heap overflow and info leak from PCRE capture clobbering in the map/script engine, chained to RCE.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-08-06T00:00:24.105398Z"} https://vulnerability.circl.lu/sighting/8f85a474-12ac-4ddb-a0e9-abb5dce43eb1/export Thu, 06 Aug 2026 00:00:24 +0000