CVE-2026-42945

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 8.1EPSS 3%

Published 2026-05-13Updated 2026-05-16

Exploited in the wildMedia 8808227PoC

Vulnerability details

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CNAf5

EPSS score history

Sources

65 links

PoC links are not available for guest users. Login to view them.

Profile

CVSS

8.1

EPSS

Published

2026-05-13

Updated

2026-05-16

CNA

Vendors

2 products

CPEs

cpe:/o:redhat:enterprise_linux_eus:10.0

cpe:/o:redhat:enterprise_linux:10.1

cpe:/o:redhat:enterprise_linux:10.2

cpe:/a:redhat:enterprise_linux:8::appstream

cpe:/a:redhat:rhel_e4s:9.0::appstream

cpe:/a:redhat:rhel_e4s:9.2::appstream

cpe:/a:redhat:rhel_eus:9.4::appstream

cpe:/a:redhat:rhel_eus:9.6::appstream

cpe:/a:redhat:enterprise_linux:9::appstream

cpe:/a:redhat:rhel_eus:9.4::crb

cpe:/a:redhat:rhel_eus:9.6::crb

cpe:/a:redhat:enterprise_linux:9::crb

cpe:/a:redhat:hummingbird:1

cpe:/a:redhat:openshift_data_foundation:4.14::el9

cpe:/a:redhat:openshift_data_foundation:4.15::el9

cpe:/a:redhat:openshift_data_foundation:4.16::el9

cpe:/a:redhat:openshift_data_foundation:4.17::el9

cpe:/a:redhat:openshift_data_foundation:4.18::el9

cpe:/a:redhat:openshift_data_foundation:4.19::el9

cpe:/a:redhat:openshift_data_foundation:4.21::el9

cpe:/a:redhat:openshift_data_foundation:4.20::el9

cpe:/a:redhat:satellite:6.18::el9

cpe:/a:redhat:satellite:6.19::el9

cpe:/a:redhat:rhui:5::el9

cpe:/a:redhat:red_hat_3scale_amp:2

cpe:/a:redhat:insights_proxy:1

cpe:/a:redhat:enterprise_linux:8

cpe:/a:redhat:enterprise_linux:9

cpe:/a:redhat:rhel_e4s:9.0

cpe:/a:redhat:rhel_e4s:9.2

cpe:/a:redhat:rhel_eus:9.4

cpe:/a:redhat:rhel_eus:9.6

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated