CVE-2026-15176
Description
A flaw was found in nginx. A remote, unauthenticated attacker can trigger a heap-based buffer overflow by sending crafted HTTP requests to a server configured with specific alias and rewrite directives that reference the request filename variable. Successful exploitation may allow an attacker to achieve arbitrary code execution or cause a Denial of Service (DoS) by crashing worker processes.
Statement
An IMPORTANT severity heap-based buffer overflow was found in nginx (ngx_http_core_module), affecting the nginx component in Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS, Red Hat Hardened Images, and Red Hat's services management platform (cloud.redhat.com). A remote, unauthenticated attacker can send crafted HTTP requests to trigger a heap-based buffer overflow in the nginx worker process on servers configured with a location that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable, or where the $request_filename variable is used in an access log format directive. Exploitation requires this specific configuration and conditions beyond the attacker's control; a successful attack crashes the worker process, causing a denial of service, and may allow code execution on systems with ASLR disabled or where the attacker can bypass ASLR. This is a data plane issue with no control plane exposure. Red Hat rates this flaw as IMPORTANT (CVSS 3.1 score 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), which is lower than the upstream CVSS 4.0 rating of 9.2 CRITICAL, because exploitation depends on a specific server configuration. A fix is being pursued for the affected products.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | N/A | 8.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.
Integrity,Confidentiality,Availability,Access Control
Technical Impact: Execute Unauthorized Code or Commands; Bypass Protection Mechanism; Modify Memory
Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy. Besides important user data, heap-based overflows can be used to overwrite function pointers that may be living in memory, pointing it to the attacker's code. Even in applications that do not explicitly use function pointers, the run-time will usually leave many in memory. For example, object methods in C++ are generally implemented using function pointers. Even in C programs, there is often a global offset table used by the underlying runtime.
Integrity,Confidentiality,Availability,Access Control,Other
Technical Impact: Execute Unauthorized Code or Commands; Bypass Protection Mechanism; Other
When the consequence is arbitrary code execution, this can often be used to subvert any other security service.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
