This vulnerability in NGINX's ngx_http_rewrite_module arises when the rewrite directive is followed by rewrite, if, or set directives using unnamed Perl-Compatible Regular Expression captures with a question mark in the replacement string. Exploitation by unauthenticated attackers sending crafted HTTP requests can trigger a heap buffer overflow in the NGINX worker process. This may cause a denial of service via process restart or arbitrary code execution on systems where ASLR is disabled or bypassed. The vulnerability is tracked as CWE-122 (Heap-based Buffer Overflow) and CWE-131 (Incorrect Calculation of Buffer Size). Red Hat's advisory confirms the issue and provides updated packages to remediate it.

Successful exploitation can lead to denial of service due to NGINX worker process restart or arbitrary code execution on systems without ASLR protection. The vulnerability affects confidentiality, integrity, and availability with high impact. No known exploits are reported in the wild at this time.

Red Hat has released security updates for affected NGINX packages, including version 1.26.3-1.el10_0.9 and related modules. Users should apply these official patches promptly to remediate the vulnerability. Exploitation requires specific non-default rewrite configurations; reviewing and adjusting these configurations may reduce risk. No additional mitigations are specified by the vendor advisory.