This vulnerability in the ngx_http_rewrite_module arises from improper handling of unnamed PCRE captures in rewrite directives when combined with certain replacement strings containing a question mark. Exploitation requires sending specially crafted HTTP requests and can lead to a heap buffer overflow in the NGINX worker process. The overflow may cause process restarts and, if ASLR is disabled, could enable remote code execution. The vulnerability affects NGINX Plus versions R32 and R36. The CVSS 3.1 score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required. No official fix or patch has been documented as of the published date.

Successful exploitation can cause a denial of service via worker process restart due to heap buffer overflow. On systems with ASLR disabled, it may lead to remote code execution, compromising confidentiality, integrity, and availability of the affected system. The vulnerability is exploitable remotely without authentication but requires conditions beyond the attacker's control. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, monitor F5's advisories for updates. Until a fix is available, consider disabling or limiting use of the ngx_http_rewrite_module with the affected directive patterns if feasible to reduce exposure.