CVE-2026-9256 is a heap-based buffer overflow vulnerability in the ngx_http_rewrite_module of NGINX Plus and NGINX Open Source. It arises when a rewrite directive uses regex patterns with distinct, overlapping PCRE captures and replacement strings referencing multiple captures in redirect or arguments contexts. Exploitation by unauthenticated attackers sending crafted HTTP requests can lead to a worker process restart or code execution on systems without effective ASLR. Red Hat advisories confirm the issue and provide updated packages to remediate the vulnerability.

Successful exploitation can cause denial of service by crashing the NGINX worker process due to heap buffer overflow. On systems where ASLR is disabled or bypassed, attackers may achieve arbitrary code execution, leading to full compromise of the affected system. The vulnerability is exploitable remotely without authentication, increasing risk.

Red Hat has issued security updates that fix this vulnerability. Users should apply the provided patches from Red Hat Enterprise Linux 10 and related distributions as detailed in the Red Hat advisories (e.g., RHSA-2026:29874). Since this is not a cloud service, remediation requires updating affected software versions. Patch status is confirmed by Red Hat advisories. No alternative mitigations are specified.