"According to F5, which acquired NGINX in 2019, the flaw can be triggered by specially crafted HTTP requests under certain server configurations. In most cases, the result is a crashed worker process and a forced restart, though systems running without standard Linux memory protections could potentially face code execution. A public proof-of-concept exploit appeared the same day patches dropped, which helps explain why researchers started seeing exploitation attempts almost immediately."
A heap buffer overflow vulnerability in NGINX, tracked as CVE-2026-42945 and nicknamed “NGINX Rift,” was disclosed last week after reportedly remaining unnoticed for 18 years. Researchers observed active exploitation tied to the flaw on canary systems just days after publication. The issue affects both NGINX Open Source and NGINX Plus and carries a CVSS score of 9.2. An unauthenticated attacker can crash the NGINX worker process by sending crafted HTTP requests. Under certain server configurations and with standard Linux memory protections disabled, code execution may be possible. A proof-of-concept exploit appeared the same day patches were released, accelerating exploitation attempts.
Read at theregister
Unable to calculate read time
Collection
[
|
...
]