CVE-2026-15176

A flaw was found in nginx. A remote, unauthenticated attacker can trigger a heap-based buffer overflow by sending crafted HTTP requests to a server configured with specific alias and rewrite directives that reference the request filename variable. Successful exploitation may allow an attacker to achieve arbitrary code execution or cause a Denial of Service (DoS) by crashing worker processes.

An IMPORTANT severity heap-based buffer overflow was found in nginx (ngx_http_core_module), affecting the nginx component in Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS, Red Hat Hardened Images, and Red Hat's services management platform (cloud.redhat.com). A remote, unauthenticated attacker can send crafted HTTP requests to trigger a heap-based buffer overflow in the nginx worker process on servers configured with a location that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable, or where the $request_filename variable is used in an access log format directive. Exploitation requires this specific configuration and conditions beyond the attacker's control; a successful attack crashes the worker process, causing a denial of service, and may allow code execution on systems with ASLR disabled or where the attacker can bypass ASLR. This is a data plane issue with no control plane exposure. Red Hat rates this flaw as IMPORTANT (CVSS 3.1 score 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), which is lower than the upstream CVSS 4.0 rating of 9.2 CRITICAL, because exploitation depends on a specific server configuration. A fix is being pursued for the affected products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.