Pre-auth nginx RCE explained with a capture-clobbering overflow
jedisct1 · x · 2026-07-20
A detailed exploit write-up on a pre-auth nginx RCE affecting 13 call sites, tracked as CVE-2026-42533.
- The diagram explains a shared mutable state bug: r->captures is clobbered between the regex LEN pass and VALUE pass.
- During the LEN pass, nginx sizes a buffer based on one set of captures; a later map-regex call overwrites those captures.
- The VALUE pass then uses the corrupted state, writing attacker-controlled content into a buffer that is too small.
- The result is a 197-byte overflow in the illustrated example.
The post credits Cyberstan and links to the original blog write-up.
More from Safety
- Per-surface intent thresholds: a practical guardrail design for AI email agents — marlene_zw · 2026-10-27
- China bets on open-weight AI: cybersecurity weapon or armour? SCMP examines the debate — pstAsiatech · 2026-10-27
- Anthropic's S-1 unusually discusses AI sentience and moral status risks — birchlse · 2026-10-27
- The most dangerous instruction you can give a superintelligent machine: lie to me — r0ck3t23 · 2026-10-27
- Researcher Asks Whether Suspicious Model Behavior Can Ever Be Explained — or Faked — jd_pressman · 2026-10-27
- UK AISI papers: no good safeguards yet against misuse of biological AI tools — davidmanheim · 2026-10-27