CVE-2026-42945: f5 dos Heap-based Buffer Overflow

Vulnerability summary

CVE-2026-42945 is a critical (CVSS 9.2) Heap-based Buffer Overflow vulnerability in f5 dos. EPSS estimates a 3.40% chance of exploitation in the next 30 days, higher than 88.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 13-05-2026
   PublishedVulnerability first disclosed.
2. 10-09-2026
   Last modifiedVulnerability information updated.

Description

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

• CWE-122Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
• CWE-131Incorrect Calculation of Buffer SizeThe product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.