Critical NGINX Flaw CVE-2024-35200 Allows DoS and Code Execution

Key Takeaways

• A new critical vulnerability, ‘Poolslip’ (CVE-2026-9256), has been discovered in NGINX, a widely used web server.
• This flaw can be exploited by remote, unauthenticated attackers to cause Denial of Service (DoS) and potentially achieve arbitrary code execution.
• Both NGINX Open Source and NGINX Plus are affected, impacting a vast array of internet infrastructure, including reverse proxies and Kubernetes ingress controllers.
• Patches are available for core NGINX versions, and immediate updates are strongly recommended.

Critical ‘Poolslip’ Vulnerability Threatens NGINX Deployments

System administrators are now confronting another urgent security update cycle following the public disclosure of “Poolslip,” a severe new vulnerability impacting NGINX, a cornerstone of global web infrastructure. This flaw, which allows for Denial of Service (DoS) attacks and potentially remote code execution, necessitates immediate attention and patching across affected systems.

Designated as CVE-2026-9256 and also referred to as nginx-poolslip, this critical vulnerability affects both NGINX Plus and NGINX Open Source. An attacker can trigger the flaw remotely and without authentication over standard HTTP connections.

Technical Details of the Vulnerability

The root cause of Poolslip lies within the ngx_http_rewrite_module, the same component previously implicated in another NGINX flaw, “NGINX Rift” (CVE-2026-42945). According to an advisory from F5, the condition manifests when a rewrite directive employs a regex pattern containing distinct, yet overlapping, PCRE capture groups. An example would be ^/((.*))$ combined with a replacement string that references multiple captures, such as $1$2, within a redirect or arguments context.

Under these specific conditions, a malicious actor can send specially crafted HTTP requests that trigger a heap buffer overflow (CWE-122) within the NGINX worker process. NGINX allocates a dedicated memory pool for each request, which is subsequently released upon request completion. Within this memory pool structure, NGINX maintains a linked list of cleanup handlers. If an attacker successfully overwrites or redirects a pointer to one of these handlers, the process of pool destruction can be hijacked, leading to control-flow manipulation.

While the earlier Rift vulnerability exploited an error in buffer size calculations, Poolslip leverages a different code path to achieve a controlled pointer “slip” across adjacent linked structures within the same memory pool. Crucially, researchers have confirmed that the patch issued for the prior Rift flaw did not fully address the underlying memory pool attack surface, leaving a critical window open for Poolslip to emerge in the updated codebase.

At a minimum, successful exploitation of Poolslip results in the crash and restart of the NGINX worker process, leading to a denial-of-service condition. More critically, code execution becomes a possibility on systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed by an attacker. F5’s advisory confirms there is no control-plane exposure, categorizing this strictly as a data-plane issue. The vulnerability has been assigned a High severity rating of 8.1 (CVSS v3.1) and a Critical rating of 9.2 (CVSS v4.0).

Given NGINX’s pervasive deployment as reverse proxies, API gateways, and Kubernetes ingress controllers, the potential attack surface for Poolslip is immense, underscoring the urgency of patching.

Affected Versions and Fixes

The Poolslip vulnerability impacts NGINX Open Source versions from 0.1.17 through 1.30.1, as well as version 1.31.0. Users are advised to upgrade to NGINX Open Source 1.30.2 or 1.31.1. For NGINX Plus users, versions R32 through R36 are vulnerable and should be updated to R36 P5 or R32 P7, while 37.x users should upgrade to R37.0.1.1. It is important to note that the 0.x branch of NGINX Open Source will not receive a fix for this vulnerability.

A range of downstream products also inherit the vulnerable components, including NGINX Instance Manager, F5 WAF for NGINX, NGINX App Protect (both WAF and DoS versions), NGINX Gateway Fabric, and NGINX Ingress Controller. These products will require updates as fixes become available from F5. For older versions of NGINX Open Source (0.1.17 – 0.9.7), F5 has indicated that no fix will be provided.

The discovery of this flaw is credited to Mufeed VH from Winfunc Research, Nebula Security, and Vexera AI. With proof-of-concept exploits already circulating, organizations must prioritize patching without delay.

What You Should Do

• Immediately Apply Patches: Upgrade NGINX Open Source to version 1.30.2 or 1.31.1. For NGINX Plus, update to R36 P5 or R32 P7 (for R32–R36) or R37.0.1.1 (for 37.x).
• Monitor for Downstream Updates: Keep an eye out for and apply patches for affected F5 and NGINX downstream products such as NGINX Instance Manager, WAF, App Protect, Gateway Fabric, and Ingress Controller as they become available.
• Implement Mitigation if Patching is Delayed: If immediate patching is not feasible, F5 recommends replacing unnamed captures with named captures in all affected rewrite directives. For example, instead of referencing $1 and $2, use named captures like (?...) and (?

  ...), and reference them by name in the replacement string.
• Review ASLR Configuration: Ensure Address Space Layout Randomization (ASLR) is enabled on your systems to mitigate the risk of arbitrary code execution.
• Stay Informed: Continue monitoring official advisories from F5 and NGINX for any further updates or mitigation strategies.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.