Stream complex-value capture desynchronization causes heap overflow (CVE-2026-42533)

Metric values as published in the disclosure vector. Meters show how far each value raises exposure.

1. Source · attacker-controlledsrc/stream/ngx_stream_core_module.c:412

   ngx_stream_core_preread_phase()

2. 1
   Step 01src/stream/ngx_stream_core_module.c:412

   A client connected to the reachable stream listener and supplied unauthenticated preread bytes. With ssl_preread on, those bytes were parsed as a TLS ClientHello before any upstream connection or application authentication.

   n = c->recv(c, b->last, size);
   

3. 2
   Step 02src/stream/ngx_stream_ssl_preread_module.c:401-407

   The SSL preread parser allocated storage for the SNI hostname using the length encoded by the client. The generic parser copy state then copied the attacker-controlled hostname bytes into this session-owned buffer.

   host = ngx_pnalloc(ctx->pool, size);
   if (host == NULL) {
       return NGX_ERROR;
   }
   
   ctx->host.data = host;
   

4. 3
   Step 03src/stream/ngx_stream_script.c:82-100

   ngx_stream_complex_value() ran all length opcodes, allocated exactly that predicted length, and only then ran the copy opcodes. Both passes read mutable capture fields from the same ngx_stream_session_t.

   for (i = 0; ip && *ip; i++) {
       lcode = *(ngx_stream_script_len_code_pt *) ip;
       len += lcode(&le);
   }
   
   value->len = len;
   value->data = ngx_pnalloc(s->connection->pool, len);
   
   while (*(uintptr_t *) e.ip) {
       code = *(ngx_stream_script_code_pt *) e.ip;
       code((ngx_stream_script_engine_t *) &e);
   }
   

5. 4
   Step 04src/stream/ngx_stream_script.c:909-914 (before fix)

   The $1 length opcode ran before the regex-backed map variable. With no current capture, it contributed zero bytes to the allocation and did not reserve space for a later capture.

   if (n < s->ncaptures) {
       cap = s->captures;
       return cap[n + 1] - cap[n];
   }
   
   return 0;
   

6. 5
   Step 05src/stream/ngx_stream_variables.c:1172-1184

   The following $m length opcode evaluated map $ssl_preread_server_name $m. Its regex matched the attacker-controlled SNI and published new offsets and captures_data into the session-wide capture state after $1 had already been sized.

   rc = ngx_regex_exec(re->regex, str, s->captures, len);
   
   if (rc == NGX_REGEX_NO_MATCHED) {
       return NGX_DECLINED;
   }
   
   s->ncaptures = rc * 2;
   s->captures_data = str->data;
   

7. 6
   Step 06src/stream/ngx_stream_script.c:87-90

   With the map value X, the stale predicted output length was one byte. NGINX allocated that one-byte result even though $1 now referred to the much longer SNI capture.

   value->len = len;
   value->data = ngx_pnalloc(s->connection->pool, len);
   

8. 7
   Step 07src/stream/ngx_stream_script.c:937-940 (before fix)

   During the copy pass, the $1 opcode observed the newly populated capture state and copied the full SNI hostname without checking the remaining result-buffer capacity. The ASan proof reached this sink with a 12,000-byte write.

   if (n < s->ncaptures) {
       cap = s->captures;
       p = s->captures_data;
       e->pos = ngx_copy(pos, &p[cap[n]], cap[n + 1] - cap[n]);
   }
   

9. 8
   Step 08src/stream/ngx_stream_script.c:680-704,982-989 (fix, commit b767540)

   The accepted fix records the allocated buffer end and routes literal, variable, and capture copies through a shared length guard. A mismatch logs an alert, stops the script, sets an internal-error status, and makes ngx_stream_complex_value() fail closed.

   if (e->end - e->pos < (ssize_t) len) {
       ngx_log_error(NGX_LOG_ALERT, e->session->connection->log, 0,
                     "no buffer space in script copy");
       e->ip = ngx_stream_script_exit;
       e->status = NGX_STREAM_INTERNAL_SERVER_ERROR;
       return NGX_ERROR;
   }
   
   /* capture copy */
   if (ngx_stream_script_check_length(e, len) != NGX_OK) {
       return;
   }
   
   e->pos = ngx_copy(pos, p, len);
   

10. Sinksrc/stream/ngx_stream_script.c:940

    ngx_stream_script_copy_capture_code()