rewrite overlapping captures heap overflow (CVE-2026-9256)

Metric values as published in the disclosure vector. Meters show how far each value raises exposure.

1. Source · attacker-controlledsrc/http/modules/ngx_http_rewrite_module.c:408

   ngx_http_rewrite() (capture-only replacement selects fast path)

2. 1
   Step 01src/http/modules/ngx_http_rewrite_module.c:408-410 (before fix)

   The rewrite compiler removed the exact capture-aware length program when the replacement had no non-capture variables and no duplicate reference to the same capture number. A replacement like $1$2 with distinct captures satisfied that condition even though both captures could overlap.

   if (sc.variables == 0 && !sc.dup_capture) {
       regex->lengths = NULL;
   }
   

3. 2
   Step 02src/http/ngx_http_script.c:1143-1155 (before fix)

   With regex->lengths == NULL, the runtime fast path sized the output buffer by adding one whole-URI escape adjustment and the raw length of each capture. It did not calculate escape expansion per referenced capture.

   if (code->lengths == NULL) {
       e->buf.len = code->size;
   
       if (code->uri) {
           if (r->ncaptures && (r->quoted_uri || r->plus_in_uri)) {
               e->buf.len += 2 * ngx_escape_uri(NULL, r->uri.data, r->uri.len,
                                                NGX_ESCAPE_ARGS);
           }
       }
   
       for (n = 2; n < r->ncaptures; n += 2) {
           e->buf.len += r->captures[n + 1] - r->captures[n];
       }
   }
   

4. 3
   Step 03src/http/ngx_http_script.c:1179

   The under-sized length was used for a request-pool allocation. In the ASan run, the allocation stayed in a 4096-byte pool block and the later escaped copy wrote at the first byte past that block.

   e->buf.data = ngx_pnalloc(r->pool, e->buf.len);
   if (e->buf.data == NULL) {
       e->ip = ngx_http_script_exit;
       e->status = NGX_HTTP_INTERNAL_SERVER_ERROR;
       return;
   }
   
   e->pos = e->buf.data;
   

5. 4
   Step 04src/http/ngx_http_parse.c:548-571

   A URI containing + or quoted bytes sets request parser flags that later make redirect and arguments capture copies use NGX_ESCAPE_ARGS escaping.

   case '+':
       r->plus_in_uri = 1;
       break;
   
   case '%':
       quoted_state = state;
       state = sw_quoted;
       break;
   

6. 5
   Step 05src/http/ngx_http_script.c:1397-1402

   The copy phase escapes each referenced capture independently. For nested captures such as ^/((.*))$, $1 and $2 can cover the same bytes, so the same attacker-controlled plus signs are expanded twice even though the vulnerable fast path only reserved one URI-wide escape adjustment.

   if (e->quote
       && (r->quoted_uri || r->plus_in_uri))
   {
       p = e->pos;
       e->pos = (u_char *) ngx_escape_uri(p, &e->line.data[cap[n]],
                                          cap[n + 1] - cap[n],
                                          NGX_ESCAPE_ARGS);
   }
   

7. 6
   Step 06src/http/ngx_http_script.c:1145-1163 (fix, commit ca4f92a)

   The accepted upstream fix keeps the fast path but makes its sizing mirror the copy phase: each capture contributes its raw length plus its own NGX_ESCAPE_ARGS expansion. Distinct overlapping captures are therefore counted separately.

   cap = r->captures;
   p = r->captures_data;
   
   for (n = 2; n < r->ncaptures; n += 2) {
       e->buf.len += cap[n + 1] - cap[n];
   
       if (code->uri) {
           if (r->quoted_uri || r->plus_in_uri) {
               e->buf.len += 2 * ngx_escape_uri(NULL, &p[cap[n]],
                                                cap[n + 1] - cap[n],
                                                NGX_ESCAPE_ARGS);
           }
       }
   }
   

8. Sinksrc/http/ngx_http_script.c:1400

   ngx_http_script_copy_capture_code() (escaped capture copy)