https://blog.kalfaoglu.net/tags/heap-overflow/Recent content in Heap-Overflow on kalfaoglu.netHugoenSun, 26 Jul 2026 00:00:00 +0000https://blog.kalfaoglu.net/posts/2026-07-26-cve-2026-42533-nginx-heap-overflow-en/Sun, 26 Jul 2026 00:00:00 +0000https://blog.kalfaoglu.net/posts/2026-07-26-cve-2026-42533-nginx-heap-overflow-en/<p>F5 patched <a href="https://nvd.nist.gov/vuln/detail/CVE-2026-42533">CVE-2026-42533</a> on July 15. If you run nginx, this one deserves your attention before the proof-of-concept code drops — and there is a countdown on that.</p> <h2 id="what-the-flaw-is">What the flaw is</h2> <p>The vulnerability is a heap buffer overflow (CWE-122) in nginx&rsquo;s script engine — the component that assembles output strings from configuration directives at request time. It surfaces under a specific configuration pattern: a <code>map</code> block using regex matching, where the map&rsquo;s output variable appears in a string expression <em>after</em> a numbered capture variable (<code>$1</code>, <code>$2</code>) from an earlier regex match.</p>