Homepage

Heap-based Buffer Overflow The advisory has been revoked - it doesn't affect any version of package ingress-nginx-controller-1.13  (opens in a new tab)

Threat Intelligence

Exploit Maturity
Proof of Concept
EPSS
3.4% (89th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-WOLFILATEST-INGRESSNGINXCONTROLLER113-16771102
  • published20 May 2026
  • disclosed13 May 2026
Report a new vulnerability Found a mistake?

Introduced: 13 May 2026

CVE-2026-42945  (opens in a new tab)
CWE-122  (opens in a new tab)

Amendment

The Wolfi security team deemed this advisory irrelevant for Wolfi:latest.

NVD Description

Note: Versions mentioned in the description apply only to the upstream ingress-nginx-controller-1.13 package and not the ingress-nginx-controller-1.13 package as distributed by Wolfi.

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when the rewrite directive is followed by a rewrite, if, or set directive and an unnamed Perl-Compatible Regular Expression (PCRE) capture (for example, $1, $2) with a replacement string that includes a question mark (?). An unauthenticated attacker along with conditions beyond its control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

References