Skip to content

Back to the catalog

securityboulevard.comarticle

Three CVEs and the May 2026 Exploit Chain Nobody's Taking Seriously (nginx Rift)

Analyzes three May 2026 Linux CVEs as one chain: CVE-2026-42945 (NGINX Rift), an unauthenticated heap overflow in ngx_http_rewrite_module (is_args mismatch between length and copy passes), then page-cache LPEs Copy Fail (CVE-2026-31431, authencesn) and Dirty Frag (CVE-2026-43284/CVE-2026-43500, xfrm-ESP/rxrpc) that bypass the algif_aead blacklist. Author releases a bash static scanner for vulnerable rewrite patterns (unnamed captures plus '?' followed by rewrite/if/set) and gives fixes: upgrade nginx to 1.30.1/1.31.0 or use named captures, plus kernel module mitigations.

TL;DR Chains NGINX Rift RCE with Copy Fail/Dirty Frag page-cache root LPEs, with an offline nginx config scanner and mitigations.
Open original ↗

Organisations named here

  • depthfirst
  • Theori
  • NGINX Rift

CVEs named here

  • CVE-2026-43500
  • CVE-2026-42945
  • CVE-2026-31431
  • CVE-2026-43284

Technologies named here

  • AppArmor / SELinux
  • CISA Known Exploited Vulnerabilities Catalog
  • WordPress recommended NGINX configuration
  • NGINX ingress controllers
  • Linux kernel on every distro shipped since 2017
  • Linux kernel modules algif_aead, xfrm_algo, rxrpc
  • nginx
  • Linux kernel
  • WordPress
  • Linux
  • CISA KEV

Techniques named here

  • Page-cache corruption local privilege escalation
  • Dirty Frag LPE via xfrm-ESP or rxrpc
  • In-the-wild Dirty Frag sequence
  • Copy Fail
  • Dirty Frag

Threat actors named here

  • Exploit chain / campaigns

Also named here

  • Hyunwoo Kim

Related in Offensive Security