Skip to content

Back to the catalog

Orca Security: nginx Flaw in 1.45M Tengine Servers (CVE-2026-42945 + CVE-2026-9256)
orca.securitywriteup

Orca Security: nginx Flaw in 1.45M Tengine Servers (CVE-2026-42945 + CVE-2026-9256)

Orca Security researchers found that two critical nginx heap buffer overflow CVEs in the rewrite engine (ngx_http_script.c) — CVE-2026-42945 ("NGINX Rift") and CVE-2026-9256 ("nginx-poolslip") — also live untouched in Tengine, Alibaba's nginx fork last released in October 2023 and running on 1.45 million internet-facing servers (Aliyun, Taobao, CDN edges, reverse proxies). They compiled Tengine 3.1.0 with AddressSanitizer, built working single-request unauthenticated crash exploits for both bugs, and confirmed neither CVE had a patched Tengine release as of publication, with heap corruption potentially steerable toward code execution if ASLR is disabled/bypassed.

TL;DR Orca finds two unpatched nginx heap-overflow CVEs (Rift, poolslip) still live and exploitable in Tengine, Alibaba's nginx fork, across 1.45M internet-facing servers.
Open original ↗

Organisations named here

  • nginx-poolslip
  • NGINX Rift

CVEs named here

  • CVE-2026-42945
  • CVE-2026-9256

Technologies named here

  • Tengine
  • Orca Security Platform
  • nginx
  • Shodan
  • AddressSanitizer
  • Docker

Techniques named here

  • Heap buffer overflow via malformed HTTP request
  • Denial of Service via worker crash loop
  • Source-code lineage tracing across forks

Related in AppSec