CVE-2026-27654

This is the first Russian-language analysis of CVE-2026-27654. The vulnerability is a heap buffer overflow (CWE-122) in the ngx_http_dav_module of the NGINX web server. It arises from a size_t underflow when handling WebDAV MOVE and COPY requests.

Repository structure

• CVE-2026-27654.pdf — vulnerability analysis
• ploit.py — example PoC
• SETUP.md — instructions for setting up a research environment

Disclaimer

This repository is strictly educational and research-oriented.

• The materials cover the publicly disclosed and already patched vulnerability CVE-2026-27654. Information about the vulnerability is officially published in NVD, the GitHub Advisory Database, and the F5 advisory (K000160382); the fix is available in NGINX starting from version 1.29.7.
• The repository contains a writeup of the vulnerability and educational materials. It is not intended for attacking other people's systems and does not contain tools for doing so.
• Any code examples are provided for analysis and reproduction in an isolated lab environment that you own or for which you have explicit written permission to use.
• The author bears no responsibility for any damage or unlawful acts committed using the presented materials. All responsibility for applying the information lies with the user.