== CVE-2026-42533 NGINX ASLR-enabled network RCE reproduction == ROOT=/workspace/bundle RUN_ID=pruva42533-1784957360-4749 VULN_COMMIT=28219209e0b4f9e155fd8bd91ab81b8ac30628f2 FIXED_COMMIT=b767540492e8c79a58bc26034d3bab2f708b7bd1 2 Using repository path: /pruva/project-cache/repo Reusing existing repository at /pruva/project-cache/repo b76754049 Script: buffer overrun protection. src/http/ngx_http_script.c | 63 ++++++++++++++++++++++++++++++++++++++++++ src/http/ngx_http_script.h | 4 +++ src/stream/ngx_stream_script.c | 45 ++++++++++++++++++++++++++++++ src/stream/ngx_stream_script.h | 5 ++++ 4 files changed, 117 insertions(+) Patch hunk verification: vulnerable tree lacks ngx_http_script_check_length; fixed tree contains it nginx.conf sha256=b70518e28eb22955d60cc1f879183219d416ce4ddef354407770121380bce2eb Building/verifying Docker image pruva-nginx-cve-2026-42533:vulnerable-28219209e0b4 Building/verifying Docker image pruva-nginx-cve-2026-42533:fixed-b767540492e8 --- starting vulnerable attempt 1 marker=PRUVA_42533_VULNERABLE_1_1784957428_6AA723FB --- VULNERABLE_ATTEMPT_CONFIRMED role=vulnerable attempt=1 marker=PRUVA_42533_VULNERABLE_1_1784957428_6AA723FB --- starting vulnerable attempt 2 marker=PRUVA_42533_VULNERABLE_2_1784957430_DAEE2FFD --- VULNERABLE_ATTEMPT_CONFIRMED role=vulnerable attempt=2 marker=PRUVA_42533_VULNERABLE_2_1784957430_DAEE2FFD --- starting fixed attempt 1 marker=PRUVA_42533_FIXED_1_1784957432_FBE549D5 --- FIXED_NEGATIVE_CONTROL_OK role=fixed attempt=1 attacker_rc=1 marker_present=false marker=PRUVA_42533_FIXED_1_1784957432_FBE549D5 --- starting fixed attempt 2 marker=PRUVA_42533_FIXED_2_1784957441_7727967F --- FIXED_NEGATIVE_CONTROL_OK role=fixed attempt=2 attacker_rc=1 marker_present=false marker=PRUVA_42533_FIXED_2_1784957441_7727967F ASLR verifier: vulnerable executable mapping bases differ: 0x55d551e45000 vs 0x564f17702000 == Reproduction confirmed == Two fresh vulnerable NGINX processes created target-local command markers observable through /rce-proof. Two fixed negative controls reached the TCP peer procedure without marker creation. Runtime manifest: /workspace/bundle/repro/runtime_manifest.json Validation verdict: /workspace/bundle/repro/validation_verdict.json