CVE-2009-3896
NoneCVSS
—
EPSS
10.2%
Published
Nov 24, 2009
CISA due date
—
The record
src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.14 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a long URI.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | nginx | 0 | 0.7.62-1 |
| Debian:12 | nginx | 0 | 0.7.62-1 |
| Debian:13 | nginx | 0 | 0.7.62-1 |
| Debian:4.0 | nginx | 0 | 0.4.13-2+etch3 |
| Debian:5.0 | nginx | 0 | 0.6.32-3+lenny3 |
Related vulnerabilities
- CVE-2017-7529 Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow… Also affects nginx
- CVE-2016-1247 The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before… Also affects nginx
- CVE-2016-4450 os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote… Also affects nginx
- CVE-2016-0742 The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to… Also affects nginx
- CVE-2014-3616 nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or… Also affects nginx
- CVE-2013-4547 nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass… Also affects nginx
- CVE-2013-2070 http/modules/ngx_http_proxy_module.c in nginx 1.1.4 through 1.2.8 and 1.3.0 through… Also affects nginx
- CVE-2012-1180 Use-after-free vulnerability in nginx before 1.0.14 and 1.1.x before 1.1.17 allows remote… Also affects nginx