CVE-2009-2629

published 2009-09-15

CVE-2009-2629: Buffer underflow in src/http/ngx_http_parse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 allows remote…

high 7.5 CVSS 3.1

AV N AC L Au N C P I P A P

EXPLOIT

Buffer underflow in src/http/ngx_http_parse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 allows remote attackers to execute arbitrary code via crafted HTTP requests.

Affected

15 ranges

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	debian_linux	—	—
debian	debian_linux	—	—
debian	nginx	< nginx 0.7.61-3 (bookworm)	nginx 0.7.61-3 (bookworm)
f5	nginx	>= 0 < 0.7.61-3	0.7.61-3
f5	nginx	>= 0 < 0.7.61-3	0.7.61-3
f5	nginx	>= 0 < 0.7.61-3	0.7.61-3
f5	nginx	>= 0 < 0.7.61-3	0.7.61-3
f5	nginx	>= 0.1.0 < 0.5.38	0.5.38
f5	nginx	>= 0.6.0 < 0.6.39	0.6.39
f5	nginx	>= 0.7.0 < 0.7.62	0.7.62
f5	nginx	>= 0.8.0 < 0.8.15	0.8.15
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—

CVSS provenance

nvd 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

osv 7.5 HIGH

CWE-787