CVE-2009-3896 Null dereference in n/a
Remote attackers can crash the nginx web server worker process by sending a long URI, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-3896?
CVE-2009-3896 is a medium-severity vulnerability in n/a, published on 24 Nov 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.14 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a long URI.
Weakness: CWE-119
Which versions are affected by CVE-2009-3896?
It affects 2 products.
Products include F5 Nginx, Nginx Nginx.
How do I fix CVE-2009-3896?
Upgrade to a fixed version.
Is CVE-2009-3896 being exploited?
There is no known exploitation of CVE-2009-3896 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2009-3896, DSA-1920-1, GHSA-32qw-fvh7-vw83.