CVE-2010-2266: F5 Nginx

Medium severity, CVSS 5.0. EPSS: 21.5% chance of exploitation in the next 30 days.

nginx 0.8.36 allows remote attackers to cause a denial of service (crash) via certain encoded directory traversal sequences that trigger memory corruption, as demonstrated using the "%c0.%c0." sequence.

Affected products

• F5 Nginx: from 0.7.52, before 0.7.67 (fixed in 0.7.67); from 0.8.0, up to and including 0.8.40

Published 2010-06-15. Last modified 2026-06-16.