F5 Nginx vulnerabilities

41 CVEs affecting F5 Nginx, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-23419, published 2025-02-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability, published 2023-10-10. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2023-10-10. EPSS: 100% chance of exploitation in the next 30 days. The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2013-2028, published 2013-07-20. High severity, CVSS 7.5. EPSS: 87.5% chance of exploitation in the next 30 days. The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a chunked…
CVE-2009-3555, published 2009-11-09. Critical severity, CVSS 9.8. EPSS: 87.3% chance of exploitation in the next 30 days. The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before…
CVE-2016-0742, published 2016-02-15. High severity, CVSS 7.5. EPSS: 82.4% chance of exploitation in the next 30 days. The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response.
CVE-2019-9513, published 2019-08-13. High severity, CVSS 7.5. EPSS: 81.6% chance of exploitation in the next 30 days. Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the…
CVE-2009-2629, published 2009-09-15. High severity, CVSS 7.5. EPSS: 75.1% chance of exploitation in the next 30 days. Buffer underflow in src/http/ngx_http_parse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 allows remote attackers to execute arbitrary code via…
CVE-2010-2263, published 2010-06-15. Medium severity, CVSS 5.0. EPSS: 71.9% chance of exploitation in the next 30 days. nginx 0.8 before 0.8.40 and 0.7 before 0.7.66, when running on Windows, allows remote attackers to obtain source code or unparsed content of arbitrary files under the web document root by appending…
CVE-2013-4547, published 2013-11-23. High severity, CVSS 7.5. EPSS: 67.7% chance of exploitation in the next 30 days. nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character in a URI.
CVE-2017-7529, published 2017-07-13. High severity, CVSS 7.5. EPSS: 62.6% chance of exploitation in the next 30 days. Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered…
CVE-2019-9511, published 2019-08-13. High severity, CVSS 7.5. EPSS: 59.5% chance of exploitation in the next 30 days. Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data…

Latest

CVE-2025-23419, published 2025-02-05. Medium severity, CVSS 4.3. EPSS: 2.8% chance of exploitation in the next 30 days. When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers.…
CVE-2022-41742, published 2022-10-19. High severity, CVSS 7.1. EPSS: 1.2% chance of exploitation in the next 30 days. NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the…
CVE-2022-41741, published 2022-10-19. High severity, CVSS 7.8. EPSS: 0.8% chance of exploitation in the next 30 days. NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the…
CVE-2021-3618, published 2022-03-23. High severity, CVSS 7.4. EPSS: 2% chance of exploitation in the next 30 days. ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard…
CVE-2017-20005, published 2021-06-06. Critical severity, CVSS 9.8. EPSS: 3.3% chance of exploitation in the next 30 days. NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date…
CVE-2021-23017, published 2021-06-01. High severity, CVSS 7.7. EPSS: 53.5% chance of exploitation in the next 30 days. A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process…
CVE-2019-20372, published 2020-01-09. Medium severity, CVSS 5.3. EPSS: 15% chance of exploitation in the next 30 days. NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is…
CVE-2011-4968, published 2019-11-19. Medium severity, CVSS 4.8. EPSS: 4% chance of exploitation in the next 30 days. nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack (MITM)
CVE-2019-9516, published 2019-08-13. Medium severity, CVSS 6.5. EPSS: 56.3% chance of exploitation in the next 30 days. Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value,…