What is CVE-2013-2028?

CVE-2013-2028 is a vulnerability in F5 nginx, classified under Out-of-bounds Write. Published 2013-07-20.

Is CVE-2013-2028 known to be exploited?

35 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in F5 nginx

CVE-2013-2028

The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a chunked Transfer-Encoding request with a large chunk size, which triggers an integer signedness error and a stack-based buffer overflow.

Vulnerability class: Buffer Overflow

Published 2013-07-20 · last modified 2026-06-16.

CVSS v2 metric

CVSS v2 base score 7.5 (High). Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.875 (99.8th percentile), scored 2026-10-15.

High probability of exploitation in the next 30 days — patch promptly. 100th percentile — 99.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.875 · newest: 0.875 · change: 0.000

Affected products

F5 nginx
Fedoraproject Fedora — versions 19

Weakness classification (CWE)

CWE-787 — Out-of-bounds Write

Public proof-of-concept exploits

References

mailman.nginx.org/pipermail/nginx-announce/2013/000112.html (Vendor Advisory, mailing-list, Patch, Mitigation)
www.osvdb.org/93037 (vdb-entry, Broken Link)
lists.fedoraproject.org/pipermail/package-announce/2013-May/105176.html (vendor-advisory, Third Party Advisory)
www.vnsecurity.net/2013/05/analysis-of-nginx-cve-2013-2028/ (Broken Link)
secunia.com/advisories/55181 (Third Party Advisory, third-party-advisory)
www.securityfocus.com/bid/59699 (VDB Entry, Third Party Advisory, vdb-entry)
security.gentoo.org/glsa/glsa-201310-04.xml (vendor-advisory, Third Party Advisory)
github.com/rapid7/metasploit-framework/pull/1834 (Patch, Third Party Advisory)
nginx.org/download/patch.2013.chunked.txt (Patch, Vendor Advisory)
packetstormsecurity.com/files/121675/Nginx-1.3.9-1.4.0-Denial-Of-Service.html (Exploit, VDB Entry, Third Party Advisory)

Frequently asked questions

What is CVE-2013-2028?: CVE-2013-2028 is a vulnerability in F5 nginx, classified under Out-of-bounds Write. Published 2013-07-20.
Is CVE-2013-2028 known to be exploited?: 35 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.