What is CVE-2016-0747?

CVE-2016-0747 is a medium-severity vulnerability in Apple Xcode, classified under Uncontrolled Resource Consumption. CVSS score: 5.3/10. Published 2016-02-15.

How severe is CVE-2016-0747?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Resource exhaustion in Apple Xcode

CVE-2016-0747

The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution.

Vulnerability class: DoS (Denial of Service)

Published 2016-02-15 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

EPSS exploit prediction

EPSS: 0.087 (94.9th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 95th percentile — 94.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.084 · newest: 0.087 · change: +0.002

Affected products

Apple Xcode
F5 nginx
Canonical Ubuntu Linux — versions 14.04, 15.10
Debian Linux — versions 7.0, 8.0, 9.0
openSUSE Leap — versions 42.1

Weakness classification (CWE)

CWE-400 — Uncontrolled Resource Consumption

References

lists.opensuse.org/opensuse-updates/2016-02/msg00042.html (vendor-advisory, Mailing List, Third Party Advisory)
bto.bluecoat.com/security-advisory/sa115 (Third Party Advisory)
security.gentoo.org/glsa/201606-06 (vendor-advisory, Third Party Advisory)
www.securitytracker.com/id/1034869 (VDB Entry, Third Party Advisory, vdb-entry)
mailman.nginx.org/pipermail/nginx/2016-January/049700.html (Vendor Advisory, mailing-list)
access.redhat.com/errata/RHSA-2016:1425 (vendor-advisory, Third Party Advisory)
bugzilla.redhat.com/show_bug.cgi (Patch, Third Party Advisory, Issue Tracking)
www.debian.org/security/2016/dsa-3473 (vendor-advisory, Third Party Advisory)
www.ubuntu.com/usn/USN-2892-1 (vendor-advisory, Third Party Advisory)
support.apple.com/kb/HT212818 (Third Party Advisory)

Frequently asked questions

What is CVE-2016-0747?: CVE-2016-0747 is a medium-severity vulnerability in Apple Xcode, classified under Uncontrolled Resource Consumption. CVSS score: 5.3/10. Published 2016-02-15.
How severe is CVE-2016-0747?: Medium severity. CVSS v3 base score is 5.3 out of 10.