F5 Nginx
42 CVEs affecting F5 Nginx. Latest disclosed: 2026-06-08. Critical: 3, High: 14.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-20005 | Critical | 9.8 | 2021-06-06 | NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer… |
CVE-2016-0746 | Critical | 9.8 | 2016-02-15 | Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker… |
CVE-2009-3555 | Critical | 9.8 | 2009-11-09 | The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Serve… |
CVE-2016-1247 | High | 7.8 | 2016-11-29 | The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubu… |
CVE-2021-23017 | High | 7.7 | 2021-06-01 | A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory ov… |
CVE-2026-49975 | High | 7.5 | 2026-06-08 | Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue… |
CVE-2023-44487 | High | 7.5 | 2023-10-10 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the w… |
CVE-2019-9513 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and con… |
CVE-2019-9511 | High | 7.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The… |
CVE-2018-16844 | High | 7.5 | 2018-11-07 | nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive CPU usage. This issue affects nginx co… |
CVE-2018-16843 | High | 7.5 | 2018-11-07 | nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption. This issue affects… |
CVE-2017-7529 | High | 7.5 | 2017-07-13 | Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of pote… |
CVE-2016-4450 | High | 7.5 | 2016-06-07 | os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker p… |
CVE-2016-0742 | High | 7.5 | 2016-02-15 | The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference and worker process… |
CVE-2021-3618 | High | 7.4 | 2022-03-23 | ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, su… |
CVE-2022-41742 | High | 7.1 | 2022-10-19 | NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and… |
CVE-2022-41741 | High | 7.0 | 2022-10-19 | NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and… |
CVE-2019-9516 | Medium | 6.5 | 2019-08-13 | Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length… |
CVE-2018-16845 | Medium | 6.1 | 2018-11-07 | nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process… |
CVE-2019-20372 | Medium | 5.3 | 2020-01-09 | NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized… |