Skip to content
Back to search

CVE-2009-2629

HIGH
7.5NVD

Summary

generated automatically from NVD data

CVE-2009-2629 is a buffer underflow (CWE-787) in src/http/ngx_http_parse.c of f5 nginx, affecting versions from 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15. A remote attacker can send crafted HTTP requests to execute arbitrary code on the server. The entry is also associated with Debian Linux and Fedora, and carries a CVSS v2.0 score of 7.5 (HIGH).

NVD description

Buffer underflow in src/http/ngx_http_parse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 allows remote attackers to execute arbitrary code via crafted HTTP requests.

Share:

EPSS · FIRST.org

75.1%probability of exploitation in the next 30 days

Higher than 99% of scored CVEs

EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-11-01, recomputed daily by FIRST.org.

CVSS v2.0 Score

7.5
/ 10.0
HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P

Information

Published
15 sept. 2009
Updated
16 juin 2026
Status
Modified
Source
cret@cert.org

Affected products

f5 nginxAll nginx CVEs →
Versions ≥ 0.1.0, < 0.5.38 · ≥ 0.6.0, < 0.6.39 · ≥ 0.7.0, < 0.7.62 · ≥ 0.8.0, < 0.8.15
debian debian linux
Versions 4.0 · 5.0 · 6.0
fedoraproject fedora
Versions 10 · 11 · 12

Bounds published by NVD: "< 8.4.27" means 8.4.27 is no longer vulnerable. The fixed release to install is in the vendor advisory.

Weaknesses (CWE)

CWE-787

References (20)

Similar CVEs

Other vulnerabilities of type CWE-787

…

Running nginx? Know which CVEs hit your version.

Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.

Watch my nginxI already have an account