Summary
generated automatically from NVD dataCVE-2021-23017 affects the resolver component of nginx, which is also reflected in products such as OpenResty and several Oracle Communications monitors. An attacker able to forge UDP packets that appear to come from the DNS server could trigger a 1-byte memory overwrite (CWE-193), which may crash a worker process or potentially have other impact. The flaw is rated 7.7 (HIGH) under CVSS v3.1, with a network attack vector and high attack complexity.
NVD description
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.
EPSS · FIRST.org
53.5%probability of exploitation in the next 30 days
Higher than 98% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-18, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 1 juin 2021
- Updated
- 17 juin 2026
- Status
- Modified
- Source
- f5sirt@f5.com
Affected products
Weaknesses (CWE)
References (28)
- http://mailman.nginx.org/pipermail/nginx-announce/2021/000300.htmlMailing ListPatchVendor Advisory
- http://packetstormsecurity.com/files/167720/Nginx-1.20.0-Denial-Of-Service.htmlThird Party AdvisoryVDB Entry
- https://security.netapp.com/advisory/ntap-20210708-0006/Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlPatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatchThird Party Advisory
- http://mailman.nginx.org/pipermail/nginx-announce/2021/000300.htmlMailing ListPatchVendor Advisory
- + 13 more references on NVD
Similar CVEs
Other vulnerabilities of type CWE-193
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.