CVE-2009-3896

src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6...

5.0 MediumFix available

CVE-2009-3896 is a medium vulnerability (CVSS 5.0) in F5 Nginx, published October 26, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 10.2%, the 95th percentile. Fixed in nginx 0.7.62-1.

src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.14 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a long URI.

Exploit likelihood

10.2%Up 3.6 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

Record: CVE-2009-3896
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Record: CVE-2009-3896
Updated: 2026-11-02

EUVDEUVD-2009-3867 No score

Record: EUVD-2009-3867
Updated: 2026-11-03

GitHub AdvisoriesGHSA-32qw-fvh7-vw83 No score

src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6...

Record: GHSA-32qw-fvh7-vw83
Weakness: CWE-119
Updated: 2026-11-02

OSV No score

Record: CVE-2009-3896
Updated: 2026-11-02

OSVDEBIAN-CVE-2009-3896 No score

Record: DEBIAN-CVE-2009-3896
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`nginx` Debian:12	before 0.7.62-1	0.7.62-1
`nginx` Debian:13	before 0.7.62-1	0.7.62-1
`nginx` Debian:14	before 0.7.62-1	0.7.62-1
`nginx` Debian:4.0	before 0.4.13-2+etch3, plus listed versions 0.4.13-20.4.13-2+etch2	0.4.13-2+etch3
`nginx` Debian:5.0	before 0.6.32-3+lenny3, plus listed versions 0.6.32-30.6.32-3+lenny2	0.6.32-3+lenny3

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 12 moreShow less