Every CVE Search/ Get API key

CVE-2017-7529

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow...

7.5 HighPublic exploitFix available

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

62.6%Up 57.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.

Record
CVE-2017-7529
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-190
Updated
2026-11-02
CVE List No score

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.

Record
CVE-2017-7529
Weakness
CWE-190
Updated
2026-11-02
EUVDEUVD-2017-16545 No score

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.

Record
EUVD-2017-16545
Updated
2026-11-03
GitHub AdvisoriesGHSA-85mj-h68w-w736 7.5

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow...

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.

Record
GHSA-85mj-h68w-w736
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-190
Updated
2026-11-02
OSVALPINE-CVE-2017-7529 7.5

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.

Record
ALPINE-CVE-2017-7529
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVBELL-CVE-2017-7529 7.5

CVE-2017-7529 does not affect BellSoft software

Record
BELL-CVE-2017-7529
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 12 moreShow less
OSV 7.5

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.

Record
CVE-2017-7529
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2017-7529 7.5

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.

Record
DEBIAN-CVE-2017-7529
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2017:2538 5.3

Red Hat Security Advisory: rh-nginx110-nginx security update

Record
RHSA-2017:2538
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2017-7529 7.5

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.

Record
UBUNTU-CVE-2017-7529
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVCLSA-2026-1776791328 No score

nginx: Fix of 5 CVEs

  • CVE-2017-7529: fix integer overflow in range filter
  • CVE-2018-16843: fix excessive memory consumption in HTTP/2
  • CVE-2018-16844: fix excessive CPU usage in HTTP/2
  • CVE-2019-9511: fix excessive memory growth via HTTP/2 DATA frame manipulation
  • CVE-2019-9513: fix excessive CPU usage via HTTP/2 PRIORITY frame manipulation
Record
CLSA-2026-1776791328
Updated
2026-11-02
OSVCLSA-2026-1776791510 No score

nginx: Fix of 5 CVEs

  • CVE-2017-7529: fix integer overflow in range filter
  • CVE-2018-16843: fix excessive memory consumption in HTTP/2
  • CVE-2018-16844: fix excessive CPU usage in HTTP/2
  • CVE-2019-9511: fix excessive memory growth via HTTP/2 DATA frame manipulation
  • CVE-2019-9513: fix excessive CPU usage via HTTP/2 PRIORITY frame manipulation
Record
CLSA-2026-1776791510
Updated
2026-11-02
OSVMGASA-2017-0231 No score

Updated nginx packages fix security vulnerability

A security issue was identified in nginx range filter. A specially crafted request might result in an integer overflow and incorrect processing of ranges, potentially resulting in sensitive information leak (CVE-2017-7529).

Record
MGASA-2017-0231
Updated
2026-11-02
OSVopenSUSE-SU-2018:0813-1 No score

Security update for nginx

This update for nginx to version 1.13.9 fixes the following issues:

  • CVE-2017-7529: nginx: Integer overflow in nginx range filter module allowed memory disclosure (bsc#1048265)

This update also contains all updates and improvements in 1.13.9 upstream release.

Record
openSUSE-SU-2018:0813-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11092-1 No score

nginx-1.21.3-1.4 on GA media

These are all security issues fixed in the nginx-1.21.3-1.4 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11092-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11341-1 No score

ruby2.7-rubygem-passenger-6.0.8-3.2 on GA media

These are all security issues fixed in the ruby2.7-rubygem-passenger-6.0.8-3.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11341-1
Updated
2026-11-02
OSVSUSE-SU-2017:2387-1 No score

Security update for nginx-1.0

This update for NGINX fixes the following issues:

Security issue fixed:

  • CVE-2017-7529: Integer overflow in nginx range filter module leading to memory disclosure. (bsc#1048265)
Record
SUSE-SU-2017:2387-1
Updated
2026-11-02
OSVUSN-3352-1 No score

nginx vulnerability

It was discovered that an integer overflow existed in the range filter feature of nginx. A remote attacker could use this to expose sensitive information.

Record
USN-3352-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nginx
Alpine:v3.10
 0.5.6 up to 1.12.1-r0
1.12.1-r0
nginx
Alpine:v3.11
 0.5.6 up to 1.12.1-r0
1.12.1-r0
nginx
Alpine:v3.12
 0.5.6 up to 1.12.1-r0
1.12.1-r0
nginx
Alpine:v3.13
 0.5.6 up to 1.12.1-r0
1.12.1-r0
nginx
Alpine:v3.14
 0.5.6 up to 1.12.1-r0
1.12.1-r0
nginx
Alpine:v3.15
 0.5.6 up to 1.12.1-r0
1.12.1-r0
nginx
Alpine:v3.16
 0.5.6 up to 1.12.1-r0
1.12.1-r0
nginx
Alpine:v3.17
 0.5.6 up to 1.12.1-r0
1.12.1-r0
nginx
Alpine:v3.18
 0.5.6 up to 1.12.1-r0
1.12.1-r0
nginx
Alpine:v3.19
 0.5.6 up to 1.12.1-r0
1.12.1-r0
Show 58 moreShow less
Affected packages
PackageAffectedFixed
nginx
Alpine:v3.20
 0.5.6 up to 1.12.1-r0
1.12.1-r0
nginx
Alpine:v3.21
 0.5.6 up to 1.12.1-r0
1.12.1-r0
nginx
Alpine:v3.22
 0.5.6 up to 1.12.1-r0
1.12.1-r0
nginx
Alpine:v3.23
 0.5.6 up to 1.12.1-r0
1.12.1-r0
nginx
Alpine:v3.24
 0.5.6 up to 1.12.1-r0
1.12.1-r0
nginx
Alpine:v3.4
 0.5.6 up to 1.10.3-r0
1.10.3-r0
nginx
Alpine:v3.5
 0.5.6 up to 1.10.3-r1
1.10.3-r1
nginx
Alpine:v3.6
 0.5.6 up to 1.12.1-r0
1.12.1-r0
nginx
Alpine:v3.7
 0.5.6 up to 1.12.1-r0
1.12.1-r0
nginx
Alpine:v3.8
 0.5.6 up to 1.12.1-r0
1.12.1-r0
nginx
Alpine:v3.9
 0.5.6 up to 1.12.1-r0
1.12.1-r0
nginx
TuxCare:OracleLinux:6
From an advisory covering 5 CVEs
 before 1.10.3-4.el6.tuxcare.els7
1.10.3-4.el6.tuxcare.els7
nginx-all-modules
TuxCare:OracleLinux:6
From an advisory covering 5 CVEs
 before 1.10.3-4.el6.tuxcare.els7
1.10.3-4.el6.tuxcare.els7
nginx-filesystem
TuxCare:OracleLinux:6
From an advisory covering 5 CVEs
 before 1.10.3-4.el6.tuxcare.els7
1.10.3-4.el6.tuxcare.els7
nginx-mod-http-geoip
TuxCare:OracleLinux:6
From an advisory covering 5 CVEs
 before 1.10.3-4.el6.tuxcare.els7
1.10.3-4.el6.tuxcare.els7
nginx-mod-http-image-filter
TuxCare:OracleLinux:6
From an advisory covering 5 CVEs
 before 1.10.3-4.el6.tuxcare.els7
1.10.3-4.el6.tuxcare.els7
nginx-mod-http-perl
TuxCare:OracleLinux:6
From an advisory covering 5 CVEs
 before 1.10.3-4.el6.tuxcare.els7
1.10.3-4.el6.tuxcare.els7
nginx-mod-http-xslt-filter
TuxCare:OracleLinux:6
From an advisory covering 5 CVEs
 before 1.10.3-4.el6.tuxcare.els7
1.10.3-4.el6.tuxcare.els7
nginx-mod-mail
TuxCare:OracleLinux:6
From an advisory covering 5 CVEs
 before 1.10.3-4.el6.tuxcare.els7
1.10.3-4.el6.tuxcare.els7
nginx-mod-stream
TuxCare:OracleLinux:6
From an advisory covering 5 CVEs
 before 1.10.3-4.el6.tuxcare.els7
1.10.3-4.el6.tuxcare.els7
nginx
TuxCare:CentOS:6
From an advisory covering 5 CVEs
 before 1.10.3-4.el6.tuxcare.els7
1.10.3-4.el6.tuxcare.els7
nginx-all-modules
TuxCare:CentOS:6
From an advisory covering 5 CVEs
 before 1.10.3-4.el6.tuxcare.els7
1.10.3-4.el6.tuxcare.els7
nginx-filesystem
TuxCare:CentOS:6
From an advisory covering 5 CVEs
 before 1.10.3-4.el6.tuxcare.els7
1.10.3-4.el6.tuxcare.els7
nginx-mod-http-geoip
TuxCare:CentOS:6
From an advisory covering 5 CVEs
 before 1.10.3-4.el6.tuxcare.els7
1.10.3-4.el6.tuxcare.els7
nginx-mod-http-image-filter
TuxCare:CentOS:6
From an advisory covering 5 CVEs
 before 1.10.3-4.el6.tuxcare.els7
1.10.3-4.el6.tuxcare.els7
nginx-mod-http-perl
TuxCare:CentOS:6
From an advisory covering 5 CVEs
 before 1.10.3-4.el6.tuxcare.els7
1.10.3-4.el6.tuxcare.els7
nginx-mod-http-xslt-filter
TuxCare:CentOS:6
From an advisory covering 5 CVEs
 before 1.10.3-4.el6.tuxcare.els7
1.10.3-4.el6.tuxcare.els7
nginx-mod-mail
TuxCare:CentOS:6
From an advisory covering 5 CVEs
 before 1.10.3-4.el6.tuxcare.els7
1.10.3-4.el6.tuxcare.els7
nginx-mod-stream
TuxCare:CentOS:6
From an advisory covering 5 CVEs
 before 1.10.3-4.el6.tuxcare.els7
1.10.3-4.el6.tuxcare.els7
nginx
Debian:12
 before 1.13.3-1
1.13.3-1
nginx
Debian:13
 before 1.13.3-1
1.13.3-1
nginx
Debian:14
 before 1.13.3-1
1.13.3-1
nginx
Debian:7
 before 1.2.1-2.2+wheezy4+deb7u1, plus listed versions
1.2.1-2.21.2.1-2.2+wheezy11.2.1-2.2+wheezy21.2.1-2.2+wheezy31.2.1-2.2+wheezy3~bpo60+11.2.1-2.2+wheezy4
1.2.1-2.2+wheezy4+deb7u1
nginx
Debian:8
 before 1.6.2-5+deb8u5, plus listed versions
1.6.2-51.6.2-5+a.exp11.6.2-5+deb8u11.6.2-5+deb8u1~bpo70+11.6.2-5+deb8u21.6.2-5+deb8u2~bpo70+11.6.2-5+deb8u31.6.2-5+deb8u4
1.6.2-5+deb8u5
nginx
Debian:9
 before 1.10.3-1+deb9u1, plus listed versions
1.10.3-11.10.3-1+deb9u1~bpo8+11.10.3-1+deb9u1~bpo8+2
1.10.3-1+deb9u1
nginx
Mageia:5
 before 1.6.2-5.3.mga5
1.6.2-5.3.mga5
nginx
Mageia:6
 before 1.10.3-1.1.mga6
1.10.3-1.1.mga6
rh-nginx110-nginx
Red Hat:rhel_software_collections:2::el6
 before 1:1.10.2-8.el6
1:1.10.2-8.el6
rh-nginx110-nginx-debuginfo
Red Hat:rhel_software_collections:2::el6
 before 1:1.10.2-8.el6
1:1.10.2-8.el6
rh-nginx110-nginx-mod-http-image-filter
Red Hat:rhel_software_collections:2::el6
 before 1:1.10.2-8.el6
1:1.10.2-8.el6
rh-nginx110-nginx-mod-http-perl
Red Hat:rhel_software_collections:2::el6
 before 1:1.10.2-8.el6
1:1.10.2-8.el6
rh-nginx110-nginx-mod-http-xslt-filter
Red Hat:rhel_software_collections:2::el6
 before 1:1.10.2-8.el6
1:1.10.2-8.el6
rh-nginx110-nginx-mod-mail
Red Hat:rhel_software_collections:2::el6
 before 1:1.10.2-8.el6
1:1.10.2-8.el6
rh-nginx110-nginx-mod-stream
Red Hat:rhel_software_collections:2::el6
 before 1:1.10.2-8.el6
1:1.10.2-8.el6
rh-nginx110-nginx
Red Hat:rhel_software_collections:2::el7
 before 1:1.10.2-8.el7
1:1.10.2-8.el7
rh-nginx110-nginx-debuginfo
Red Hat:rhel_software_collections:2::el7
 before 1:1.10.2-8.el7
1:1.10.2-8.el7
rh-nginx110-nginx-mod-http-image-filter
Red Hat:rhel_software_collections:2::el7
 before 1:1.10.2-8.el7
1:1.10.2-8.el7
rh-nginx110-nginx-mod-http-perl
Red Hat:rhel_software_collections:2::el7
 before 1:1.10.2-8.el7
1:1.10.2-8.el7
rh-nginx110-nginx-mod-http-xslt-filter
Red Hat:rhel_software_collections:2::el7
 before 1:1.10.2-8.el7
1:1.10.2-8.el7
rh-nginx110-nginx-mod-mail
Red Hat:rhel_software_collections:2::el7
 before 1:1.10.2-8.el7
1:1.10.2-8.el7
rh-nginx110-nginx-mod-stream
Red Hat:rhel_software_collections:2::el7
 before 1:1.10.2-8.el7
1:1.10.2-8.el7
nginx-1.0
SUSE:Lifecycle Management Server 1.3
 before 1.0.15-0.35.3.1
1.0.15-0.35.3.1
nginx-1.0
SUSE:Studio Onsite 1.3
 before 1.0.15-0.35.3.1
1.0.15-0.35.3.1
nginx-1.0
SUSE:WebYast 1.3
 before 1.0.15-0.35.3.1
1.0.15-0.35.3.1
nginx
Ubuntu:14.04:LTS
 before 1.4.6-1ubuntu3.8, plus listed versions
1.4.1-3ubuntu11.4.3-2ubuntu11.4.4-1ubuntu11.4.4-2ubuntu11.4.4-4ubuntu1
Show 10 moreShow less
1.4.5-1ubuntu11.4.6-1ubuntu21.4.6-1ubuntu31.4.6-1ubuntu3.11.4.6-1ubuntu3.21.4.6-1ubuntu3.31.4.6-1ubuntu3.41.4.6-1ubuntu3.51.4.6-1ubuntu3.61.4.6-1ubuntu3.7
1.4.6-1ubuntu3.8
nginx
Ubuntu:16.04:LTS
 before 1.10.3-0ubuntu0.16.04.2, plus listed versions
1.9.3-1ubuntu11.9.6-2ubuntu11.9.6-2ubuntu21.9.9-0ubuntu11.9.9-1ubuntu1
Show 13 moreShow less
1.9.10-0ubuntu11.9.10-1ubuntu11.9.11-0ubuntu11.9.11-0ubuntu21.9.12-0ubuntu11.9.13-0ubuntu11.9.14-0ubuntu11.9.15-0ubuntu11.10.0-0ubuntu0.16.04.11.10.0-0ubuntu0.16.04.21.10.0-0ubuntu0.16.04.31.10.0-0ubuntu0.16.04.41.10.3-0ubuntu0.16.04.1
1.10.3-0ubuntu0.16.04.2
nginx
SUSE:Package Hub 12
 before 1.13.9-12.1
1.13.9-12.1
nginx
openSUSE:Tumbleweed
From an advisory covering 7 CVEs
 before 1.21.3-1.4
1.21.3-1.4

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubliusec/CVE-2017-75292017-07-19
PoC in GitHuben0f/CVE-2017-7529_PoC2018-06-20
PoC in GitHubcved-sources/cve-2017-75292019-01-17
PoC in GitHubMaxSecurity/CVE-2017-7529-POC2019-06-06
PoC in GitHubcyberk1w1/CVE-2017-75292020-06-13
PoC in GitHubcyberharsh/nginx-CVE-2017-75292020-06-24
PoC in GitHubdaehee/nginx-overflow2020-09-15
PoC in GitHubgemboxteam/exploit-nginx-1.10.32021-01-19
PoC in GitHubinsecrez/Remote-Integer-Overflow-Vulnerability2021-01-20
PoC in GitHubmo3zj/Nginx-Remote-Integer-Overflow-Vulnerability2021-03-31
Show 8 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubfu2x2000/CVE-2017-7529-Nginx---Remote-Integer-Overflow-Exploit2021-09-01
PoC in GitHubShehzadcyber/CVE-2017-75292022-07-18
PoC in GitHubcoolman6942o/-Exploit-CVE-2017-75292023-12-19
PoC in GitHubSirEagIe/CVE-2017-75292024-04-25
PoC in GitHubFenil2511/CVE-2017-7529-POC2025-03-05
PoC in GitHubyoungmin0104/CVE-2017-7529-2025-04-17
PoC in GitHubportfolio10/nginx2025-04-27
PoC in GitHubCyberCTF/vulhub-nginx-cve-2017-75292026-10-08

History

History
RecordedChangedSources
affected, exploits, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-7529 is a high vulnerability (CVSS 7.5) in F5 Nginx, published July 11, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 62.6%, the 99th percentile. Fixed in nginx 1.12.1-r0.

References

Show 37 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open