CVE-2020-11724
An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP...
An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.capture API.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.capture API.
- Record
CVE-2020-11724- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-444
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.capture API.
- Record
CVE-2020-11724- Updated
- 2026-11-02
EUVDEUVD-2020-4066 No score
An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.capture API.
- Record
EUVD-2020-4066- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-478m-xrv3-7r93
An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP...
An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.capture API.
- Record
GHSA-478m-xrv3-7r93- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-444
- Updated
- 2026-11-02
OSV
An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.capture API.
- Record
CVE-2020-11724- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-11724
An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.capture API.
- Record
DEBIAN-CVE-2020-11724- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2020-11724
An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.capture API.
- Record
UBUNTU-CVE-2020-11724- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVCLSA-2022-1650377152 No score
Fix CVE(s): CVE-2020-11724
- SECURITY UPDATE: HTTP request smuggling in Lua module
- debian/modules/nginx-lua: Fix parsing HTTP headers in the ngx.location.capture API (porting an upstream patch 9ab38e8ee35fc08a57636b1b6190dca70b0076fa from https://github.com/openresty/lua-nginx-module)
- CVE-2020-11724
- Record
CLSA-2022-1650377152- Updated
- 2026-11-02
OSVUSN-5371-1 No score
nginx vulnerabilities
It was discovered that nginx Lua module mishandled certain inputs. An attacker could possibly use this issue to perform an HTTP Request Smuggling attack. This issue was fixed for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-11724)
It was discovered that nginx Lua module mishandled certain inputs. An attacker could possibly use this issue to disclose sensitive information. This issue only affects Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-36309)
It was discovered that nginx mishandled the use of compatible certificates among multiple encryption protocols. If a remote attacker were able to intercept the communication, this issue could be used to redirect traffic between subdomains. (CVE-2021-3618)
- Record
USN-5371-1- Updated
- 2026-11-02
OSVUSN-5371-3 No score
nginx vulnerability
USN-5371-1 and USN-5371-2 fixed several vulnerabilities in nginx. This update provides the corresponding update for CVE-2020-11724 for Ubuntu 16.04 ESM.
Original advisory details:
It was discovered that nginx Lua module mishandled certain inputs. An attacker could possibly use this issue to perform an HTTP Request Smuggling attack. This issue was fixed for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-11724)
It was discovered that nginx Lua module mishandled certain inputs. An attacker could possibly use this issue to disclose sensitive information. This issue only affects Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-36309)
It was discovered that nginx mishandled the use of compatible certificates among multiple encryption protocols. If a remote attacker were able to intercept the communication, this issue could be used to redirect traffic between subdomains. (CVE-2021-3618)
- Record
USN-5371-3- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nginxTuxCare:Ubuntu:16.04 |
before 1.10.3-0ubuntu0.16.04.8+tuxcare.els2 | 1.10.3-0ubuntu0.16.04.8+tuxcare.els2 |
nginx-commonTuxCare:Ubuntu:16.04 |
before 1.10.3-0ubuntu0.16.04.8+tuxcare.els2 | 1.10.3-0ubuntu0.16.04.8+tuxcare.els2 |
nginx-coreTuxCare:Ubuntu:16.04 |
before 1.10.3-0ubuntu0.16.04.8+tuxcare.els2 | 1.10.3-0ubuntu0.16.04.8+tuxcare.els2 |
nginx-docTuxCare:Ubuntu:16.04 |
before 1.10.3-0ubuntu0.16.04.8+tuxcare.els2 | 1.10.3-0ubuntu0.16.04.8+tuxcare.els2 |
nginx-extrasTuxCare:Ubuntu:16.04 |
before 1.10.3-0ubuntu0.16.04.8+tuxcare.els2 | 1.10.3-0ubuntu0.16.04.8+tuxcare.els2 |
nginx-fullTuxCare:Ubuntu:16.04 |
before 1.10.3-0ubuntu0.16.04.8+tuxcare.els2 | 1.10.3-0ubuntu0.16.04.8+tuxcare.els2 |
nginx-lightTuxCare:Ubuntu:16.04 |
before 1.10.3-0ubuntu0.16.04.8+tuxcare.els2 | 1.10.3-0ubuntu0.16.04.8+tuxcare.els2 |
nginxDebian:12 |
before 1.18.0-5 | 1.18.0-5 |
nginxDebian:13 |
before 1.18.0-5 | 1.18.0-5 |
nginxDebian:14 |
before 1.18.0-5 | 1.18.0-5 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
nginxDebian:9 |
before 1.10.3-1+deb9u5, plus listed versions 1.10.3-11.10.3-1+deb9u11.10.3-1+deb9u1~bpo8+11.10.3-1+deb9u1~bpo8+21.10.3-1+deb9u21.10.3-1+deb9u31.10.3-1+deb9u4 |
1.10.3-1+deb9u5 |
nginxDebian:10 |
before 1.14.2-2+deb10u3, plus listed versions 1.14.2-21.14.2-2+deb10u11.14.2-2+deb10u2 |
1.14.2-2+deb10u3 |
nginxUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.4.1-3ubuntu11.4.3-2ubuntu11.4.4-1ubuntu11.4.4-2ubuntu11.4.4-4ubuntu1 Show 19 moreShow less1.4.5-1ubuntu11.4.6-1ubuntu21.4.6-1ubuntu31.4.6-1ubuntu3.11.4.6-1ubuntu3.21.4.6-1ubuntu3.31.4.6-1ubuntu3.41.4.6-1ubuntu3.51.4.6-1ubuntu3.61.4.6-1ubuntu3.71.4.6-1ubuntu3.81.4.6-1ubuntu3.91.4.6-1ubuntu3.9+esm11.4.6-1ubuntu3.9+esm21.4.6-1ubuntu3.9+esm31.4.6-1ubuntu3.9+esm41.4.6-1ubuntu3.9+esm51.4.6-1ubuntu3.9+esm61.4.6-1ubuntu3.9+esm8 |
None known |
nginxUbuntu:Pro:16.04:LTS |
before 1.10.3-0ubuntu0.16.04.5+esm4, plus listed versions 1.9.3-1ubuntu11.9.6-2ubuntu11.9.6-2ubuntu21.9.9-0ubuntu11.9.9-1ubuntu1 Show 20 moreShow less1.9.10-0ubuntu11.9.10-1ubuntu11.9.11-0ubuntu11.9.11-0ubuntu21.9.12-0ubuntu11.9.13-0ubuntu11.9.14-0ubuntu11.9.15-0ubuntu11.10.0-0ubuntu0.16.04.11.10.0-0ubuntu0.16.04.21.10.0-0ubuntu0.16.04.31.10.0-0ubuntu0.16.04.41.10.3-0ubuntu0.16.04.11.10.3-0ubuntu0.16.04.21.10.3-0ubuntu0.16.04.31.10.3-0ubuntu0.16.04.41.10.3-0ubuntu0.16.04.51.10.3-0ubuntu0.16.04.5+esm11.10.3-0ubuntu0.16.04.5+esm21.10.3-0ubuntu0.16.04.5+esm3 |
1.10.3-0ubuntu0.16.04.5+esm4 |
nginxUbuntu:18.04:LTS |
before 1.14.0-0ubuntu1.10, plus listed versions 1.12.1-0ubuntu21.13.6-2ubuntu11.13.6-2ubuntu21.13.10-1ubuntu11.13.12-0ubuntu1 Show 9 moreShow less1.14.0-0ubuntu11.14.0-0ubuntu1.11.14.0-0ubuntu1.21.14.0-0ubuntu1.31.14.0-0ubuntu1.41.14.0-0ubuntu1.51.14.0-0ubuntu1.61.14.0-0ubuntu1.71.14.0-0ubuntu1.9 |
1.14.0-0ubuntu1.10 |
nginxUbuntu:20.04:LTS |
before 1.18.0-0ubuntu1.3, plus listed versions 1.16.1-0ubuntu21.16.1-0ubuntu31.17.5-0ubuntu11.17.6-0ubuntu11.17.7-0ubuntu1 Show 9 moreShow less1.17.8-0ubuntu11.17.8-0ubuntu21.17.8-0ubuntu31.17.9-0ubuntu11.17.9-0ubuntu21.17.9-0ubuntu31.17.10-0ubuntu11.18.0-0ubuntu11.18.0-0ubuntu1.2 |
1.18.0-0ubuntu1.3 |
nginxUbuntu:Pro:16.04:LTS |
before 1.10.3-0ubuntu0.16.04.5+esm3, plus listed versions 1.9.3-1ubuntu11.9.6-2ubuntu11.9.6-2ubuntu21.9.9-0ubuntu11.9.9-1ubuntu1 Show 19 moreShow less1.9.10-0ubuntu11.9.10-1ubuntu11.9.11-0ubuntu11.9.11-0ubuntu21.9.12-0ubuntu11.9.13-0ubuntu11.9.14-0ubuntu11.9.15-0ubuntu11.10.0-0ubuntu0.16.04.11.10.0-0ubuntu0.16.04.21.10.0-0ubuntu0.16.04.31.10.0-0ubuntu0.16.04.41.10.3-0ubuntu0.16.04.11.10.3-0ubuntu0.16.04.21.10.3-0ubuntu0.16.04.31.10.3-0ubuntu0.16.04.41.10.3-0ubuntu0.16.04.51.10.3-0ubuntu0.16.04.5+esm11.10.3-0ubuntu0.16.04.5+esm2 |
1.10.3-0ubuntu0.16.04.5+esm3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-11724 is a high vulnerability (CVSS 7.5) in Openresty, published April 12, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.59%, the 85th percentile. Fixed in nginx 1.10.3-0ubuntu0.16.04.8+tuxcare.els2.
References
github.com/openresty/openresty/blob/4e8b4c395f842a078e429c80dd063b2323999957/patches/ngx_http_lua-0.10.15-fix_location_capture_content_length_chunked.patch
lists.debian.org/debian-lts-announce/2020/07/msg00014.html
debian.org/security/2020/dsa-4750
security.netapp.com/advisory/ntap-20210129-0002
nvd.nist.gov/vuln/detail/CVE-2020-11724
Show 9 moreShow less
errata.cloudlinux.com/ubuntu16_04/CLSA-2022-1650377152
security-tracker.debian.org/tracker/CVE-2020-11724
ubuntu.com/security/CVE-2020-11724
cve.org/CVERecord?id=CVE-2020-11724