Every CVE Search/ Get API key

CVE-2009-3896

src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6...

5.0 MediumFix available

src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.14 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a long URI.

Exploit likelihood

10.2%Up 3.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.14 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a long URI.

Record
CVE-2009-3896
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.14 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a long URI.

Record
CVE-2009-3896
Updated
2026-11-02
EUVDEUVD-2009-3867 No score

src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.14 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a long URI.

Record
EUVD-2009-3867
Updated
2026-11-03
GitHub AdvisoriesGHSA-32qw-fvh7-vw83 No score

src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6...

src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.14 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a long URI.

Record
GHSA-32qw-fvh7-vw83
Weakness
CWE-119
Updated
2026-11-02
OSV No score

src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.14 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a long URI.

Record
CVE-2009-3896
Updated
2026-11-02
OSVDEBIAN-CVE-2009-3896 No score

src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.14 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a long URI.

Record
DEBIAN-CVE-2009-3896
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nginx
Debian:12
 before 0.7.62-1
0.7.62-1
nginx
Debian:13
 before 0.7.62-1
0.7.62-1
nginx
Debian:14
 before 0.7.62-1
0.7.62-1
nginx
Debian:4.0
 before 0.4.13-2+etch3, plus listed versions
0.4.13-20.4.13-2+etch2
0.4.13-2+etch3
nginx
Debian:5.0
 before 0.6.32-3+lenny3, plus listed versions
0.6.32-30.6.32-3+lenny2
0.6.32-3+lenny3

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-3896 is a medium vulnerability (CVSS 5.0) in F5 Nginx, published October 26, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 10.2%, the 95th percentile. Fixed in nginx 0.7.62-1.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open