Every CVE Search/ Get API key

CVE-2016-4450

os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to...

7.5 HighFix available

os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

16.4%Up 15.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.

Record
CVE-2016-4450
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-476
Updated
2026-11-02
CVE List No score

os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.

Record
CVE-2016-4450
Updated
2026-11-02
EUVDEUVD-2016-5439 No score

os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.

Record
EUVD-2016-5439
Updated
2026-11-03
GitHub AdvisoriesGHSA-qw3j-mxg7-jx9v 7.5

os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to...

os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.

Record
GHSA-qw3j-mxg7-jx9v
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSV 7.5

os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.

Record
CVE-2016-4450
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2016-4450 7.5

os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.

Record
DEBIAN-CVE-2016-4450
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVUBUNTU-CVE-2016-4450 7.5

os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.

Record
UBUNTU-CVE-2016-4450
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2016-0216 No score

Updated nginx packages fix CVE-2016-4450

Updated nginx package fixes security vulnerability:

A problem was identified in nginx code responsible for saving client request body to a temporary file. A specially crafted request might result in worker process crash due to a NULL pointer dereference while writing client request body to a temporary file (CVE-2016-4450).

Record
MGASA-2016-0216
Updated
2026-11-02
OSVopenSUSE-SU-2017:0361-1 No score

Security update for nginx

This update for nginx fixes the following vulnerability:

  • CVE-2016-4450: Remote attackers could have caused a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.
Record
openSUSE-SU-2017:0361-1
Updated
2026-11-02
OSVopenSUSE-SU-2017:0362-1 No score

Security update for nginx

This update for nginx fixes the following vulnerability:

  • CVE-2016-4450: Remote attackers could have caused a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.
Record
openSUSE-SU-2017:0362-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10044-1 No score

nginx-1.11.4-2.5 on GA media

These are all security issues fixed in the nginx-1.11.4-2.5 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10044-1
Updated
2026-11-02
OSVSUSE-SU-2017:0190-1 No score

Security update for nginx-1.0

This update for nginx-1.0 fixes the following issues:

This security issues fixed:

  • CVE-2016-4450: NULL pointer dereference while writing client request body (bsc#982505).
  • CVE-2016-1000105: Setting HTTP_PROXY environment variable via Proxy header (httpoxy) (bnc#988491).
Record
SUSE-SU-2017:0190-1
Updated
2026-11-02
OSVUSN-2991-1 No score

nginx vulnerability

It was discovered that nginx incorrectly handled saving client request bodies to temporary files. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service.

Record
USN-2991-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nginx
Debian:12
 before 1.10.1-1
1.10.1-1
nginx
Debian:13
 before 1.10.1-1
1.10.1-1
nginx
Debian:14
 before 1.10.1-1
1.10.1-1
nginx
Debian:8
 before 1.6.2-5+deb8u2, plus listed versions
1.6.2-51.6.2-5+a.exp11.6.2-5+deb8u11.6.2-5+deb8u1~bpo70+11.6.2-5+deb8u2~bpo70+1
1.6.2-5+deb8u2
nginx
Mageia:5
 before 1.6.2-5.2.mga5
1.6.2-5.2.mga5
rh-nginx18-nginx
Red Hat:rhel_software_collections:2::el6
From an advisory covering 4 CVEs
 before 1:1.8.1-1.el6
1:1.8.1-1.el6
rh-nginx18-nginx-debuginfo
Red Hat:rhel_software_collections:2::el6
From an advisory covering 4 CVEs
 before 1:1.8.1-1.el6
1:1.8.1-1.el6
rh-nginx18-nginx
Red Hat:rhel_software_collections:2::el7
From an advisory covering 4 CVEs
 before 1:1.8.1-1.el7
1:1.8.1-1.el7
rh-nginx18-nginx-debuginfo
Red Hat:rhel_software_collections:2::el7
From an advisory covering 4 CVEs
 before 1:1.8.1-1.el7
1:1.8.1-1.el7
nginx-1.0
SUSE:Lifecycle Management Server 1.3
From an advisory covering 2 CVEs
 before 1.0.15-0.34.1
1.0.15-0.34.1
Show 6 moreShow less
Affected packages
PackageAffectedFixed
nginx-1.0
SUSE:Studio Onsite 1.3
From an advisory covering 2 CVEs
 before 1.0.15-0.34.1
1.0.15-0.34.1
nginx-1.0
SUSE:WebYast 1.3
From an advisory covering 2 CVEs
 before 1.0.15-0.34.1
1.0.15-0.34.1
nginx
Ubuntu:14.04:LTS
 before 1.4.6-1ubuntu3.5, plus listed versions
1.4.1-3ubuntu11.4.3-2ubuntu11.4.4-1ubuntu11.4.4-2ubuntu11.4.4-4ubuntu1
Show 7 moreShow less
1.4.5-1ubuntu11.4.6-1ubuntu21.4.6-1ubuntu31.4.6-1ubuntu3.11.4.6-1ubuntu3.21.4.6-1ubuntu3.31.4.6-1ubuntu3.4
1.4.6-1ubuntu3.5
nginx
Ubuntu:16.04:LTS
 before 1.10.0-0ubuntu0.16.04.2, plus listed versions
1.9.3-1ubuntu11.9.6-2ubuntu11.9.6-2ubuntu21.9.9-0ubuntu11.9.9-1ubuntu1
Show 9 moreShow less
1.9.10-0ubuntu11.9.10-1ubuntu11.9.11-0ubuntu11.9.11-0ubuntu21.9.12-0ubuntu11.9.13-0ubuntu11.9.14-0ubuntu11.9.15-0ubuntu11.10.0-0ubuntu0.16.04.1
1.10.0-0ubuntu0.16.04.2
nginx
SUSE:Package Hub 12
 before 1.8.1-9.1
1.8.1-9.1
nginx
openSUSE:Tumbleweed
From an advisory covering 11 CVEs
 before 1.11.4-2.5
1.11.4-2.5

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-4450 is a high vulnerability (CVSS 7.5) in F5 Nginx, published May 31, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 16.4%, the 96th percentile. Fixed in nginx 1.10.1-1.

References

Show 41 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open