{"id":"CVE-2016-4450","aliases":["DEBIAN-CVE-2016-4450","DSA-3592-1","EUVD-2016-5439","GHSA-qw3j-mxg7-jx9v","MGASA-2016-0216","RHSA-2016:1425","SUSE-SU-2017:0190-1","UBUNTU-CVE-2016-4450","USN-2991-1","openSUSE-SU-2017:0361-1","openSUSE-SU-2017:0362-1","openSUSE-SU-2024:10044-1"],"status":"published","title":"os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to...","description":"os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.16376,"percentile":0.96989,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2016-05-31T00:00:00Z","modified":"2026-10-24T10:30:33Z","fixes":[{"ecosystem":"Debian:12","package":"nginx","fixed_in":["1.10.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nginx","fixed_in":["1.10.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nginx","fixed_in":["1.10.1-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"nginx","fixed_in":["1.6.2-5+deb8u2"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"nginx","fixed_in":["1.6.2-5.2.mga5"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"nginx","fixed_in":["1.4.6-1ubuntu3.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"nginx","fixed_in":["1.10.0-0ubuntu0.16.04.2"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 12","package":"nginx","fixed_in":["1.8.1-9.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.1-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-5+deb8u2"}]}],"versions":["1.6.2-5","1.6.2-5+a.exp1","1.6.2-5+deb8u1","1.6.2-5+deb8u1~bpo70+1","1.6.2-5+deb8u2~bpo70+1"]},{"source":"osv","ecosystem":"Mageia:5","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-5.2.mga5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-nginx18-nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.1-1.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-nginx18-nginx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.1-1.el6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-nginx18-nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.1-1.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-nginx18-nginx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.1-1.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Lifecycle Management Server 1.3","package":"nginx-1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.15-0.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Studio Onsite 1.3","package":"nginx-1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.15-0.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:WebYast 1.3","package":"nginx-1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.15-0.34.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-1ubuntu3.5"}]}],"versions":["1.4.1-3ubuntu1","1.4.3-2ubuntu1","1.4.4-1ubuntu1","1.4.4-2ubuntu1","1.4.4-4ubuntu1","1.4.5-1ubuntu1","1.4.6-1ubuntu2","1.4.6-1ubuntu3","1.4.6-1ubuntu3.1","1.4.6-1ubuntu3.2","1.4.6-1ubuntu3.3","1.4.6-1ubuntu3.4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-0ubuntu0.16.04.2"}]}],"versions":["1.9.3-1ubuntu1","1.9.6-2ubuntu1","1.9.6-2ubuntu2","1.9.9-0ubuntu1","1.9.9-1ubuntu1","1.9.10-0ubuntu1","1.9.10-1ubuntu1","1.9.11-0ubuntu1","1.9.11-0ubuntu2","1.9.12-0ubuntu1","1.9.13-0ubuntu1","1.9.14-0ubuntu1","1.9.15-0ubuntu1","1.10.0-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-1ubuntu3.5"}]}],"versions":["1.4.1-3ubuntu1","1.4.3-2ubuntu1","1.4.4-1ubuntu1","1.4.4-2ubuntu1","1.4.4-4ubuntu1","1.4.5-1ubuntu1","1.4.6-1ubuntu2","1.4.6-1ubuntu3","1.4.6-1ubuntu3.1","1.4.6-1ubuntu3.2","1.4.6-1ubuntu3.3","1.4.6-1ubuntu3.4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-0ubuntu0.16.04.2"}]}],"versions":["1.9.3-1ubuntu1","1.9.6-2ubuntu1","1.9.6-2ubuntu2","1.9.9-0ubuntu1","1.9.9-1ubuntu1","1.9.10-0ubuntu1","1.9.10-1ubuntu1","1.9.11-0ubuntu1","1.9.11-0ubuntu2","1.9.12-0ubuntu1","1.9.13-0ubuntu1","1.9.14-0ubuntu1","1.9.15-0ubuntu1","1.10.0-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-2.5"}]}],"bundled":11}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"f5","product":"nginx"}],"references":[{"url":"http://www.securitytracker.com/id/1036019","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.gentoo.org/glsa/201606-06","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://mailman.nginx.org/pipermail/nginx-announce/2016/000179.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory","advisory","article","report"]},{"url":"http://www.ubuntu.com/usn/USN-2991-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.debian.org/security/2016/dsa-3592","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:1425","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/90967","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4450","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qw3j-mxg7-jx9v"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-4450","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0216.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18595","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1302587","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1302588","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1302589","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1341462","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1425.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-0742","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-0742","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0742","tags":["advisory"]},{"url":"http://mailman.nginx.org/pipermail/nginx-announce/2016/000169.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-0746","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-0746","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0746","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-0747","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-0747","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0747","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4450","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4450","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170190-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/982505","tags":["report"]},{"url":"https://bugzilla.suse.com/988491","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1000105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4450","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-4450","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2991-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0747","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-4450","description":"os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.","status":"published","published":"2016-06-07T14:00:00Z","modified":"2024-08-06T00:32:25.451Z","updated_at":"2026-11-02T14:33:35.488991Z"}],"euvd":[{"id":"EUVD-2016-5439","description":"os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.","status":"published","published":"2016-06-07T14:00:00Z","modified":"2024-08-06T00:32:25Z","updated_at":"2026-11-03T02:22:46.329763Z"}],"ghsa":[{"id":"GHSA-qw3j-mxg7-jx9v","title":"os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to...","description":"os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.","status":"published","published":"2022-05-13T01:05:15Z","modified":"2023-02-01T05:02:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:49:58.498747Z"}],"nvd":[{"id":"CVE-2016-4450","description":"os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.","status":"published","published":"2016-06-07T14:06:14.2Z","modified":"2026-06-17T00:47:35.047Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:03:26.642445Z"}],"osv":[{"id":"CVE-2016-4450","description":"os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.","status":"published","published":"2016-06-07T14:06:14.2Z","modified":"2026-10-24T10:30:33.725491726Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:02.454775Z"},{"id":"DEBIAN-CVE-2016-4450","description":"os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.","status":"published","published":"2016-06-07T14:06:14.2Z","modified":"2026-09-22T07:00:47.321678616Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"UBUNTU-CVE-2016-4450","description":"os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a crafted request, involving writing a client request body to a temporary file.","status":"published","published":"2016-05-31T00:00:00Z","modified":"2026-02-04T04:25:10.266933Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:12.261906Z"},{"id":"DSA-3592-1","title":"nginx - security update","status":"published","published":"2016-06-01T00:00:00Z","modified":"2026-03-09T01:21:08.897062Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0216","title":"Updated nginx packages fix CVE-2016-4450","description":"Updated nginx package fixes security vulnerability:\n\nA problem was identified in nginx code responsible for saving client request\nbody to a temporary file.  A specially crafted request might result in worker\nprocess crash due to a NULL pointer dereference while writing client request\nbody to a temporary file (CVE-2016-4450).\n","status":"published","published":"2016-06-02T21:40:03Z","modified":"2026-04-16T06:26:18.584896049Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2017:0361-1","title":"Security update for nginx","description":"This update for nginx fixes the following vulnerability:\n\n- CVE-2016-4450: Remote attackers could have caused a denial of service\n  (NULL pointer dereference and worker process crash) via a crafted request,\n  involving writing a client request body to a temporary file.","status":"published","published":"2017-02-01T21:19:46Z","modified":"2026-02-04T02:41:20.611093Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2017:0362-1","title":"Security update for nginx","description":"This update for nginx fixes the following vulnerability:\n\n- CVE-2016-4450: Remote attackers could have caused a denial of service\n  (NULL pointer dereference and worker process crash) via a crafted request,\n  involving writing a client request body to a temporary file.","status":"published","published":"2017-02-01T21:19:46Z","modified":"2026-02-04T02:52:54.388304Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:10044-1","title":"nginx-1.11.4-2.5 on GA media","description":"These are all security issues fixed in the nginx-1.11.4-2.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:22:35.012911Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2016:1425","title":"Red Hat Security Advisory: rh-nginx18-nginx security update","status":"published","published":"2024-09-13T12:28:22Z","modified":"2026-06-29T10:12:55Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"SUSE-SU-2017:0190-1","title":"Security update for nginx-1.0","description":"This update for nginx-1.0 fixes the following issues:\n\nThis security issues fixed:\n- CVE-2016-4450: NULL pointer dereference while writing client request body (bsc#982505).\n- CVE-2016-1000105: Setting HTTP_PROXY environment variable via Proxy header (httpoxy) (bnc#988491).\n","status":"published","published":"2017-01-17T17:04:53Z","modified":"2026-02-04T04:33:01.741931Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"USN-2991-1","title":"nginx vulnerability","description":"It was discovered that nginx incorrectly handled saving client request\nbodies to temporary files. A remote attacker could possibly use this issue\nto cause nginx to crash, resulting in a denial of service.\n","status":"published","published":"2016-06-02T17:03:40Z","modified":"2026-02-10T04:41:00Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}