{"id":"CVE-2024-33452","aliases":["BIT-openresty-2024-33452","DEBIAN-CVE-2024-33452","DLA-4228-1","EUVD-2024-31190","GHSA-qm42-2jf7-gc6x","UBUNTU-CVE-2024-33452"],"status":"published","title":"An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct...","description":"An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00852,"percentile":0.58669,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2025-04-22T00:00:00Z","modified":"2026-11-02T12:02:31Z","fixes":[{"ecosystem":"Bitnami","package":"openresty","fixed_in":["1.25.3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libnginx-mod-http-lua","fixed_in":["1:0.10.23-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libnginx-mod-http-lua","fixed_in":["1:0.10.27-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libnginx-mod-http-lua","fixed_in":["1:0.10.27-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nginx","fixed_in":["1.22.0-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nginx","fixed_in":["1.22.0-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nginx","fixed_in":["1.22.0-3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"openresty","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.25.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libnginx-mod-http-lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.10.23-1+deb12u1"}]}],"versions":["1:0.10.23-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libnginx-mod-http-lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.10.27-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libnginx-mod-http-lua","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.10.27-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.0-3"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-6.1+deb11u5"}]}],"versions":["1.18.0-6.1","1.18.0-6.1+deb11u1","1.18.0-6.1+deb11u2","1.18.0-6.1+deb11u3","1.18.0-6.1+deb11u4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"lua-nginx-memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"lua-nginx-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.20-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"lua-nginx-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.05-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"lua-nginx-memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"lua-nginx-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"lua-nginx-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.06-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"lua-nginx-memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.14-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"lua-nginx-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.27-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"lua-nginx-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.06-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"lua-nginx-memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.14-1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"lua-nginx-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.27-1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"lua-nginx-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.08-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"lua-nginx-memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.14-1.1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"lua-nginx-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.27-1.1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"lua-nginx-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.08-1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"lua-nginx-memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.14-1.1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"lua-nginx-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.27-1.1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"lua-nginx-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.08-1build1","0.13-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"lua-nginx-memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.14-1.1build2","0.18-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"lua-nginx-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.27-1.1build2","0.33-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"lua-nginx-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"lua-nginx-memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.14-1.1build1","0.14-1.1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"lua-nginx-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.27-1.1build1","0.27-1.1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"lua-nginx-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13-1"]}],"products":[{"vendor":"openresty","product":"lua-nginx-module"}],"references":[{"url":"https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn","tags":["Exploit","Third Party Advisory","advisory","web","report"]},{"url":"https://www.benasin.space/2025/03/18/OpenResty-lua-nginx-module-v0-10-26-HTTP-Request-Smuggling-in-HEAD-requests/","tags":["Exploit","Third Party Advisory","advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/06/msg00026.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-33452","tags":["web","advisory"]},{"url":"https://www.benasin.space/2025/03/18/OpenResty-lua-nginx-module-v0-10-26-HTTP-Request-Smuggling-in-HEAD-requests"},{"url":"https://github.com/advisories/GHSA-qm42-2jf7-gc6x"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/33xxx/CVE-2024-33452.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-33452","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-33452","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-33452","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-33452","description":"An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request.","status":"published","published":"2025-04-22T00:00:00Z","modified":"2025-11-03T19:29:49.75Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:34:21.404483Z"}],"euvd":[{"id":"EUVD-2024-31190","description":"An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request.","status":"published","published":"2025-04-22T00:00:00Z","modified":"2025-11-03T19:29:49Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T19:49:33.639996Z"}],"ghsa":[{"id":"GHSA-qm42-2jf7-gc6x","title":"An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct...","description":"An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request.","status":"published","published":"2025-04-22T18:32:11Z","modified":"2025-11-03T21:34:44Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:04:24.938946Z"}],"nvd":[{"id":"CVE-2024-33452","description":"An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request.","status":"published","published":"2025-04-22T16:15:44.2Z","modified":"2026-06-17T07:31:49.43Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:10:46.40251Z"}],"osv":[{"id":"CVE-2024-33452","description":"An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request.","status":"published","published":"2025-04-22T00:00:00Z","modified":"2026-10-28T02:31:02.589640996Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"DEBIAN-CVE-2024-33452","description":"An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request.","status":"published","published":"2025-04-22T16:15:44.2Z","modified":"2026-11-02T12:02:31.843504294Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"UBUNTU-CVE-2024-33452","description":"An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request.","status":"published","published":"2025-04-22T16:15:00Z","modified":"2026-10-17T12:56:36.382613259Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"BIT-openresty-2024-33452","description":"An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request.","status":"published","published":"2025-06-24T14:52:16.514Z","modified":"2026-09-08T08:48:24.536589064Z","updated_at":"2026-11-02T15:28:34.343258Z"},{"id":"DLA-4228-1","title":"nginx - security update","status":"published","published":"2025-06-24T00:00:00Z","modified":"2026-03-09T01:20:57.808777Z","updated_at":"2026-11-02T15:46:12.7027Z"}]}}