CVE-2009-3896
Summary
| CVE | CVE-2009-3896 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2009-11-24 17:30:00 UTC |
| Updated | 2026-04-23 00:35:47 UTC |
| Description | src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.14 allows remote attackers to cause a denial of service (NULL pointer dereference and worker process crash) via a long URI. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
NoneIntegrity
NoneAvailability
PartialAV:N/AC:L/Au:N/C:N/I:N/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | F5 | Nginx | 0.1.0 | All | All | All |
| Application | F5 | Nginx | 0.1.1 | All | All | All |
| Application | F5 | Nginx | 0.1.10 | All | All | All |
| Application | F5 | Nginx | 0.1.11 | All | All | All |
| Application | F5 | Nginx | 0.1.12 | All | All | All |
| Application | F5 | Nginx | 0.1.13 | All | All | All |
| Application | F5 | Nginx | 0.1.14 | All | All | All |
| Application | F5 | Nginx | 0.1.15 | All | All | All |
| Application | F5 | Nginx | 0.1.16 | All | All | All |
| Application | F5 | Nginx | 0.1.17 | All | All | All |
| Application | F5 | Nginx | 0.1.18 | All | All | All |
| Application | F5 | Nginx | 0.1.19 | All | All | All |
| Application | F5 | Nginx | 0.1.2 | All | All | All |
| Application | F5 | Nginx | 0.1.20 | All | All | All |
| Application | F5 | Nginx | 0.1.21 | All | All | All |
| Application | F5 | Nginx | 0.1.22 | All | All | All |
| Application | F5 | Nginx | 0.1.23 | All | All | All |
| Application | F5 | Nginx | 0.1.24 | All | All | All |
| Application | F5 | Nginx | 0.1.25 | All | All | All |
| Application | F5 | Nginx | 0.1.26 | All | All | All |
| Application | F5 | Nginx | 0.1.27 | All | All | All |
| Application | F5 | Nginx | 0.1.28 | All | All | All |
| Application | F5 | Nginx | 0.1.29 | All | All | All |
| Application | F5 | Nginx | 0.1.3 | All | All | All |
| Application | F5 | Nginx | 0.1.30 | All | All | All |
| Application | F5 | Nginx | 0.1.31 | All | All | All |
| Application | F5 | Nginx | 0.1.32 | All | All | All |
| Application | F5 | Nginx | 0.1.33 | All | All | All |
| Application | F5 | Nginx | 0.1.34 | All | All | All |
| Application | F5 | Nginx | 0.1.35 | All | All | All |
| Application | F5 | Nginx | 0.1.36 | All | All | All |
| Application | F5 | Nginx | 0.1.37 | All | All | All |
| Application | F5 | Nginx | 0.1.38 | All | All | All |
| Application | F5 | Nginx | 0.1.39 | All | All | All |
| Application | F5 | Nginx | 0.1.4 | All | All | All |
| Application | F5 | Nginx | 0.1.40 | All | All | All |
| Application | F5 | Nginx | 0.1.41 | All | All | All |
| Application | F5 | Nginx | 0.1.42 | All | All | All |
| Application | F5 | Nginx | 0.1.43 | All | All | All |
| Application | F5 | Nginx | 0.1.44 | All | All | All |
| Application | F5 | Nginx | 0.1.45 | All | All | All |
| Application | F5 | Nginx | 0.1.5 | All | All | All |
| Application | F5 | Nginx | 0.1.6 | All | All | All |
| Application | F5 | Nginx | 0.1.7 | All | All | All |
| Application | F5 | Nginx | 0.1.8 | All | All | All |
| Application | F5 | Nginx | 0.1.9 | All | All | All |
| Application | F5 | Nginx | 0.2.0 | All | All | All |
| Application | F5 | Nginx | 0.2.1 | All | All | All |
| Application | F5 | Nginx | 0.2.2 | All | All | All |
| Application | F5 | Nginx | 0.2.3 | All | All | All |
| Application | F5 | Nginx | 0.2.4 | All | All | All |
| Application | F5 | Nginx | 0.2.5 | All | All | All |
| Application | F5 | Nginx | 0.2.6 | All | All | All |
| Application | F5 | Nginx | 0.3.0 | All | All | All |
| Application | F5 | Nginx | 0.3.1 | All | All | All |
| Application | F5 | Nginx | 0.3.10 | All | All | All |
| Application | F5 | Nginx | 0.3.11 | All | All | All |
| Application | F5 | Nginx | 0.3.12 | All | All | All |
| Application | F5 | Nginx | 0.3.13 | All | All | All |
| Application | F5 | Nginx | 0.3.14 | All | All | All |
| Application | F5 | Nginx | 0.3.15 | All | All | All |
| Application | F5 | Nginx | 0.3.16 | All | All | All |
| Application | F5 | Nginx | 0.3.17 | All | All | All |
| Application | F5 | Nginx | 0.3.18 | All | All | All |
| Application | F5 | Nginx | 0.3.19 | All | All | All |
| Application | F5 | Nginx | 0.3.2 | All | All | All |
| Application | F5 | Nginx | 0.3.20 | All | All | All |
| Application | F5 | Nginx | 0.3.21 | All | All | All |
| Application | F5 | Nginx | 0.3.22 | All | All | All |
| Application | F5 | Nginx | 0.3.23 | All | All | All |
| Application | F5 | Nginx | 0.3.24 | All | All | All |
| Application | F5 | Nginx | 0.3.25 | All | All | All |
| Application | F5 | Nginx | 0.3.26 | All | All | All |
| Application | F5 | Nginx | 0.3.27 | All | All | All |
| Application | F5 | Nginx | 0.3.28 | All | All | All |
| Application | F5 | Nginx | 0.3.29 | All | All | All |
| Application | F5 | Nginx | 0.3.3 | All | All | All |
| Application | F5 | Nginx | 0.3.30 | All | All | All |
| Application | F5 | Nginx | 0.3.31 | All | All | All |
| Application | F5 | Nginx | 0.3.32 | All | All | All |
| Application | F5 | Nginx | 0.3.33 | All | All | All |
| Application | F5 | Nginx | 0.3.34 | All | All | All |
| Application | F5 | Nginx | 0.3.35 | All | All | All |
| Application | F5 | Nginx | 0.3.36 | All | All | All |
| Application | F5 | Nginx | 0.3.37 | All | All | All |
| Application | F5 | Nginx | 0.3.38 | All | All | All |
| Application | F5 | Nginx | 0.3.39 | All | All | All |
| Application | F5 | Nginx | 0.3.4 | All | All | All |
| Application | F5 | Nginx | 0.3.40 | All | All | All |
| Application | F5 | Nginx | 0.3.41 | All | All | All |
| Application | F5 | Nginx | 0.3.42 | All | All | All |
| Application | F5 | Nginx | 0.3.43 | All | All | All |
| Application | F5 | Nginx | 0.3.44 | All | All | All |
| Application | F5 | Nginx | 0.3.45 | All | All | All |
| Application | F5 | Nginx | 0.3.46 | All | All | All |
| Application | F5 | Nginx | 0.3.47 | All | All | All |
| Application | F5 | Nginx | 0.3.48 | All | All | All |
| Application | F5 | Nginx | 0.3.49 | All | All | All |
| Application | F5 | Nginx | 0.3.5 | All | All | All |
| Application | F5 | Nginx | 0.3.50 | All | All | All |
| Application | F5 | Nginx | 0.3.51 | All | All | All |
| Application | F5 | Nginx | 0.3.52 | All | All | All |
| Application | F5 | Nginx | 0.3.53 | All | All | All |
| Application | F5 | Nginx | 0.3.54 | All | All | All |
| Application | F5 | Nginx | 0.3.55 | All | All | All |
| Application | F5 | Nginx | 0.3.56 | All | All | All |
| Application | F5 | Nginx | 0.3.57 | All | All | All |
| Application | F5 | Nginx | 0.3.58 | All | All | All |
| Application | F5 | Nginx | 0.3.59 | All | All | All |
| Application | F5 | Nginx | 0.3.6 | All | All | All |
| Application | F5 | Nginx | 0.3.60 | All | All | All |
| Application | F5 | Nginx | 0.3.61 | All | All | All |
| Application | F5 | Nginx | 0.3.7 | All | All | All |
| Application | F5 | Nginx | 0.3.8 | All | All | All |
| Application | F5 | Nginx | 0.3.9 | All | All | All |
| Application | F5 | Nginx | 0.4.0 | All | All | All |
| Application | F5 | Nginx | 0.4.1 | All | All | All |
| Application | F5 | Nginx | 0.4.10 | All | All | All |
| Application | F5 | Nginx | 0.4.11 | All | All | All |
| Application | F5 | Nginx | 0.4.12 | All | All | All |
| Application | F5 | Nginx | 0.4.13 | All | All | All |
| Application | F5 | Nginx | 0.4.2 | All | All | All |
| Application | F5 | Nginx | 0.4.3 | All | All | All |
| Application | F5 | Nginx | 0.4.4 | All | All | All |
| Application | F5 | Nginx | 0.4.5 | All | All | All |
| Application | F5 | Nginx | 0.4.6 | All | All | All |
| Application | F5 | Nginx | 0.4.7 | All | All | All |
| Application | F5 | Nginx | 0.4.8 | All | All | All |
| Application | F5 | Nginx | 0.4.9 | All | All | All |
| Application | F5 | Nginx | 0.5.0 | All | All | All |
| Application | F5 | Nginx | 0.5.1 | All | All | All |
| Application | F5 | Nginx | 0.5.10 | All | All | All |
| Application | F5 | Nginx | 0.5.11 | All | All | All |
| Application | F5 | Nginx | 0.5.12 | All | All | All |
| Application | F5 | Nginx | 0.5.13 | All | All | All |
| Application | F5 | Nginx | 0.5.14 | All | All | All |
| Application | F5 | Nginx | 0.5.15 | All | All | All |
| Application | F5 | Nginx | 0.5.16 | All | All | All |
| Application | F5 | Nginx | 0.5.17 | All | All | All |
| Application | F5 | Nginx | 0.5.18 | All | All | All |
| Application | F5 | Nginx | 0.5.19 | All | All | All |
| Application | F5 | Nginx | 0.5.2 | All | All | All |
| Application | F5 | Nginx | 0.5.20 | All | All | All |
| Application | F5 | Nginx | 0.5.21 | All | All | All |
| Application | F5 | Nginx | 0.5.22 | All | All | All |
| Application | F5 | Nginx | 0.5.23 | All | All | All |
| Application | F5 | Nginx | 0.5.24 | All | All | All |
| Application | F5 | Nginx | 0.5.25 | All | All | All |
| Application | F5 | Nginx | 0.5.26 | All | All | All |
| Application | F5 | Nginx | 0.5.27 | All | All | All |
| Application | F5 | Nginx | 0.5.28 | All | All | All |
| Application | F5 | Nginx | 0.5.29 | All | All | All |
| Application | F5 | Nginx | 0.5.3 | All | All | All |
| Application | F5 | Nginx | 0.5.30 | All | All | All |
| Application | F5 | Nginx | 0.5.31 | All | All | All |
| Application | F5 | Nginx | 0.5.32 | All | All | All |
| Application | F5 | Nginx | 0.5.33 | All | All | All |
| Application | F5 | Nginx | 0.5.34 | All | All | All |
| Application | F5 | Nginx | 0.5.35 | All | All | All |
| Application | F5 | Nginx | 0.5.36 | All | All | All |
| Application | F5 | Nginx | 0.5.37 | All | All | All |
| Application | F5 | Nginx | 0.5.4 | All | All | All |
| Application | F5 | Nginx | 0.5.5 | All | All | All |
| Application | F5 | Nginx | 0.5.6 | All | All | All |
| Application | F5 | Nginx | 0.5.7 | All | All | All |
| Application | F5 | Nginx | 0.5.8 | All | All | All |
| Application | F5 | Nginx | 0.5.9 | All | All | All |
| Application | F5 | Nginx | 0.6.0 | All | All | All |
| Application | F5 | Nginx | 0.6.1 | All | All | All |
| Application | F5 | Nginx | 0.6.10 | All | All | All |
| Application | F5 | Nginx | 0.6.11 | All | All | All |
| Application | F5 | Nginx | 0.6.12 | All | All | All |
| Application | F5 | Nginx | 0.6.13 | All | All | All |
| Application | F5 | Nginx | 0.6.14 | All | All | All |
| Application | F5 | Nginx | 0.6.15 | All | All | All |
| Application | F5 | Nginx | 0.6.17 | All | All | All |
| Application | F5 | Nginx | 0.6.18 | All | All | All |
| Application | F5 | Nginx | 0.6.19 | All | All | All |
| Application | F5 | Nginx | 0.6.2 | All | All | All |
| Application | F5 | Nginx | 0.6.20 | All | All | All |
| Application | F5 | Nginx | 0.6.21 | All | All | All |
| Application | F5 | Nginx | 0.6.22 | All | All | All |
| Application | F5 | Nginx | 0.6.23 | All | All | All |
| Application | F5 | Nginx | 0.6.24 | All | All | All |
| Application | F5 | Nginx | 0.6.25 | All | All | All |
| Application | F5 | Nginx | 0.6.26 | All | All | All |
| Application | F5 | Nginx | 0.6.27 | All | All | All |
| Application | F5 | Nginx | 0.6.28 | All | All | All |
| Application | F5 | Nginx | 0.6.29 | All | All | All |
| Application | F5 | Nginx | 0.6.3 | All | All | All |
| Application | F5 | Nginx | 0.6.30 | All | All | All |
| Application | F5 | Nginx | 0.6.31 | All | All | All |
| Application | F5 | Nginx | 0.6.32 | All | All | All |
| Application | F5 | Nginx | 0.6.33 | All | All | All |
| Application | F5 | Nginx | 0.6.34 | All | All | All |
| Application | F5 | Nginx | 0.6.35 | All | All | All |
| Application | F5 | Nginx | 0.6.36 | All | All | All |
| Application | F5 | Nginx | 0.6.37 | All | All | All |
| Application | F5 | Nginx | 0.6.38 | All | All | All |
| Application | F5 | Nginx | 0.6.4 | All | All | All |
| Application | F5 | Nginx | 0.6.5 | All | All | All |
| Application | F5 | Nginx | 0.6.6 | All | All | All |
| Application | F5 | Nginx | 0.6.7 | All | All | All |
| Application | F5 | Nginx | 0.6.8 | All | All | All |
| Application | F5 | Nginx | 0.6.9 | All | All | All |
| Application | F5 | Nginx | 0.7.0 | All | All | All |
| Application | F5 | Nginx | 0.7.1 | All | All | All |
| Application | F5 | Nginx | 0.7.10 | All | All | All |
| Application | F5 | Nginx | 0.7.11 | All | All | All |
| Application | F5 | Nginx | 0.7.12 | All | All | All |
| Application | F5 | Nginx | 0.7.13 | All | All | All |
| Application | F5 | Nginx | 0.7.14 | All | All | All |
| Application | F5 | Nginx | 0.7.15 | All | All | All |
| Application | F5 | Nginx | 0.7.16 | All | All | All |
| Application | F5 | Nginx | 0.7.17 | All | All | All |
| Application | F5 | Nginx | 0.7.18 | All | All | All |
| Application | F5 | Nginx | 0.7.19 | All | All | All |
| Application | F5 | Nginx | 0.7.2 | All | All | All |
| Application | F5 | Nginx | 0.7.20 | All | All | All |
| Application | F5 | Nginx | 0.7.21 | All | All | All |
| Application | F5 | Nginx | 0.7.22 | All | All | All |
| Application | F5 | Nginx | 0.7.23 | All | All | All |
| Application | F5 | Nginx | 0.7.24 | All | All | All |
| Application | F5 | Nginx | 0.7.25 | All | All | All |
| Application | F5 | Nginx | 0.7.26 | All | All | All |
| Application | F5 | Nginx | 0.7.27 | All | All | All |
| Application | F5 | Nginx | 0.7.28 | All | All | All |
| Application | F5 | Nginx | 0.7.29 | All | All | All |
| Application | F5 | Nginx | 0.7.3 | All | All | All |
| Application | F5 | Nginx | 0.7.30 | All | All | All |
| Application | F5 | Nginx | 0.7.31 | All | All | All |
| Application | F5 | Nginx | 0.7.32 | All | All | All |
| Application | F5 | Nginx | 0.7.33 | All | All | All |
| Application | F5 | Nginx | 0.7.34 | All | All | All |
| Application | F5 | Nginx | 0.7.35 | All | All | All |
| Application | F5 | Nginx | 0.7.36 | All | All | All |
| Application | F5 | Nginx | 0.7.37 | All | All | All |
| Application | F5 | Nginx | 0.7.38 | All | All | All |
| Application | F5 | Nginx | 0.7.39 | All | All | All |
| Application | F5 | Nginx | 0.7.4 | All | All | All |
| Application | F5 | Nginx | 0.7.40 | All | All | All |
| Application | F5 | Nginx | 0.7.41 | All | All | All |
| Application | F5 | Nginx | 0.7.42 | All | All | All |
| Application | F5 | Nginx | 0.7.43 | All | All | All |
| Application | F5 | Nginx | 0.7.44 | All | All | All |
| Application | F5 | Nginx | 0.7.45 | All | All | All |
| Application | F5 | Nginx | 0.7.46 | All | All | All |
| Application | F5 | Nginx | 0.7.47 | All | All | All |
| Application | F5 | Nginx | 0.7.48 | All | All | All |
| Application | F5 | Nginx | 0.7.49 | All | All | All |
| Application | F5 | Nginx | 0.7.5 | All | All | All |
| Application | F5 | Nginx | 0.7.50 | All | All | All |
| Application | F5 | Nginx | 0.7.51 | All | All | All |
| Application | F5 | Nginx | 0.7.52 | All | All | All |
| Application | F5 | Nginx | 0.7.53 | All | All | All |
| Application | F5 | Nginx | 0.7.54 | All | All | All |
| Application | F5 | Nginx | 0.7.55 | All | All | All |
| Application | F5 | Nginx | 0.7.56 | All | All | All |
| Application | F5 | Nginx | 0.7.57 | All | All | All |
| Application | F5 | Nginx | 0.7.58 | All | All | All |
| Application | F5 | Nginx | 0.7.59 | All | All | All |
| Application | F5 | Nginx | 0.7.6 | All | All | All |
| Application | F5 | Nginx | 0.7.60 | All | All | All |
| Application | F5 | Nginx | 0.7.61 | All | All | All |
| Application | F5 | Nginx | 0.7.7 | All | All | All |
| Application | F5 | Nginx | 0.7.8 | All | All | All |
| Application | F5 | Nginx | 0.7.9 | All | All | All |
| Application | F5 | Nginx | 0.8.0 | All | All | All |
| Application | F5 | Nginx | 0.8.1 | All | All | All |
| Application | F5 | Nginx | 0.8.10 | All | All | All |
| Application | F5 | Nginx | 0.8.11 | All | All | All |
| Application | F5 | Nginx | 0.8.12 | All | All | All |
| Application | F5 | Nginx | 0.8.13 | All | All | All |
| Application | F5 | Nginx | 0.8.14 | All | All | All |
| Application | F5 | Nginx | 0.8.2 | All | All | All |
| Application | F5 | Nginx | 0.8.3 | All | All | All |
| Application | F5 | Nginx | 0.8.4 | All | All | All |
| Application | F5 | Nginx | 0.8.5 | All | All | All |
| Application | F5 | Nginx | 0.8.6 | All | All | All |
| Application | F5 | Nginx | 0.8.7 | All | All | All |
| Application | F5 | Nginx | 0.8.8 | All | All | All |
| Application | F5 | Nginx | 0.8.9 | All | All | All |
| Application | Nginx | Nginx | 0.6.1516 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Bug 539565 – CVE-2009-3896 nginx NULL pointer dereference | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Patch |
| 'Re: null pointer dereference vulnerability in 0.1.0-0.8.13.' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| Debian -- Security Information -- DSA-1920-1 nginx | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| [SECURITY] Fedora 12 Update: nginx-0.7.64-1.fc12 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| nginx 'ngx_http_process_request_headers()' Remote Buffer Overflow Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Exploit, Patch |
| #552035 - there is null pointer dereference in nginx in debian etch/lenny - Debian Bug report logs | af854a3a-2127-422b-91ae-364da2661108 | bugs.debian.org | Exploit |
| oss-security - CVE Assignment nginx | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | Patch |
| [SECURITY] Fedora 10 Update: nginx-0.7.64-1.fc10 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| 404 Not Found | af854a3a-2127-422b-91ae-364da2661108 | security.debian.org | |
| oss-security - Re: CVEs for nginx | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | Patch |
| [SECURITY] Fedora 11 Update: nginx-0.7.64-1.fc11 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| Gentoo Linux Documentation -- nginx: Multiple vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | |
| sysoev.ru/nginx/patch.null.pointer.txt | af854a3a-2127-422b-91ae-364da2661108 | sysoev.ru | Patch |
| About Secunia Research | Flexera | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| oss-security - CVEs for nginx | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | Patch |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.