Multiple High Severity Vulnerabilities in NGINX Could Lead to RCE and DoS
Multiple vulnerabilities in NGINX Open Source and NGINX Plus could allow remote attackers to cause memory corruption, execute arbitrary code, read sensitive data, or cause a denial of service condition.
Description
Multiple high severity vulnerabilities have been identified in NGINX Open Source and NGINX Plus. These vulnerabilities include heap-based buffer overflow, integer overflow, out-of-bounds read, NULL pointer dereference, incorrect authorization, and improper neutralization of CRLF sequences.
These vulnerabilities exist in certain NGINX modules and request processing components. In some cases, the vulnerable modules may be compiled into the NGINX binary but not actively enabled in the nginx configuration file. However, certain vulnerabilities such as buffer overflows and request parsing issues may still be triggered via specially crafted HTTP requests, which can lead to worker process crash, memory corruption, or denial of service.
If the vulnerable modules are enabled, successful exploitation may allow remote code execution, unauthorized access, or data manipulation. Internet-facing NGINX servers are at higher risk.
Users and organizations are strongly advised to update to the latest patched version of NGINX.