CVE-2009-2629: nginx HTTP parser buffer underflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 2.0 rates it 7.5 HIGH with network reachability and no authentication, and EPSS is 0.75079 at the 99.48th percentile, though it is not in KEV and no exploit code is cited.

What it is

nginx versions 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 contain a buffer underflow in src/http/ngx_http_parse.c. A remote attacker can trigger it with crafted HTTP requests, and the flaw is classified as an out-of-bounds write (CWE-787) with a CVSS 2.0 base score of 7.5 (HIGH).

Impact

Successful exploitation allows arbitrary code execution in the context of the nginx worker process, giving the attacker a foothold on the web server. Confidentiality, integrity, and availability are all rated partially impacted by the CVSS vector.

Attack surface

The flaw is reached over the network through the HTTP request parser, so no authentication is required (AV:N/Au:N). No user interaction is indicated by the vector or description; any client able to send HTTP requests to the server can attempt it.

Exploitation

CVE-2009-2629 is not listed in CISA KEV and has no documented ransomware use, but EPSS is very high at 0.75079 (99.48th percentile), indicating strong predicted exploitation activity. References are vendor release notes, a Debian advisory, a CERT/CC vulnerability note, and Fedora package announcements; no public exploit code is cited in the record.

What to do

• Upgrade nginx to a fixed release: 0.5.38 or later, 0.6.39 or later, 0.7.62 or later, or 0.8.15 or later.
• Apply the vendor patch referenced by CERT/CC VU#180065 if an immediate upgrade is not possible.
• Update distribution packages per Debian DSA-1884 and the Fedora package announcements.
• If legacy nginx cannot be patched, restrict HTTP access to trusted clients and place it behind a filtering reverse proxy.
• Verify the running nginx version after remediation to confirm the fix is in place.

Detection

• Inspect nginx access and error logs for malformed or unusually long HTTP request lines that precede worker crashes or restarts.
• Monitor for nginx worker process crashes, core dumps, or unexpected restarts that could indicate parser memory corruption.
• Inventory nginx versions across hosts and flag any instance below the fixed release thresholds.
• Watch for post-exploitation behavior on web servers, such as unexpected child processes or outbound connections from the nginx worker.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.