CVE-2013-2028: nginx chunked transfer-encoding parsing stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote unauthenticated code execution and DoS with public exploit tooling and very high EPSS, though the affected nginx versions are old and likely patched in most environments.

What it is

The ngx_http_parse_chunked function in nginx 1.3.9 through 1.4.0 mishandles a chunked Transfer-Encoding request with a large chunk size, triggering an integer signedness error and a stack-based buffer overflow. This allows a remote attacker to crash the worker process and potentially execute arbitrary code. The flaw is reachable over the network without authentication.

Impact

An unauthenticated remote attacker can cause a denial of service by crashing nginx, and the stack overflow may allow arbitrary code execution in the context of the nginx worker process.

Attack surface

Reached over the network via an HTTP request using chunked Transfer-Encoding with a crafted large chunk size; no authentication or user interaction is required per the AV:N/AC:L/Au:N vector.

Exploitation

Not listed in CISA KEV, but EPSS 30-day probability is 0.87475 (99.748th percentile) and references include an Exploit-tagged Packet Storm entry and a Metasploit framework pull request, indicating public exploit tooling exists.

What to do

• Upgrade nginx to a version outside the affected 1.3.9 through 1.4.0 range, applying the vendor patch referenced in the nginx advisory.
• If immediate upgrade is not possible, apply the vendor-supplied patch.2013.chunked.txt or the distribution backport for your package.
• Disable or restrict chunked Transfer-Encoding at the front-end proxy or load balancer where operationally feasible.
• Monitor nginx worker crashes and restart loops as an indicator of attempted exploitation.
• Review exposure of nginx instances running the affected versions and prioritize internet-facing deployments.

Detection

• Inspect HTTP request logs for chunked Transfer-Encoding requests with abnormally large chunk size values.
• Alert on nginx worker process crashes, core dumps, or unexpected restarts correlated with inbound HTTP traffic.
• Use network IDS signatures for the known nginx chunked parsing exploit pattern.
• Correlate Packet Storm or Metasploit exploit traffic patterns against nginx access logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.