CVE-2017-7529: Nginx range filter integer overflow leaks memory contents

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote, unauthenticated information disclosure with a high EPSS score and broad deployment of affected nginx versions, though no confirmed in-the-wild exploitation is recorded.

What it is

Nginx versions from 0.5.6 through 1.13.2 contain an integer overflow in the range filter module. A specially crafted request triggers the overflow and causes a leak of potentially sensitive information from server memory. The flaw is remotely reachable without credentials, making it relevant to any internet-facing nginx deployment in the affected range.

Impact

An attacker gains read access to portions of nginx process memory, which may expose sensitive data such as cached content, credentials or other request data. There is no integrity or availability impact; the loss is confidentiality only.

Attack surface

Reached over the network via HTTP requests handled by the nginx range filter, with no authentication and no user interaction required per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any client able to send requests to the affected server can attempt it.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is high at roughly 0.63 probability (99th percentile), indicating elevated likelihood of attempted exploitation. References are vendor advisories and third-party entries; none are tagged as exploit code.

What to do

• Upgrade nginx to a version later than 1.13.2 that contains the range filter fix, or apply the vendor patch for your distribution.
• If immediate upgrade is not possible, disable or restrict the range filter behavior for untrusted clients at the reverse proxy or WAF layer.
• Apply the relevant vendor errata for bundled nginx components, such as Red Hat RHSA-2017:2538, Puppet Enterprise and Apple Xcode.
• Inventory all nginx instances and embedded copies (appliances, containers, bundled products) to confirm which remain in the 0.5.6 to 1.13.2 range.
• Limit exposure of nginx management and origin services to trusted networks where feasible.

Detection

• Monitor for anomalous HTTP requests containing malformed or overlapping Range headers targeting static or cached resources.
• Inspect nginx error and access logs for unusual 206 Partial Content responses or range-related errors from single clients.
• Watch for repeated range requests from one source that deviate from normal client behavior, which may indicate probing.
• Track nginx version banners and asset inventory to flag hosts still running versions in the affected range.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.