CVE-2021-23017: nginx resolver off-by-one allows 1-byte memory overwrite via forged DNS response

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityHigh CVSS (7.7) and very high EPSS percentile (98.9) indicate significant risk, though exploitation requires DNS spoofing capability and the flaw is not in CISA KEV.

What it is

The nginx resolver contains an off-by-one error (CWE-193) that lets an attacker who can forge UDP packets from the configured DNS server trigger a 1-byte memory overwrite. This can crash the worker process and may have other impacts. The flaw is remotely reachable but requires the ability to spoof DNS responses, which raises the attack complexity.

Impact

An attacker can crash nginx worker processes, causing denial of service, and the 1-byte overwrite may enable further memory corruption. The CVSS vector rates confidentiality and integrity impact as high, though the description only confirms crash and 'potential other impact'.

Attack surface

Reached over the network through the DNS resolver path when nginx is configured to resolve names; no authentication or user interaction is required. The attacker must be positioned to forge UDP packets from the DNS server, which is reflected in the high attack complexity rating.

Exploitation

CVE-2021-23017 is not listed in CISA KEV, but EPSS shows a 30-day probability of 0.53461 (98.9th percentile), indicating high predicted exploitation activity. References include a vendor patch advisory and a Packet Storm denial-of-service writeup, but no public exploit code is confirmed in the record.

What to do

• Upgrade nginx to a version containing the resolver fix as directed by the vendor advisory (mailman.nginx.org/pipermail/nginx-announce/2021/000300.html).
• Apply vendor patches for downstream products (F5, OpenResty, Fedora, NetApp, Oracle) that bundle the affected nginx resolver.
• Restrict or disable DNS resolution in nginx configurations that do not require it, reducing exposure to forged DNS responses.
• Where possible, use DNS over TCP or trusted resolver paths that are harder to spoof than plain UDP.
• Monitor for unexpected nginx worker crashes and investigate resolver-related failures.

Detection

• Monitor nginx error logs for worker process crashes or resolver-related errors that may indicate exploitation attempts.
• Watch for anomalous DNS response traffic to nginx hosts, especially spoofed or unexpected UDP packets from DNS servers.
• Use host-based crash monitoring to detect repeated nginx worker terminations.
• Correlate nginx version inventory against the vendor advisory to identify unpatched instances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.