InfraGuard
로그인 지금 사용해보기 바로구매

nginx 취약점 (CVE 목록)

nginx는 수신 웹 트래픽을 관리하고 프로토콜을 프록시하기 위해 설계되어 널리 배포된 오픈 소스 웹 서버 및 네트워크 프록시 애플리케이션입니다.

41 CVE1 KEV9.8 최고 CVSS

취약점 이력이 말해 주는 것

이 소프트웨어는 최대 CVSS 점수 9.8에 도달하는 총 41개의 CVE 이력이 있으며, 그 중 1개의 취약점이 KEV 데이터베이스에 등재되어 있습니다. 관련된 가장 최근 CVE는 2025-02-05에 게시되었습니다.

안전하게 운영하려면

운영자는 배포된 버전을 모니터링하고 지원이 종료된 브랜치를 피하면서 1.30 또는 1.31과 같이 지원되는 릴리스 라인으로 업그레이드해야 합니다.

설치된 버전 확인nginx -v

영향받는 버전 라인

알려진 취약점

CVE 제목 영향 버전 CVSS 악용 EPSS 공개일
CVE-2023-44487 The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can... ≥ 1.9.5 ≤ 1.25.2 7.5 KEV 100.0% 2023-10-10
CVE-2025-23419 TLS Session Resumption Vulnerability ≥ 1.11.4 < 1.26.3 ≥ 1.27.0 < 1.27.4 5.3 2.7% 2025-02-06
CVE-2022-41742 NGINX ngx_http_mp4_module vulnerability CVE-2022-41742 ≥ 1.1.3 ≤ 1.22.0 ≥ r22 ≤ r27 = 1.23.0 7.1 1.2% 2022-10-20
CVE-2022-41741 NGINX ngx_http_mp4_module vulnerability CVE-2022-41741 ≥ 1.1.3 ≤ 1.22.0 ≥ r22 ≤ r27 = 1.23.0 7.0 0.8% 2022-10-20
CVE-2021-3618 ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing differen... < 1.21.0 7.4 2.0% 2022-03-23
CVE-2017-20005 NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a... < 1.13.6 * 9.8 3.3% 2021-06-07
CVE-2021-23017 A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP pack... ≥ 0.6.18 < 1.20.1 7.7 53.5% 2021-06-01
CVE-2019-20372 NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by... < 1.17.7 * 5.3 15.0% 2020-01-10
CVE-2011-4968 nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the... = 0.7.61 = 0.7.62 = 0.7.64 4.8 4.0% 2019-11-20
CVE-2019-9511 Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation,... ≥ 1.9.5 < 1.16.1 ≥ 1.17.0 ≤ 1.17.2 7.5 59.5% 2019-08-14
CVE-2019-9513 Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service ≥ 1.9.5 < 1.16.1 ≥ 1.17.0 ≤ 1.17.2 7.5 81.6% 2019-08-14
CVE-2019-9516 Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service ≥ 1.9.5 < 1.16.1 ≥ 1.17.0 ≤ 1.17.2 7.5 57.5% 2019-08-14
CVE-2018-16843 nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for... > 1.9.5 < 1.14.1 > 1.15.0 < 1.15.6 5.3 48.0% 2018-11-07
CVE-2018-16844 nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for... ≥ 1.9.5 < 1.14.1 ≥ 1.15.0 < 1.15.6 5.3 12.7% 2018-11-07
CVE-2018-16845 nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an atta... ≥ 1.0.7 ≤ 1.0.15 ≥ 1.1.3 ≤ 1.15.5 8.2 9.8% 2018-11-07
CVE-2017-7529 Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in ngin... ≥ 0.5.6 ≤ 1.12.1 ≥ 1.13.0 ≤ 1.13.2 = 0.5.6 - 1.13.2 7.5 62.6% 2017-07-13
CVE-2016-1247 The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu... ≤ 1.10.1 ≤ 1.10.0 ≤ 1.6.2 7.8 4.9% 2016-11-30
CVE-2016-4450 os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial... ≥ 1.3.9 < 1.10.1 = 1.11.0 7.5 16.4% 2016-06-07
CVE-2016-0742 The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of servic... ≥ 0.6.18 < 1.8.1 ≥ 1.9.0 < 1.9.10 7.5 82.4% 2016-02-16
CVE-2016-0746 Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remo... ≥ 0.6.18 ≤ 1.8.0 ≥ 1.9.0 < 1.9.10 9.8 8.9% 2016-02-16
CVE-2016-0747 The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which all... ≥ 0.6.18 < 1.8.1 ≥ 1.9.0 < 1.9.10 5.3 8.7% 2016-02-16
CVE-2014-3556 The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before... ≥ 1.5.6 < 1.6.1 ≥ 1.7.0 < 1.7.4 6.8 7.8% 2014-12-30
CVE-2014-3616 nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple... ≥ 0.5.6 < 1.6.2 ≥ 1.7.0 < 1.7.5 4.3 5.7% 2014-12-08
CVE-2014-0088 The SPDY implementation in the ngx_http_spdy_module module in nginx 1.5.10 before 1.5.11, when running on a 32... = 1.5.10 7.5 8.9% 2014-04-29
CVE-2014-0133 Heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 all... ≥ 1.3.15 < 1.4.7 ≥ 1.5.0 ≤ 1.5.11 7.5 9.5% 2014-03-29
CVE-2013-4547 nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via... ≥ 0.8.41 < 1.4.4 ≥ 1.5.0 ≤ 1.5.6 7.5 68.5% 2013-11-24
CVE-2013-0337 The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) a... ≤ 1.3.13 = 1.0.0 = 1.0.1 7.5 2.2% 2013-10-27
CVE-2013-2028 The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attack... ≥ 1.3.9 ≤ 1.4.0 7.5 87.5% 2013-07-18
CVE-2013-2070 http/modules/ngx_http_proxy_module.c in nginx 1.1.4 through 1.2.8 and 1.3.0 through 1.4.0, when proxy_pass is... ≥ 1.1.4 ≤ 1.2.8 ≥ 1.3.9 ≤ 1.4.0 5.8 11.9% 2013-07-18
CVE-2011-4963 nginx/Windows 1.3.x before 1.3.1 and 1.2.x before 1.2.1 allows remote attackers to bypass intended access rest... ≥ 0.7.52 < 1.2.1 = 1.3.0 5.0 6.0% 2012-07-27
CVE-2012-1180 Use-after-free vulnerability in nginx before 1.0.14 and 1.1.x before 1.1.17 allows remote HTTP servers to obta... ≥ 0.1.0 < 1.0.14 ≥ 1.1.0 < 1.1.17 5.0 10.6% 2012-04-18
CVE-2012-2089 Buffer overflow in ngx_http_mp4_module.c in the ngx_http_mp4_module module in nginx 1.0.7 through 1.0.14 and 1... ≥ 1.0.7 ≤ 1.0.14 ≥ 1.1.3 ≤ 1.1.18 6.8 9.8% 2012-04-18
CVE-2011-4315 Heap-based buffer overflow in compression-pointer processing in core/ngx_resolver.c in nginx before 1.0.10 all... ≥ 0.6.18 < 1.0.10 ≥ 1.1.0 ≤ 1.1.7 6.8 6.0% 2011-12-09
CVE-2010-4180 OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does... < 0.9.2 4.3 9.5% 2010-12-06
CVE-2010-2263 nginx 0.8 before 0.8.40 and 0.7 before 0.7.66, when running on Windows, allows remote attackers to obtain sour... ≥ 0.7.52 < 0.7.66 ≥ 0.8.0 ≤ 0.8.39 5.0 71.9% 2010-06-15
CVE-2010-2266 nginx 0.8.36 allows remote attackers to cause a denial of service (crash) via certain encoded directory traver... ≥ 0.7.52 < 0.7.67 ≥ 0.8.0 ≤ 0.8.40 5.0 21.5% 2010-06-15
CVE-2009-4487 nginx 0.7.64 writes data to a log file without sanitizing non-printable characters, which might allow remote a... = 0.7.64 6.8 26.8% 2010-01-14
CVE-2009-3896 src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through 0.4.14, 0.5.x before 0.5.38, 0.6.x before 0.6.... = 0.1.0 = 0.1.1 = 0.1.2 5.0 10.2% 2009-11-25
공식 웹사이트 소스 코드 SolutionMarket 소개 페이지

내 서버의 버전을 직접 추적하세요

InfraGuard 는 모든 서버에 설치된 소프트웨어 버전을 수집하고, 알려진 취약점이 있는 버전을 알려 줍니다. 자체 호스팅이라 데이터가 내 네트워크를 벗어나지 않습니다.

라이브 데모 써 보기 바로구매

주간 악용 취약점 다이제스트

셀프호스팅 서버에 중요한 KEV 추가분을 일주일에 한 번 보내드립니다. 다른 메일은 보내지 않습니다.

데이터: CVE List(CVE® Program), NVD, CISA KEV, FIRST EPSS(EPSS 는 https://www.first.org/epss 참고), endoflife.date. 소프트웨어 목록: awesome-selfhosted(CC BY-SA 3.0).