CVE-2013-2028

The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a chunked Transfer-Encoding request with a large chunk size, which triggers an integer signedness error and a stack-based buffer overflow.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

87.48% chance of exploitation in the next 30 days, 100th percentile

Published

2013-07-18

Updated

2024-08-06

Proof-of-concept exploits (7)

• http://packetstormsecurity.com/files/121675/Nginx-1.3.9-1.4.0-Denial-Of-Service.html
• BJ-PXD/Explotacion-de-Vulnerabiliddes-bee-box0★ · 2024-08-28
• Sunqiz/CVE-2013-2028-reproduction0★ · 2022-08-15
• jptr218/nginxhack1★ · 2021-07-27
• m4drat/CVE-2013-2028-Exploit19★ · 2020-06-27
• mertsarica/hack4career85★ · 2025-08-31
• tachibana51/CVE-2013-2028-x64-bypass-ssp-and-pie-PoC3★ · 2019-08-03

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/nginx_chunked_size.rb

ExploitDB entries (4)

• https://www.exploit-db.com/exploits/25775
• https://www.exploit-db.com/exploits/32277
• https://www.exploit-db.com/exploits/26737
• https://www.exploit-db.com/exploits/25499

References

• CVE Record
• NVD entry

Related

• CVE-2017-7494
• CVE-2010-2553
• CVE-2010-3333
• CVE-2011-0104
• CVE-2012-0158
• CVE-2017-0199