$ cve CVE-2013-2028 JSON

CVE-2013-2028 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 87.5% (pctl 100)

Patch early

A public exploit exists.

Description

The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a chunked Transfer-Encoding request with a large chunk size, which triggers an integer signedness error and a stack-based buffer overflow.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	87.48% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-787
On CISA KEV	no
Public exploit	yes
Published	2013-07-20
Last modified	2026-06-16

Affected (2)

Vendor	Product
f5	nginx
fedoraproject	fedora

Public exploits

Source	Title	Date
exploit-db	Nginx 1.4.0 (Generic Linux x64) - Remote Overflow	2014-03-15
exploit-db	Nginx 1.3.9/1.4.0 (x86) - Brute Force	2013-07-11
exploit-db	Nginx 1.3.9 < 1.4.0 - Chuncked Encoding Stack Buffer Overflow (Metasploit)	2013-05-28
exploit-db	Nginx 1.3.9 < 1.4.0 - Denial of Service (PoC)	2013-05-17

References

→ the Explorer · watch your stack · NVD