CVE-2016-0746

Critical

Published: 15/02/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

A use-after-free vulnerability in the resolver in nginx versions 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other impact via a crafted DNS response related to CNAME response processing.

Risk Assessment

Organizations may experience service interruptions due to worker process crashes, potentially leading to loss of availability for applications relying on nginx.

Recommendation

It is recommended to upgrade nginx to version 1.9.10 or later to mitigate this vulnerability.

Original NVD description (English source)

Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other impact via a crafted DNS response related to CNAME response processing.