Description
The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a chunked Transfer-Encoding request with a large chunk size, which triggers an integer signedness error and a stack-based buffer overflow.
Remediation
References
Related Vulnerabilities
WordPress Plugin Advanced Custom Fields (ACF) Security Bypass (5.9.9)
WordPress Plugin MapSVG Lite Arbitrary File Upload (4.0.5)
Zope Web Application Server CVE-2011-2528 Vulnerability (CVE-2011-2528)
Werkzeug WSGI Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2024-49767)
WordPress Plugin HTML5 MP3 Player with Playlist Free Information Disclosure (2.6)