CVE-2016-0747

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-02-15 · updated 2026-06-17
Weakness: CWE-400

Description

The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution.

Affected products

Apple Xcode: before 13.0 — fixed in 13.0
Canonical Ubuntu Linux: 14.04, 15.10
Debian Linux: 7.0, 8.0, 9.0
nginx: from 0.6.18 before 1.8.1; from 1.9.0 before 1.9.10 — fixed in 1.8.1, 1.9.10
openSUSE Leap: 42.1

How to fix

Upgrade to a fixed version: Apple Xcode 13.0; nginx 1.8.1, 1.9.10. Check the vendor advisory for mitigations.

References

http://lists.opensuse.org/opensuse-updates/2016-02/msg00042.html
http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html
http://seclists.org/fulldisclosure/2021/Sep/36
http://www.debian.org/security/2016/dsa-3473
http://www.securitytracker.com/id/1034869
http://www.ubuntu.com/usn/USN-2892-1
https://access.redhat.com/errata/RHSA-2016:1425
https://bto.bluecoat.com/security-advisory/sa115
https://bugzilla.redhat.com/show_bug.cgi?id=1302589
https://security.gentoo.org/glsa/201606-06
https://support.apple.com/kb/HT212818
http://lists.opensuse.org/opensuse-updates/2016-02/msg00042.html

Get alerted when CVE-2016-0747 or the next vulnerability affects your stack