dbcve.org
NginxWeb server / proxy · F5

CVE-2012-1180

MEDIUM · 5.0 CVSS v2.0 Published 2012-04-17
Fix available
A fix is available. Upgrade to 1.0.14 / 1.1.17 or later.
See remediation →
59/100
Remediation priority · Elevated
Remotely reachable No privileges Zero-click Patch available

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Use-after-free vulnerability in nginx before 1.0.14 and 1.1.x before 1.1.17 allows remote HTTP servers to obtain sensitive information from process memory via a crafted backend response, in conjunction with a client request.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis
How this class of weakness works · CWE-416

Memory is used after it has been freed, so its contents — now potentially attacker-controlled — drive the program's behaviour. With careful heap grooming this becomes code execution. The fix requires disciplined ownership of memory and often a targeted rework of the object lifecycle.

General guidance for the use after free class — the official description and references above are authoritative for this specific CVE. Want a bespoke review and a reviewed fix? Ask our team →

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
NginxWeb server / proxy
Affected:>= 0.1.0, < 1.0.14>= 1.1.0, < 1.1.17
FedoraOperating system
Affected:= 15= 16= 17
Debian LinuxOperating system
Affected:= 6.0

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None

AV:N/AC:L/Au:N/C:P/I:N/A:N

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Upgrade available Upgrade to 1.0.14 / 1.1.17 or later
Fixed in 1.0.141.1.17
Vendor patch nginx.org →
We can perform the upgrade in your staging environment and verify nothing breaks — typical engagement from $2,850. Get the upgrade done

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2012-1180 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2012-1180 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data