CVE-2017-7529
HighNginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.
Published Jul 13, 2017 · Updated Aug 4, 2026 · Also known as ALPINE-CVE-2017-7529, DEBIAN-CVE-2017-7529, DLA-1024-1, DSA-3908-1, SUSE-SU-2017:2387-1, UBUNTU-CVE-2017-7529, USN-3352-1
Key Facts
Patch immediately- CVE-2017-7529 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Xcode (Apple), Nginx (F5), Puppet Enterprise and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 63% probability of exploitation in the next 30 days.
- Fixed versions are available, including Xcode 13.0, Nginx 1.12.1, Nginx 1:1.12.1-1.32.amzn1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS (30-day exploit likelihood)
63%
Higher than 99.1% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2017-7529 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.
Affected Products
89 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| XcodeApple | See advisory | 13.0 |
| NginxF5 | >= 0.5.6 - 1.13.2 | 1.12.1 |
| Puppet EnterprisePuppet | See advisory | 2016.4.7 |
| nginx-mainlinearch | See advisory | 1.13.3-1 |
| rootio-nginxrootio | See advisory | 1.13.3-1 |
Patched Releases
Xcode
13.0
Nginx
1.12.1, 1:1.12.1-1.32.amzn1, 1:1.17.7-2.el7, 1.10.3-0ubuntu0.16.04.2, 1.10.3-1+deb9u1, 1.10.3-r0, 1.10.3-r1, 1.11.13-4.ph1, 1.12.1-1, 1.12.1-r0, 1.13.3-1, 1.13.5-1.ph2, 1.13.9-12.1, 1.13.9-2.3.1, 1.2.1-2.2+wheezy4+deb7u1, 1.21.3-1.4, 1.4.6-1ubuntu3.8, 1.6.2-5+deb8u5, 1.8.1-10.5.1
nginx-1.0
1.0.15-0.35.3.1
nginx-all-modules
1:1.12.1-1.32.amzn1, 1:1.17.7-2.el7
nginx-filesystem
1:1.17.7-2.el7
nginx-mainline
1.13.3-1
nginx-mod-http-geoip
1:1.12.1-1.32.amzn1
nginx-mod-http-image-filter
1:1.12.1-1.32.amzn1, 1:1.17.7-2.el7
nginx-mod-http-perl
1:1.12.1-1.32.amzn1, 1:1.17.7-2.el7
nginx-mod-http-xslt-filter
1:1.12.1-1.32.amzn1, 1:1.17.7-2.el7
nginx-mod-mail
1:1.12.1-1.32.amzn1, 1:1.17.7-2.el7
nginx-mod-stream
1:1.12.1-1.32.amzn1, 1:1.17.7-2.el7
nginx-source
1.21.3-1.4
olcne-agent
1.0.8-2.el7, 1.1.6-1.el7
olcne-api-server
1.0.8-2.el7, 1.1.6-1.el7
olcne-istio-chart
1.1.6-1.el7
olcne-nginx
1.0.8-2.el7, 1.1.6-1.el7
olcne-prometheus-chart
1.1.6-1.el7
olcne-utils
1.0.8-2.el7, 1.1.6-1.el7
olcnectl
1.0.8-2.el7, 1.1.6-1.el7
Puppet Enterprise
2016.4.7
rh-nginx110-nginx
1:1.10.2-8.el6, 1:1.10.2-8.el7
rootio-nginx
1.13.3-1
ruby2.7-rubygem-passenger
6.0.8-3.2
ruby3.0-rubygem-passenger
6.0.8-3.2
Timeline
Publicly disclosed
Jul 13, 2017
Last updated
Aug 4, 2026
Weakness Type
- CWE-190 Integer Overflow or Wraparound
References
- advisory[nginx-announce] 20170711 nginx security advisory (CVE-2017-7529)
- advisoryhttp://nginx.org/download/patch.2017.ranges.txt
- advisoryRHSA-2017:2538
- advisoryhttps://bugzilla.suse.com/1048265
- advisory20210921 APPLE-SA-2021-09-20-4 Xcode 13
FAQ
Common Questions.
Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.
Affected: Xcode (Apple); Nginx (F5) versions >= 0.5.6 - 1.13.2; Puppet Enterprise, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Xcode 13.0, Nginx 1.12.1, Nginx 1:1.12.1-1.32.amzn1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2017-7529 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo