CVE-2016-0742

The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response.

• CWE-476

• http://lists.opensuse.org/opensuse-updates/2016-02/msg00042.htmlMailing List, Third Party Advisory
• http://mailman.nginx.org/pipermail/nginx/2016-January/049700.htmlVendor Advisory
• http://seclists.org/fulldisclosure/2021/Sep/36Mailing List, Third Party Advisory
• http://www.debian.org/security/2016/dsa-3473Third Party Advisory
• http://www.securitytracker.com/id/1034869Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-2892-1Third Party Advisory
• https://access.redhat.com/errata/RHSA-2016:1425Third Party Advisory
• https://bto.bluecoat.com/security-advisory/sa115Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1302587Issue Tracking, Patch, Third Party Advisory
• https://security.gentoo.org/glsa/201606-06Third Party Advisory
• https://support.apple.com/kb/HT212818Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2016-02/msg00042.htmlMailing List, Third Party Advisory
• http://mailman.nginx.org/pipermail/nginx/2016-January/049700.htmlVendor Advisory
• http://seclists.org/fulldisclosure/2021/Sep/36Mailing List, Third Party Advisory
• http://www.debian.org/security/2016/dsa-3473Third Party Advisory
• http://www.securitytracker.com/id/1034869Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-2892-1Third Party Advisory
• https://access.redhat.com/errata/RHSA-2016:1425Third Party Advisory
• https://bto.bluecoat.com/security-advisory/sa115Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1302587Issue Tracking, Patch, Third Party Advisory
• https://security.gentoo.org/glsa/201606-06Third Party Advisory
• https://support.apple.com/kb/HT212818Third Party Advisory

Published

Feb 15, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-0736In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_…
• CVE-2016-0737OpenStack Object Storage (Swift) before 2.4.0 does not prope…
• CVE-2016-0738OpenStack Object Storage (Swift) before 2.3.1 (Kilo), 2.4.x,…
• CVE-2016-0739libssh before 0.7.3 improperly truncates ephemeral secrets g…
• CVE-2016-0740Buffer overflow in the ImagingLibTiffDecode function in libI…
• CVE-2016-0741slapd/connection.c in 389 Directory Server (formerly Fedora …
• CVE-2016-0743Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-0744Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-0745Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-0746Use-after-free vulnerability in the resolver in nginx 0.6.18…9.8
• CVE-2016-0747The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 d…5.3
• CVE-2016-0749The smartcard interaction in SPICE allows remote attackers t…