CVE-2016-0747

The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution.

• CWE-400

• http://lists.opensuse.org/opensuse-updates/2016-02/msg00042.htmlMailing List, Third Party Advisory
• http://mailman.nginx.org/pipermail/nginx/2016-January/049700.htmlVendor Advisory
• http://seclists.org/fulldisclosure/2021/Sep/36Mailing List, Third Party Advisory
• http://www.debian.org/security/2016/dsa-3473Third Party Advisory
• http://www.securitytracker.com/id/1034869Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-2892-1Third Party Advisory
• https://access.redhat.com/errata/RHSA-2016:1425Third Party Advisory
• https://bto.bluecoat.com/security-advisory/sa115Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1302589Issue Tracking, Patch, Third Party Advisory
• https://security.gentoo.org/glsa/201606-06Third Party Advisory
• https://support.apple.com/kb/HT212818Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2016-02/msg00042.htmlMailing List, Third Party Advisory
• http://mailman.nginx.org/pipermail/nginx/2016-January/049700.htmlVendor Advisory
• http://seclists.org/fulldisclosure/2021/Sep/36Mailing List, Third Party Advisory
• http://www.debian.org/security/2016/dsa-3473Third Party Advisory
• http://www.securitytracker.com/id/1034869Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-2892-1Third Party Advisory
• https://access.redhat.com/errata/RHSA-2016:1425Third Party Advisory
• https://bto.bluecoat.com/security-advisory/sa115Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1302589Issue Tracking, Patch, Third Party Advisory
• https://security.gentoo.org/glsa/201606-06Third Party Advisory
• https://support.apple.com/kb/HT212818Third Party Advisory

Published

Feb 15, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-0741slapd/connection.c in 389 Directory Server (formerly Fedora …
• CVE-2016-0742The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 a…7.5
• CVE-2016-0743Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-0744Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-0745Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-0746Use-after-free vulnerability in the resolver in nginx 0.6.18…9.8
• CVE-2016-0749The smartcard interaction in SPICE allows remote attackers t…
• CVE-2016-0750The hotrod java client in infinispan before 9.1.0.Final auto…4.2
• CVE-2016-0751actionpack/lib/action_dispatch/http/mime_type.rb in Action P…
• CVE-2016-0752Directory traversal vulnerability in Action View in Ruby on …7.5
• CVE-2016-0753Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x b…5.3
• CVE-2016-0754cURL before 7.47.0 on Windows allows attackers to write to a…