critical CVSS 10 EPSS 87% Public exploit available

CVE-2009-3555·Nginx vulnerability

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.

Severity
critical
Software
Nginx
Fixed in
2.2.14-2
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 87% — in the top 0.2% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

Until: 2.2.14-2

Fixed in: 2.2.14-2

How to fix this CVE

Upgrade Nginx to version 2.2.14-2 or later to patch the TLS renegotiation vulnerability that allows attackers to inject plaintext data into encrypted sessions. This vulnerability affects the SSL/TLS handshake process and can lead to session hijacking or data tampering. Apply the update immediately across all affected systems and restart the Nginx service to activate the security patch.

sudo dnf update nginx

Defensia detects this vulnerability

How to check if you are affected

  1. Step 1: Check the installed Nginx version by running `nginx -v` or `sudo nginx -v` to identify if it is below 2.2.14-2.
  2. Step 2: Verify TLS/SSL configuration with `sudo nginx -T` to ensure renegotiation settings are properly configured post-patch.
  3. Step 3: Search Nginx access and error logs for suspicious renegotiation patterns using `grep -i 'renegotiat' /var/log/nginx/error.log` and look for unexpected client handshakes.
  4. Step 4: After upgrading, confirm the patch was applied by running `nginx -v` again and comparing against version 2.2.14-2 or later; then reload Nginx with `sudo systemctl reload nginx` and verify service status with `sudo systemctl status nginx`.

FAQ

What is CVE-2009-3555?

CVE-2009-3555 is a critical TLS/SSL renegotiation vulnerability that allows man-in-the-middle attackers to inject arbitrary plaintext data into encrypted HTTPS sessions by exploiting improper association between renegotiation handshakes and the original connection. This attack, also known as the 'plaintext injection' or 'Project Mogul' issue, can result in session hijacking, credential theft, or cache poisoning.

Is CVE-2009-3555 being actively exploited?

While CVE-2009-3555 is not currently listed in the CISA Known Exploited Vulnerabilities catalog, public exploits have been available since 2009, making it a significant historical risk. Organizations running outdated Nginx versions remain vulnerable to exploitation attempts.

What versions of Nginx are affected by CVE-2009-3555?

All Nginx versions prior to 2.2.14-2 are affected by this vulnerability. Although Nginx 1.x was the primary production version at the time, this vulnerability affects the underlying OpenSSL or GnuTLS libraries used in conjunction with Nginx versions that did not properly validate renegotiation handshakes.

How do I check if my server is vulnerable to CVE-2009-3555?

Run `nginx -v` to display the installed version and compare it against 2.2.14-2; if it is lower, your system is vulnerable. Additionally, check the OpenSSL version with `openssl version` and verify it is patched to 0.9.8l or later, as the vulnerability is tied to the underlying SSL/TLS library.

Does Defensia detect CVE-2009-3555?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Nginx is installed on a monitored server, CVE-2009-3555 will appear in your dashboard with remediation steps.

Related Nginx CVEs

CVE-2021-23017CVSS 9A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.
CVE-2023-44487CVSS 9The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2026-42946CVSS 9A vulnerability exists in the ngx_http_scgi_module and ngx_http_uwsgi_module modules that may result in excessive memory allocation or an over-read of data. When scgi_pass or uwsgi_pass is configured, an unauthenticated attacker with man-in-the-middle (MITM) ability to control responses from an upstream server may be able to read the memory of the NGINX worker process or restart it.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-60005CVSS 9NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart. Impact: This vulnerability may allow remote, unauthenticated attackers to have limited control to disclose memory contents or restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2026-49975CVSS 9Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2009-3555. Free for 1 server.

Get started free