CVE-2009-2629

CVE-2009-2629 describes a buffer underflow vulnerability in nginx versions 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15, allowing remote attackers to execute arbitrary code via crafted HTTP requests. This vulnerability carries a CVSS score of 7.5, indicating high severity due to its network-based attack vector, low attack complexity, and potential for partial confidentiality, integrity, and availability impacts. While not listed in CISA's KEV catalog, an ExploitDB entry for heap corruption in Nginx 0.6.38 exists, suggesting proof-of-concept exploit code is publicly available, though there is no evidence of active exploitation or significant community discussion.