onyx

onyx --cves cve-2021-23017

CVE-2021-23017

HIGHPOCnginx
score
<0.1
cvss
7.7
epss
53.5%
published
2021-06-01
kev added
—
first seen

nginx resolver contains a 1-byte memory overwrite caused by forged UDP packets from DNS server, letting attackers cause worker process crash or other impacts, exploit requires attacker to forge UDP packets from DNS server.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2021-06-01 — PublishedP2026-10-21 — Tracked by OnyxT2026-10-21 — Public PoC: http://packetstormsecurity.com/files/167720/Nginx-1.20.0-Denial-Of-Service.htmlXscore2026-10-21: score <0.1<0.1epss2026-09-22: epss 53.5%2026-09-23: epss 53.5%2026-09-24: epss 53.5%2026-09-25: epss 53.5%2026-09-26: epss 53.5%2026-09-27: epss 53.5%2026-09-28: epss 53.5%2026-09-29: epss 53.5%2026-09-30: epss 53.5%2026-10-01: epss 53.5%2026-10-02: epss 53.5%2026-10-03: epss 53.5%2026-10-04: epss 53.5%2026-10-05: epss 53.5%2026-10-06: epss 53.5%2026-10-07: epss 53.5%2026-10-08: epss 53.5%2026-10-09: epss 53.5%2026-10-10: epss 53.5%2026-10-11: epss 53.5%2026-10-12: epss 53.5%2026-10-13: epss 53.5%2026-10-14: epss 53.5%2026-10-15: epss 53.5%2026-10-16: epss 53.5%2026-10-18: epss 53.5%2026-10-19: epss 53.5%2026-10-20: epss 53.5%2026-10-21: epss 53.5%53.5%mentions/day0no mentions in 30 days2026-09-22today
  1. Published
  2. Tracked by Onyx
  3. Public PoC http://packetstormsecurity.com/files/167720/Nginx-1.20.0-Denial-Of-Service.html

Exploit availability

Weaknesses

CWE-193

References 14