CVE-2019-20372

5.3 mediumEPSS 15%

NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 15% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
CWE: CWE-444
Published: 2020-01-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apple:xcode
canonical:ubuntu_linux
f5:nginx
netapp:cloud_backup
opensuse:leap

References

http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00013.html
http://nginx.org/en/CHANGES
http://seclists.org/fulldisclosure/2021/Sep/36
https://bertjwregeer.keybase.pub/2019-12-10%20-%20error_page%20request%20smuggling.pdf
https://duo.com/docs/dng-notes#version-1.5.4-january-2020

Check your stack JSON