CVE-2018-9230
In OpenResty through 1.13.6.1, URI parameters are obtained using the ngx.req.get_uri_args and ngx.req.get_post_args functions that ignore parameters beyond the hundredth one, which might allow remote attackers to bypass intended access restrictions or…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 13.2%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
In OpenResty through 1.13.6.1, URI parameters are obtained using the ngx.req.get_uri_args and ngx.req.get_post_args functions that ignore parameters beyond the hundredth one, which might allow remote attackers to bypass intended access restrictions or interfere with certain Web Application Firewall (ngx_lua_waf or X-WAF) products. NOTE: the vendor has reported that 100 parameters is an intentional default setting, but is adjustable within the API. The vendor's position is that a security-relevant misuse of the API by a WAF product is a vulnerability in the WAF product, not a vulnerability in OpenResty
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 13.24% probability · 96th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- openresty/openresty
- Source
- cve@mitre.org
EPSS moved from 6.1% on 21 September 2026 to 13.2% on 27 October 2026. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”.
References
- https://github.com/Bypass007/vuln/blob/master/OpenResty/Uri%20parameter%20overflow%20in%20Openresty.mdExploit, Third Party Advisory
- https://openresty.org/en/changelog-1013006.htmlVendor Advisory
- https://github.com/Bypass007/vuln/blob/master/OpenResty/Uri%20parameter%20overflow%20in%20Openresty.mdExploit, Third Party Advisory
- https://openresty.org/en/changelog-1013006.htmlVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.