TI-2018-06684 Aliases CVE-2018-9230 GHSA-fgf7-9g3w-445r

In OpenResty through 1.13.6.1, URI parameters are obtained using the ngx.req.get_uri_args…

MEDIUM 57CWE-89Published 2018-04-02 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

In OpenResty through 1.13.6.1, URI parameters are obtained using the ngx.req.get_uri_args and ngx.req.get_post_args functions that ignore parameters beyond the hundredth one, which might allow remote attackers to bypass intended access restrictions or interfere with certain Web Application Firewall (ngx_lua_waf or X-WAF) products. NOTE: the vendor has reported that 100 parameters is an intentional default setting, but is adjustable within the API. The vendor's position is that a security-relevant misuse of the API by a WAF product is a vulnerability in the WAF product, not a vulnerability in OpenResty

Why it matters now

EPSS 0.13237 96th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:openresty:openresty::::::::	before 1.13.6.1	Vulnerable	openresty

cpe:2.3:a:openresty:openresty:*:*:*:*:*:*:*:* Versions before 1.13.6.1 Vulnerable ·openresty

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2018-9230
2026-10-03 Alias added: GHSA-fgf7-9g3w-445r

References

Exploit 1

https://github.com/Bypass007/vuln/blob/master/OpenResty/Uri%20parameter%20overflow%20in%20Openresty.md

Advisory 1

https://openresty.org/en/changelog-1013006.html

TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2021-05876 A security issue in nginx resolver was identified, which might allow an attacker who is… CVSS 3.1HIGH 7.7
TI-2026-39910 OpenResty: Buffer overflow when writing PROXY protocol v2 header to upstream CVSS 3.1HIGH 7.5
TI-2020-09415 An issue was discovered in OpenResty before 1.15.8.4. CVSS 3.1HIGH 7.5
TI-2024-26625 In lj_str_hash.c in OpenResty 1.19.3.1 through 1.25.3.1, the string hashing function… CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences