# Is nginx vulnerable to the Hash Table Vulnerability (n.runs AG)? **URL:** \ **Category:** NGINX\ **Created:** [December 31, 2011, 7:38pm UTC](https://www.ruby-forum.com/t/is-nginx-vulnerable-to-the-hash-table-vulnerability-n-runs-ag/215347 "2011-12-31T19:38:34Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\ **Post date:** [December 31, 2011, 7:38pm UTC](https://www.ruby-forum.com/t/is-nginx-vulnerable-to-the-hash-table-vulnerability-n-runs-ag/215347/1 "2011-12-31T19:38:34Z")
> **[Hash Table Vulnerability Enables Wide-Scale DDoS Attacks](https://www.securityweek.com/hash-table-collision-attacks-could-trigger-ddos-massive-scale/)** > > Hash Table Vulnerability: Several vendors are currently working to resolve a hash collision vulnerability, which if exploited can trigger a denial-of-service condition on multiple platforms. Without going through the way nginx parses an incoming request, I’m unsure if nginx isn’t vulnerable to this, because of the availability to grab the value of a GET parameter via [http://wiki.nginx.org/HttpCoreModule#.24arg\_PARAMETER](http://wiki.nginx.org/HttpCoreModule#.24arg_PARAMETER). My hope is that especially if an $arg\_PARAMETER isn’t used in the config, it is not vulnerable because it wouldn’t even attempt to parse the parameters, but I can’t be sure. Can anyone speak to this? ---
**Author:** ![jhernandez](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e68b1a/32.png) [@jhernandez](https://www.ruby-forum.com/u/jhernandez)\ **Post date:** [January 1, 2012, 1:35am UTC](https://www.ruby-forum.com/t/is-nginx-vulnerable-to-the-hash-table-vulnerability-n-runs-ag/215347/2 "2012-01-01T01:35:29Z")
Hello! On Sat, Dec 31, 2011 at 11:37:39AM -0700, Justin H. wrote: > Can anyone speak to this? > It’s not vulnerable even if $arg\_\* is used. Maxim D. ---
**Author:** ![jhernandez](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e68b1a/32.png) [@jhernandez](https://www.ruby-forum.com/u/jhernandez)\ **Post date:** [January 1, 2012, 6:59am UTC](https://www.ruby-forum.com/t/is-nginx-vulnerable-to-the-hash-table-vulnerability-n-runs-ag/215347/3 "2012-01-01T06:59:48Z")
Thank you for the confirmation - I read through the parts of code in question but wanted to get a second opinion. How about the lua and/or the perl modules? It looks as if they are using the nginx functions? Sent from my iPhone ---
**Author:** ![jhernandez](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e68b1a/32.png) [@jhernandez](https://www.ruby-forum.com/u/jhernandez)\ **Post date:** [January 1, 2012, 3:21pm UTC](https://www.ruby-forum.com/t/is-nginx-vulnerable-to-the-hash-table-vulnerability-n-runs-ag/215347/4 "2012-01-01T15:21:40Z")
On Sun, Jan 1, 2012 at 1:58 PM, Justin H. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Thank you for the confirmation - I read through the parts of code in > question but wanted to get a second opinion. > > How about the lua and/or the perl modules? It looks as if they are > using the nginx functions? The current released versions of ngx\_lua does have this vulnerability in its ngx.req.get\_uri\_args() and ngx.req.get\_post\_args() functions. I’ve already worked out a patch for these two functions in ngx\_lua’s git max-args branch here: ``` https://github.com/chaoslawful/lua-nginx-module/commit/75876 ``` With this patch, both of these functions will only parse 100 query args at most. And one can specify a custom maximum number of args parsed with an optional function argument (default to 100) and enforcing unlimited parsing by specifying a zero number. This patch (as well as this branch) will be merged into the master branch in 3 Jan. Best, -agentzh ---
**Author:** ![jhernandez](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e68b1a/32.png) [@jhernandez](https://www.ruby-forum.com/u/jhernandez)\ **Post date:** [January 1, 2012, 3:32pm UTC](https://www.ruby-forum.com/t/is-nginx-vulnerable-to-the-hash-table-vulnerability-n-runs-ag/215347/5 "2012-01-01T15:32:09Z")
On 1 January 2012 17:20, agentzh [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > I’ve already worked out a patch for these two functions in ngx\_lua’s > branch in 3 Jan. > It would probably be a good idea at that point, to finally make a > release of v0.3.1 of the ngx\_lua module as with about 45 “Release > Candidates”, it must already hold some record 🙂 ---
**Author:** ![jhernandez](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e68b1a/32.png) [@jhernandez](https://www.ruby-forum.com/u/jhernandez)\ **Post date:** [January 1, 2012, 6:54am UTC](https://www.ruby-forum.com/t/is-nginx-vulnerable-to-the-hash-table-vulnerability-n-runs-ag/215347/6 "2012-01-01T06:54:52Z")
On Sun, Jan 1, 2012 at 2:37 AM, Justin H. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > **[Hash Table Vulnerability Enables Wide-Scale DDoS Attacks](https://www.securityweek.com/hash-table-collision-attacks-could-trigger-ddos-massive-scale/)** > > Hash Table Vulnerability: Several vendors are currently working to resolve a hash collision vulnerability, which if exploited can trigger a denial-of-service condition on multiple platforms. > Without going through the way nginx parses an incoming request, I’m unsure > if nginx isn’t vulnerable to this, because of the availability to grab the > value of a GET parameter > viahttp://wiki.nginx.org/HttpCoreModule#.24arg\_PARAMETER. My hope is that > especially if an $arg\_PARAMETER isn’t used in the config, it is not > vulnerable because it wouldn’t even attempt to parse the parameters, but I > can’t be sure. Well, the $arg\_PARAMETER variable is not implemented with hash tables at all 😉 It scans the URI query string at every invocation 🙂 Regards, -agentzh ---
**Author:** ![jhernandez](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e68b1a/32.png) [@jhernandez](https://www.ruby-forum.com/u/jhernandez)\ **Post date:** [January 1, 2012, 7:38pm UTC](https://www.ruby-forum.com/t/is-nginx-vulnerable-to-the-hash-table-vulnerability-n-runs-ag/215347/7 "2012-01-01T19:38:35Z")
On Sun, Jan 01, 2012 at 05:31:46PM +0300, Nginx U. wrote: > > I’ve already worked out a patch for these two functions in ngx\_lua’s > > branch in 3 Jan. > > It would probably be a good idea at that point, to finally make a > release of v0.3.1 of the ngx\_lua module as with about 45 “Release > Candidates”, it must already hold some record 🙂 +1. – Sergey A. Osokin [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![jhernandez](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e68b1a/32.png) [@jhernandez](https://www.ruby-forum.com/u/jhernandez)\ **Post date:** [January 4, 2012, 12:49pm UTC](https://www.ruby-forum.com/t/is-nginx-vulnerable-to-the-hash-table-vulnerability-n-runs-ag/215347/8 "2012-01-04T12:49:23Z")
On Sun, Jan 1, 2012 at 10:20 PM, agentzh [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > enforcing unlimited parsing by specifying a zero number. > > This patch (as well as this branch) will be merged into the master > branch in 3 Jan. I’ve also added similar protections to ngx.req.get\_headers(): ``` http://wiki.nginx.org/HttpLuaModule#ngx.req.get_headers ``` All of these changes have been released as ngx\_lua 0.3.1rc45: [Tags · openresty/lua-nginx-module · GitHub](https://github.com/chaoslawful/lua-nginx-module/tags) and also included in the ngx\_openresty bundle’s devel version 1.0.10.39: [OpenResty® - High-Concurrency Web Platform Built on Nginx + LuaJIT](http://openresty.org/#Download) Feedback welcome! Best, -agentzh ---
**Author:** ![jhernandez](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/e68b1a/32.png) [@jhernandez](https://www.ruby-forum.com/u/jhernandez)\ **Post date:** [January 4, 2012, 9:02pm UTC](https://www.ruby-forum.com/t/is-nginx-vulnerable-to-the-hash-table-vulnerability-n-runs-ag/215347/9 "2012-01-04T21:02:23Z")
On 4 January 2012 14:48, agentzh [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > I’ve also added similar protections to ngx.req.get\_headers(): > > [GitHub - nginxinc/nginx-wiki: ARCHIVED -- Source for the now archived NGINX Wiki section of https://www.nginx.com · GitHub](http://wiki.nginx.org/HttpLuaModule#ngx.req.get_headers) > > All of these changes have been released as ngx\_lua 0.3.1rc45: > Nice one. Thanks.