Vulnerability · Published Feb 14, 2024 · Assigned by f5
CVE-2024-24989NGINX HTTP/3 QUIC vulnerability
High 7.5
In plain English
A high-severity null pointer dereference in NGINX Open Source from F5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html . NOTE: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | nginx | 1.26.0-1 | DEBIAN-CVE-2024-24989 |
| Debian:14 | nginx | 1.26.0-1 | DEBIAN-CVE-2024-24989 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| F5 | NGINX Plus | R31 – before R31 P1 |
| F5 | NGINX Open Source | 1.25.3 – before 1.25.4 |
Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H