Vulnerability · Published Feb 14, 2024 · Assigned by f5
CVE-2024-24990NGINX HTTP/3 QUIC vulnerability
High 7.5
In plain English
A high-severity use-after-free in NGINX Open Source from F5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | nginx | 1.26.0-1 | DEBIAN-CVE-2024-24990 |
| Debian:14 | nginx | 1.26.0-1 | DEBIAN-CVE-2024-24990 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| F5 | NGINX Plus | R31 – before R31 P1R30 – before R30 P2 |
| F5 | NGINX Open Source | 1.25.0 – before 1.25.4 |
Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H