p PatchFirst

CVE-2024-24989

CVE-2024-24989 · NGINX HTTP/3 QUIC vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html . NOTE: Software versions which have reached End of Technical Support (EoTS) are not evaluated

CVSS 7.5 · High · EPSS 1.1% · Fix available

Published
Updated

Stack: system · web

Affected products and versions

  • nginx plus

    Versions
    • ≥ R31, < R31 P1: Affected (custom)

    No fix published

  • nginx

    Versions
    • ≥ 1.25.3, < 1.25.4: Affected (semver)

    Update to 1.25.4

  • nginx Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.26.0-1

    Update to 1.26.0-1

  • nginx Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.26.0-1

    Update to 1.26.0-1

Original sources

Check your server →