p PatchFirst

CVE-2024-31079

CVE-2024-31079 · NGINX HTTP/3 QUIC vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate or cause other potential impact. This attack requires that a request be specifically timed during the connection draining process, which the attacker has no visibility and limited influence over.

CVSS 4.8 · Medium · EPSS 0.9% · Fix available

Published
Updated

Stack: system · web

Affected products and versions

  • nginx

    Versions
    • ≥ 1.25.0, < 1.26.1: Affected (semver)

    Update to 1.26.1

  • nginx plus

    Versions
    • ≥ R30, < R32: Affected (custom)

    Update to R32

  • nginx Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.26.0-2

    Update to 1.26.0-2

  • nginx Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.26.0-2

    Update to 1.26.0-2

Original sources

Check your server →