Skip to content
OpenAdvisories
Medium · 5.3 CVE-2024-34161 EUVD-2024-34667

NGINX HTTP/3 QUIC vulnerability

Published May 29, 2024 · Updated Feb 13, 2025 · Assigned by f5

Vendor: F5 Product: NGINX Open Source Product: NGINX Plus Package: nginx Package: nginx-mainline Package: nginx-mainline-config Package: nginx-mainline-config-compat Package: nginx-mainline-mod-http_geoip Package: nginx-mainline-mod-http_image_filter Package: nginx-mainline-mod-http_perl Package: nginx-mainline-mod-http_xslt_filter Package: nginx-mainline-mod-mail Package: nginx-mainline-mod-stream Package: nginx-mainline-mod-stream_geoip Package: nginx-mainline-openrc Package: nginx-mainline-package-config Package: nginx-mainline-src Package: nginx-mainline-syslog-config Package: nginx-stable Category: Network devices Ecosystem: Debian Ecosystem: Wolfi

Description

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Unit (MTU) of 4096 or greater without fragmentation, undisclosed QUIC packets can cause NGINX worker processes to leak previously freed memory.

Affected products

VendorProductAffectedFixed
F5 NGINX Open Source 1.25.0 – < 1.26.1 1.26.1
F5 NGINX Plus R30 – < R32 R32

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 nginx 1.26.0-2 —
Debian 13 nginx 1.26.0-2 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling nginx-mainline +13 1.27.0-r0 —
Wolfi rolling nginx-stable 1.26.1-r0 —

Advisories 2

References