CVE-2024-24990: NGINX HTTP/3 QUIC vulnerability
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NGINXto a version that resolves this vulnerability.Fixed in 31 - Upgrade
Upgrade
Nginxto a version that resolves this vulnerability.Fixed in 1.25.4 - Configuration
Do not configure NGINX to use the experimental HTTP/3 QUIC module (it is not enabled by default). Disable/remove the HTTP/3 QUIC configuration so the HTTP/3 QUIC module is not used.
NGINX HTTP/3 QUIC module HTTP/3 QUIC module enabled = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2024-24990?
CVE-2024-24990 is classified as a vulnerability that can lead to the termination of NGINX worker processes.
How do I fix CVE-2024-24990?
To mitigate CVE-2024-24990, ensure the HTTP/3 QUIC module is disabled in your NGINX configuration.
Which versions are affected by CVE-2024-24990?
CVE-2024-24990 affects NGINX Plus versions 30 and 31, and NGINX Open Source versions from 1.25.0 to 1.25.3.
Is HTTP/3 QUIC enabled by default in NGINX?
No, the HTTP/3 QUIC module is not enabled by default in NGINX and is considered experimental.
What could cause NGINX worker processes to terminate in CVE-2024-24990?
Undisclosed requests within the HTTP/3 QUIC module configuration can lead to the termination of NGINX worker processes.