CVE-2024-31079: NGINX HTTP/3 QUIC vulnerability
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate or cause other potential impact. This attack requires that a request be specifically timed during the connection draining process, which the attacker has no visibility and limited influence over.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NGINXto a version that resolves this vulnerability.Fixed in 32 - Upgrade
Upgrade
Nginxto a version that resolves this vulnerability.Fixed in 1.27.01.26.1 - Upgrade
Upgrade
debian/nginxto a version that resolves this vulnerability.Fixed in 1.26.0-2 - Upgrade
Upgrade
debian/nginxto a version that resolves this vulnerability.Fixed in 1.22.1-9+deb12u9Fixed in 1.22.1-9+deb12u10Fixed in 1.26.3-3+deb13u7Fixed in 1.26.3-3+deb13u10Fixed in 1.30.6-2
Event History
Frequently Asked Questions
What is the severity of CVE-2024-31079?
CVE-2024-31079 has not yet been assigned a specific severity rating, but it can lead to unexpected worker process termination in NGINX configurations using HTTP/3.
How do I fix CVE-2024-31079?
To mitigate CVE-2024-31079, you should update to the latest patched version of NGINX Plus or NGINX Open Source as recommended by F5.
Which versions of NGINX are affected by CVE-2024-31079?
CVE-2024-31079 affects NGINX Plus versions 30 and 31, and NGINX Open Source versions between 1.25.0 and 1.26.0.
What type of attack does CVE-2024-31079 involve?
CVE-2024-31079 can be exploited through specifically timed HTTP/3 requests during the connection draining process.
Can CVE-2024-31079 impact my system's availability?
Yes, CVE-2024-31079 can impact system availability by causing NGINX worker processes to terminate unexpectedly.