CVE-2024-31079: NGINX HTTP/3 QUIC vulnerability
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate or cause other potential impact. This attack requires that a request be specifically timed during the connection draining process, which the attacker has no visibility and limited influence over.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-31079?
CVE-2024-31079 has not yet been assigned a specific severity rating, but it can lead to unexpected worker process termination in NGINX configurations using HTTP/3.
How do I fix CVE-2024-31079?
To mitigate CVE-2024-31079, you should update to the latest patched version of NGINX Plus or NGINX Open Source as recommended by F5.
Which versions of NGINX are affected by CVE-2024-31079?
CVE-2024-31079 affects NGINX Plus versions 30 and 31, and NGINX Open Source versions between 1.25.0 and 1.26.0.
What type of attack does CVE-2024-31079 involve?
CVE-2024-31079 can be exploited through specifically timed HTTP/3 requests during the connection draining process.
Can CVE-2024-31079 impact my system's availability?
Yes, CVE-2024-31079 can impact system availability by causing NGINX worker processes to terminate unexpectedly.