CVE-2024-32760: NGINX HTTP/3 QUIC vulnerability
First published: Wed May 29 2024(Updated: )
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 encoder instructions can cause NGINX worker processes to terminate or cause or other potential impact.
Credit: f5sirt@f5.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nginx | =30 | 32 |
| Nginx | >=1.25.0<=1.26.0 | 1.27.01.26.1 |
| Nginx | >=1.25.0<1.26.1 | |
| Nginx | =r30 | |
| Nginx | =r30-p1 | |
| Nginx | =r30-p2 | |
| Nginx | =r31 | |
| Nginx | =r31-p1 | |
| Fedora | =39 | |
| Fedora | =40 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://my.f5.com/manage/s/article/K000139609
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7RPLWC35WHEUFCGKNFG62ESNID25TEZ/
- http://www.openwall.com/lists/oss-security/2024/05/30/4
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLAOKJWDALQZBIV3WKGPJ6T5Z56D3PRD/
Frequently Asked Questions
What is the severity of CVE-2024-32760?
The severity of CVE-2024-32760 is currently classified as high, due to potential worker process termination in affected systems.
How do I fix CVE-2024-32760?
To fix CVE-2024-32760, upgrade NGINX Plus to version r31 or r30-p2, or NGINX Open Source to version 1.27.0 or above.
What types of software are affected by CVE-2024-32760?
CVE-2024-32760 affects specific versions of NGINX Plus and NGINX Open Source configured with the HTTP/3 QUIC module.
What impact does CVE-2024-32760 have on NGINX deployments?
CVE-2024-32760 can lead to abrupt termination of NGINX worker processes, affecting service availability.
Is there a workaround for CVE-2024-32760?
While the best solution is to apply the updates, temporarily disabling the HTTP/3 QUIC module may serve as a workaround until the update can be applied.
- agent/first-publish-date
- agent/weakness
- agent/title
- agent/description
- agent/type
- agent/severity
- agent/author
- agent/event
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/trending
- agent/last-modified-date
- agent/tags
- agent/softwarecombine
- collector/f5-advisory
- source/F5
- alias/CVE-2024-32760
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- vendor/f5
- canonical/nginx
- version/nginx/30
- version/nginx/1.25.0
- version/nginx/1.26.0
- version/nginx/r30
- version/nginx/r30-p1
- version/nginx/r30-p2
- version/nginx/r31
- version/nginx/r31-p1
- vendor/fedoraproject
- canonical/fedora
- version/fedora/39
- version/fedora/40