CVEvulnerability
CVE-2024-34161
5.3 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2024-05-29
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-416
Description
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Unit (MTU) of 4096 or greater without fragmentation, undisclosed QUIC packets can cause NGINX worker processes to leak previously freed memory.
Affected configurations
• f5 nginx open source (>= 1.25.0 < 1.26.1)
• f5 nginx plus r30
• f5 nginx plus r31
• fedoraproject fedora 39
• fedoraproject fedora 40
Related
Weakness · CWE (1)
- CWE-416 Use After Free weakness
References
- http://www.openwall.com/lists/oss-security/2024/05/30/4 Mailing List
- https://lists.fedoraproject.org/archives/list/[email protected]/message/MLAOKJWDALQZBIV3WKGPJ6T5Z56D3PRD/ Third Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]/message/R7RPLWC35WHEUFCGKNFG62ESNID25TEZ/ Third Party Advisory
- https://my.f5.com/manage/s/article/K000139627 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2024/05/30/4 Mailing List
- https://lists.fedoraproject.org/archives/list/[email protected]/message/MLAOKJWDALQZBIV3WKGPJ6T5Z56D3PRD/ Third Party Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]/message/R7RPLWC35WHEUFCGKNFG62ESNID25TEZ/ Third Party Advisory
- https://my.f5.com/manage/s/article/K000139627 Vendor Advisory