Unrated severityNVD Advisory· Published May 29, 2024· Updated Feb 13, 2025
NGINX HTTP/3 QUIC vulnerability
CVE-2024-34161
Description
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Unit (MTU) of 4096 or greater without fragmentation, undisclosed QUIC packets can cause NGINX worker processes to leak previously freed memory.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
76(expand)+ 1 more
- (no CPE)
- (no CPE)range: R30
- osv-coords73 versionspkg:apk/chainguard/ingress-nginx-controllerpkg:apk/chainguard/ingress-nginx-controller-1.9pkg:apk/chainguard/ingress-nginx-controller-compatpkg:apk/chainguard/ingress-nginx-controller-compat-1.9pkg:apk/chainguard/ingress-nginx-controller-compat-fips-1.9pkg:apk/chainguard/ingress-nginx-controller-fipspkg:apk/chainguard/ingress-nginx-controller-fips-1.9pkg:apk/chainguard/ingress-nginx-controller-fips-compatpkg:apk/chainguard/kube-webhook-certgenpkg:apk/chainguard/kube-webhook-certgen-1.9pkg:apk/chainguard/kube-webhook-certgen-fipspkg:apk/chainguard/kube-webhook-certgen-fips-1.9pkg:apk/chainguard/nginx-bitnami-compatpkg:apk/chainguard/nginx-mainlinepkg:apk/chainguard/nginx-mainline-configpkg:apk/chainguard/nginx-mainline-config-compatpkg:apk/chainguard/nginx-mainline-mod-http_geoippkg:apk/chainguard/nginx-mainline-mod-http_image_filterpkg:apk/chainguard/nginx-mainline-mod-http_perlpkg:apk/chainguard/nginx-mainline-mod-http_xslt_filterpkg:apk/chainguard/nginx-mainline-mod-mailpkg:apk/chainguard/nginx-mainline-mod-streampkg:apk/chainguard/nginx-mainline-mod-stream_geoippkg:apk/chainguard/nginx-mainline-openrcpkg:apk/chainguard/nginx-mainline-package-configpkg:apk/chainguard/nginx-mainline-srcpkg:apk/chainguard/nginx-mainline-syslog-configpkg:apk/chainguard/nginx-stablepkg:apk/chainguard/nginx-stable-configpkg:apk/chainguard/nginx-stable-config-compatpkg:apk/chainguard/nginx-stable-mod-http_geoippkg:apk/chainguard/nginx-stable-mod-http_image_filterpkg:apk/chainguard/nginx-stable-mod-http_perlpkg:apk/chainguard/nginx-stable-mod-http_xslt_filterpkg:apk/chainguard/nginx-stable-mod-mailpkg:apk/chainguard/nginx-stable-mod-streampkg:apk/chainguard/nginx-stable-mod-stream_geoippkg:apk/chainguard/nginx-stable-package-configpkg:apk/chainguard/nginx-stable-srcpkg:apk/chainguard/nginx-stable-syslog-configpkg:apk/wolfi/ingress-nginx-controllerpkg:apk/wolfi/ingress-nginx-controller-compatpkg:apk/wolfi/kube-webhook-certgenpkg:apk/wolfi/nginx-bitnami-compatpkg:apk/wolfi/nginx-mainlinepkg:apk/wolfi/nginx-mainline-configpkg:apk/wolfi/nginx-mainline-config-compatpkg:apk/wolfi/nginx-mainline-mod-http_geoippkg:apk/wolfi/nginx-mainline-mod-http_image_filterpkg:apk/wolfi/nginx-mainline-mod-http_perlpkg:apk/wolfi/nginx-mainline-mod-http_xslt_filterpkg:apk/wolfi/nginx-mainline-mod-mailpkg:apk/wolfi/nginx-mainline-mod-streampkg:apk/wolfi/nginx-mainline-mod-stream_geoippkg:apk/wolfi/nginx-mainline-openrcpkg:apk/wolfi/nginx-mainline-package-configpkg:apk/wolfi/nginx-mainline-srcpkg:apk/wolfi/nginx-mainline-syslog-configpkg:apk/wolfi/nginx-stablepkg:apk/wolfi/nginx-stable-configpkg:apk/wolfi/nginx-stable-config-compatpkg:apk/wolfi/nginx-stable-mod-http_geoippkg:apk/wolfi/nginx-stable-mod-http_image_filterpkg:apk/wolfi/nginx-stable-mod-http_perlpkg:apk/wolfi/nginx-stable-mod-http_xslt_filterpkg:apk/wolfi/nginx-stable-mod-mailpkg:apk/wolfi/nginx-stable-mod-streampkg:apk/wolfi/nginx-stable-mod-stream_geoippkg:apk/wolfi/nginx-stable-package-configpkg:apk/wolfi/nginx-stable-srcpkg:apk/wolfi/nginx-stable-syslog-configpkg:bitnami/nginxpkg:bitnami/nginx-gateway
< 1.10.1-r4+ 72 more
- (no CPE)range: < 1.10.1-r4
- (no CPE)range: < 1.9.6-r4
- (no CPE)range: < 1.9.6-r4
- (no CPE)range: < 1.9.6-r4
- (no CPE)range: < 1.9.6-r6
- (no CPE)range: < 1.10.1-r5
- (no CPE)range: < 1.9.6-r6
- (no CPE)range: < 1.10.1-r5
- (no CPE)range: < 1.10.1-r4
- (no CPE)range: < 1.9.6-r4
- (no CPE)range: < 1.10.1-r5
- (no CPE)range: < 1.9.6-r6
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.26.1-r0
- (no CPE)range: < 1.26.1-r0
- (no CPE)range: < 1.26.1-r0
- (no CPE)range: < 1.26.1-r0
- (no CPE)range: < 1.26.1-r0
- (no CPE)range: < 1.26.1-r0
- (no CPE)range: < 1.26.1-r0
- (no CPE)range: < 1.26.1-r0
- (no CPE)range: < 1.26.1-r0
- (no CPE)range: < 1.26.1-r0
- (no CPE)range: < 1.26.1-r0
- (no CPE)range: < 1.26.1-r0
- (no CPE)range: < 1.26.1-r0
- (no CPE)range: < 1.10.1-r4
- (no CPE)range: < 1.9.6-r4
- (no CPE)range: < 1.10.1-r4
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.27.0-r0
- (no CPE)range: < 1.26.1-r0
- (no CPE)range: < 1.26.1-r0
- (no CPE)range: < 1.26.1-r0
- (no CPE)range: < 1.26.1-r0
- (no CPE)range: < 1.26.1-r0
- (no CPE)range: < 1.26.1-r0
- (no CPE)range: < 1.26.1-r0
- (no CPE)range: < 1.26.1-r0
- (no CPE)range: < 1.26.1-r0
- (no CPE)range: < 1.26.1-r0
- (no CPE)range: < 1.26.1-r0
- (no CPE)range: < 1.26.1-r0
- (no CPE)range: < 1.26.1-r0
- (no CPE)range: >= 1.25.0, < 1.26.1
- (no CPE)range: >= 1.25.0, < 1.26.1
Patches
Vulnerability mechanics
References
4- my.f5.com/manage/s/article/K000139627mitrevendor-advisory
- www.openwall.com/lists/oss-security/2024/05/30/4mitre
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLAOKJWDALQZBIV3WKGPJ6T5Z56D3PRD/mitre
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7RPLWC35WHEUFCGKNFG62ESNID25TEZ/mitre
News mentions
0No linked articles in our index yet.