CVE-2024-34161

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Unit (MTU) of 4096 or greater without fragmentation, undisclosed QUIC packets can cause NGINX worker processes to leak previously freed memory.

Score

CVSS 3.1 5.3 Medium

Status

Analyzed - f5sirt@f5.com

Published

2024-05-29

Last modified

2025-02-13

Weaknesses

CWE-416

Affected products

• Nginx (F5)
• Nginx Open Source (F5)
• Nginx Plus (F5)
• Fedora (Fedoraproject)

References

• http://www.openwall.com/lists/oss-security/2024/05/30/4
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLAOKJWDALQZBIV3WKGPJ6T5…
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7RPLWC35WHEUFCGKNFG62ES…
• https://my.f5.com/manage/s/article/K000139627