CVE-2024-24990

NameCVE-2024-24990
Description When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
nginx (PTS)jessie, jessie (lts)1.6.2-5+deb8u10vulnerable
stretch (security)1.10.3-1+deb9u7vulnerable
stretch (lts), stretch1.10.3-1+deb9u8vulnerable
buster (security), buster, buster (lts)1.14.2-2+deb10u5fixed
bullseye (security), bullseye1.18.0-6.1+deb11u3fixed
bookworm1.22.1-9fixed
sid, trixie1.26.0-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
nginxsourcebuster(not affected)
nginxsourcebullseye(not affected)
nginxsourcebookworm(not affected)
nginxsource(unstable)1.26.0-1unimportant

Notes

[bookworm] - nginx <not-affected> (Vulnerable code not present)
[bullseye] - nginx <not-affected> (Vulnerable code not present)
[buster] - nginx <not-affected> (Vulnerable code not present)
https://mailman.nginx.org/pipermail/nginx-announce/2024/NW6MNW34VZ6HDIHH5YFBIJYZJN7FGNAV.html
HTTP3 not enabled in Debian build

Search for package or bug name: Reporting problems