NGINX HTTP/3 QUIC vulnerability

CVE-2024-24989

What is CVE-2024-24989?

When configured to utilize the experimental HTTP/3 QUIC module, NGINX Plus and NGINX OSS are susceptible to issues where certain undisclosed requests can lead to the termination of worker processes. This flaw poses potential disruptions in service and affects the reliability of applications relying on these web server solutions. The HTTP/3 QUIC module is not enabled by default, which limits exposure but warrants caution for users who decide to enable it. For additional insights on configuration and implications, refer to the official documentation on QUIC and HTTP/3.

News Articles

securityonline.info

CVE-2024-24990CVE-2024-24989

NGINX Releases Urgent Patch for HTTP/3 Vulnerabilities (CVE-2024-24989, CVE-2024-24990)

NGINX has released an urgent patch to address 2 flaws (CVE-2024-24989, CVE-2024-24990) lurking within its experimental HTTP/3 implementation

References