NGINX HTTP/3 QUIC vulnerability
Priority LOW 32CWE-416Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Unit (MTU) of 4096 or greater without fragmentation, undisclosed QUIC packets can cause NGINX worker processes to leak previously freed memory.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00867 58th percentileScored 2026-11-07
Fix Fixed NGINX Open Source (F5): 1.26.1NGINX Plus (F5): R32
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| F5 | NGINX Open Source | 1.25.0 to before 1.26.1 | 1.26.1 | Patch available | CNA |
| F5 | NGINX Plus | R30 to before R32 | R32 | Patch available | CNA |
- NGINX Open Source VendorF5 Affected 1.25.0 to before 1.26.1 Fixed in 1.26.1 Patch available CNA
- NGINX Plus VendorF5 Affected R30 to before R32 Fixed in R32 Patch available CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:* | 1.25.0 to before 1.26.1 | Vulnerable | F5 |
| cpe:2.3:a:f5:nginx_plus:r30:-:*:*:*:*:*:* | r30 | Vulnerable | F5 |
| cpe:2.3:a:f5:nginx_plus:r30:p1:*:*:*:*:*:* | r30 p1 | Vulnerable | F5 |
| cpe:2.3:a:f5:nginx_plus:r30:p2:*:*:*:*:*:* | r30 p2 | Vulnerable | F5 |
| cpe:2.3:a:f5:nginx_plus:r31:-:*:*:*:*:*:* | r31 | Vulnerable | F5 |
| cpe:2.3:a:f5:nginx_plus:r31:p1:*:*:*:*:*:* | r31 p1 | Vulnerable | F5 |
| cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* | 39 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* | 40 | Vulnerable | Fedoraproject |
- cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:* Versions 1.25.0 to before 1.26.1 Vulnerable ·F5
- cpe:2.3:a:f5:nginx_plus:r30:-:*:*:*:*:*:* Versions r30 Vulnerable ·F5
- cpe:2.3:a:f5:nginx_plus:r30:p1:*:*:*:*:*:* Versions r30 p1 Vulnerable ·F5
- cpe:2.3:a:f5:nginx_plus:r30:p2:*:*:*:*:*:* Versions r30 p2 Vulnerable ·F5
- cpe:2.3:a:f5:nginx_plus:r31:-:*:*:*:*:*:* Versions r31 Vulnerable ·F5
- cpe:2.3:a:f5:nginx_plus:r31:p1:*:*:*:*:*:* Versions r31 p1 Vulnerable ·F5
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* Versions 40 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA NGINX Open Source (F5) Fixed in 1.26.1
- Fix · CNA NGINX Plus (F5) Fixed in R32
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
F5 NGINX Open Source, NGINX Plus 1.26.1, R32
4 records Highest priority Priority LOW 4 LOW
Other records, highest priority first
- TI-2024-21634 NGINX HTTP/3 QUIC vulnerabilityPriority LOW 36
- TI-2024-23272 NGINX HTTP/3 QUIC vulnerabilityPriority LOW 32
- TI-2024-20468 NGINX HTTP/3 QUIC vulnerabilityPriority LOW 30
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 5 products
- Red Hat Ansible Automation Platform 1.2
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2024-34161
References
Advisory 3
More F5 Nginx Open Source vulnerabilities
- TI-2026-31136 NGINX ngx_http_rewrite_module vulnerability CVSS 4.0CRITICAL 9.2
- TI-2026-22036 NGINX ngx_http_dav_module vulnerability CVSS 4.0HIGH 8.8
- TI-2026-08132 NGINX ngx_http_rewrite_module vulnerability CVSS 4.0CRITICAL 9.2
- TI-2026-30812 NGINX Open-Source ngx_http_v3_module vulnerability CVSS 4.0CRITICAL 9.2
- TI-2026-30432 NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability CVSS 4.0CRITICAL 9.2
- TI-2026-42786 NGINX ngx_http_slice_module vulnerability CVSS 4.0HIGH 8.8
Sources
- CVE-2024-34161 · CVE Program
- CVE-2024-34161 · NVD
- FIRST EPSS
- CVE-2024-34161 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences