CVE-2024-31079: F5 Nginx Open Source

Medium severity, CVSS 4.8. EPSS: 0.9% chance of exploitation in the next 30 days.

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate or cause other potential impact. This attack requires that a request be specifically timed during the connection draining process, which the attacker has no visibility and limited influence over.

Affected products

• F5 Nginx Open Source: from 1.25.0, before 1.26.1 (fixed in 1.26.1)
• F5 Nginx Plus: version r30 only; version r31 only
• Fedoraproject Fedora: version 39 only; version 40 only

Published 2024-05-29. Last modified 2026-06-17.