CVE-2024-34161: F5 Nginx Open Source

Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days.

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Unit (MTU) of 4096 or greater without fragmentation, undisclosed QUIC packets can cause NGINX worker processes to leak previously freed memory.

Affected products

• F5 Nginx Open Source: from 1.25.0, before 1.26.1 (fixed in 1.26.1)
• F5 Nginx Plus: version r30 only; version r31 only
• Fedoraproject Fedora: version 39 only; version 40 only

Published 2024-05-29. Last modified 2026-06-17.