CVE-2024-24990
Fixed in a distro release EPSS <1%CVSS 7.5
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Products: F5 NGINX Plus, F5 NGINX Open Source
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | ingress-nginx-controller | 1.10.1-r4 |
| Chainguard | ingress-nginx-controller-1.9 | 1.9.6-r4 |
| Chainguard | ingress-nginx-controller-compat | 1.9.6-r4 |
| Chainguard | ingress-nginx-controller-compat-1.9 | 1.9.6-r4 |
| Chainguard | ingress-nginx-controller-compat-fips-1.9 | 1.9.6-r6 |
| Chainguard | ingress-nginx-controller-fips | 1.10.1-r5 |
| Chainguard | ingress-nginx-controller-fips-1.9 | 1.9.6-r6 |
| Chainguard | ingress-nginx-controller-fips-compat | 1.10.1-r5 |
| Chainguard | kube-webhook-certgen | 1.10.1-r4 |
| Chainguard | kube-webhook-certgen-1.9 | 1.9.6-r4 |
| Chainguard | kube-webhook-certgen-fips | 1.10.1-r5 |
| Chainguard | kube-webhook-certgen-fips-1.9 | 1.9.6-r6 |
| Chainguard | nginx-bitnami-compat | 1.25.4-r0 |
| Chainguard | nginx-mainline | 1.25.4-r0 |
| Chainguard | nginx-mainline-config | 1.25.4-r0 |
| Chainguard | nginx-mainline-config-compat | 1.25.4-r0 |
| Chainguard | nginx-mainline-mod-http_geoip | 1.25.4-r0 |
| Chainguard | nginx-mainline-mod-http_image_filter | 1.25.4-r0 |
| Chainguard | nginx-mainline-mod-http_perl | 1.25.4-r0 |
| Chainguard | nginx-mainline-mod-http_xslt_filter | 1.25.4-r0 |
| Chainguard | nginx-mainline-mod-mail | 1.25.4-r0 |
| Chainguard | nginx-mainline-mod-stream | 1.25.4-r0 |
| Chainguard | nginx-mainline-mod-stream_geoip | 1.25.4-r0 |
| Chainguard | nginx-mainline-openrc | 1.25.4-r0 |
| Chainguard | nginx-mainline-package-config | 1.25.4-r0 |
| Chainguard | nginx-mainline-src | 1.25.4-r0 |
| Chainguard | nginx-mainline-syslog-config | 1.25.4-r0 |
| Debian 13 | nginx | 1.26.0-1 |
| Debian 14 | nginx | 1.26.0-1 |
| Wolfi | ingress-nginx-controller | 1.10.1-r4 |
| Wolfi | ingress-nginx-controller-compat | 1.9.6-r4 |
| Wolfi | kube-webhook-certgen | 1.10.1-r4 |
| Wolfi | nginx-bitnami-compat | 1.25.4-r0 |
| Wolfi | nginx-mainline | 1.25.4-r0 |
| Wolfi | nginx-mainline-config | 1.25.4-r0 |
| Wolfi | nginx-mainline-config-compat | 1.25.4-r0 |
| Wolfi | nginx-mainline-mod-http_geoip | 1.25.4-r0 |
| Wolfi | nginx-mainline-mod-http_image_filter | 1.25.4-r0 |
| Wolfi | nginx-mainline-mod-http_perl | 1.25.4-r0 |
| Wolfi | nginx-mainline-mod-http_xslt_filter | 1.25.4-r0 |
| Wolfi | nginx-mainline-mod-mail | 1.25.4-r0 |
| Wolfi | nginx-mainline-mod-stream | 1.25.4-r0 |
| Wolfi | nginx-mainline-mod-stream_geoip | 1.25.4-r0 |
| Wolfi | nginx-mainline-openrc | 1.25.4-r0 |
| Wolfi | nginx-mainline-package-config | 1.25.4-r0 |
| Wolfi | nginx-mainline-src | 1.25.4-r0 |
| Wolfi | nginx-mainline-syslog-config | 1.25.4-r0 |