CVE-2024-31079

Katalog CVE

CVSS 4.8 · Medium EPSS 0,89%

Kerentanan Stack-based Buffer Overflow pada f5 nginx open source, f5 nginx plus +1 lainnya. Skor CVSS 3.1 4.8 (Medium) menurut NVD.

Deskripsi (NVD)

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate or cause other potential impact. This attack requires that a request be specifically timed during the connection draining process, which the attacker has no visibility and limited influence over.

Rincian

Terbit di NVD

29 Mei 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-121: Stack-based Buffer Overflow
CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,89% peluang dieksploitasi; lebih tinggi dari 58,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://my.f5.com/manage/s/article/K000139611 advisory vendor
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLAOKJWDALQZBIV... advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7RPLWC35WHEUFC... advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2024/05/30/4 mailing list