CVE-2024-31079
mediumpriority · track · 19EPSS 0.009 · 59 %ileDEEUNLRUUSEPSS · scored 2026-10-27
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate or cause other potential impact. This attack requires that a request be specifically timed during the connection draining process, which the attacker has no visibility and limited influence over.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (18)
Products and version ranges known to be affected.
advisories (4)
Vendor and ecosystem advisories describing this.
- NCSC-2024-0411Kwetsbaarheden verholpen in Oracle Database productenNL2024-10-17csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in diverse Database producten en subsystemen, zoals de Core database, Application Express, Autonomous Health Framework, Essbase, GoldenGate, SQL Developer en Secure Backup.
- WID-SEC-W-2024-1265NGINX NGINX Plus: Mehrere Schwachstellen ermöglichen Denial of ServiceDeutsch2024-05-30csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in NGINX NGINX Plus ausnutzen, um einen Denial of Service Angriff durchzuführen.
- BIT-nginx-2024-31079NGINX HTTP/3 QUIC vulnerability2024-06-04vendor · osvUS
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate or cause other potential impact. This attack requires that a request be specifically timed during the connection draining process, which the attacker has no visibility and limited influence over.
- BIT-nginx-gateway-2024-31079NGINX HTTP/3 QUIC vulnerability2025-12-03vendor · osvUS
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate or cause other potential impact. This attack requires that a request be specifically timed during the connection draining process, which the attacker has no visibility and limited influence over.
also known as (5)
Other names and identifiers for this entity.
- CNNVD-202405-4793cnnvd
- EUVD-2024-34446enisa_euvd
- BDU:2024-04387fstec_bdu
- BIT-nginx-2024-31079osv
- BIT-nginx-gateway-2024-31079osv
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2024-31079/cnnvd
- https://my.f5.com/manage/s/article/K000139611cnnvd
- https://vigilance.fr/vulnerability/nginx-four-vulnerabilities-via-HTTP-3-44414cnnvd
- http://www.openwall.com/lists/oss-security/2024/05/30/4enisa_euvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLAOKJWDALQZBIV3WKGPJ6T5Z56D3PRD/enisa_euvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7RPLWC35WHEUFCGKNFG62ESNID25TEZ/enisa_euvd
- https://my.f5.com/manage/s/article/K000139611enisa_euvd
- http://www.openwall.com/lists/oss-security/2024/05/30/4Mailing Listnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan