PT-2024-3971 · Nginx+1 · Nginx Plus+3

Nils Bars · Published 2024-05-29 · Updated 2026-04-01 · CVE-2024-34161

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NGINX Plus (affected versions not specified) NGINX OSS (affected versions not specified)

Description The issue is related to the use of memory after it has been freed in the HTTP/3 QUIC module (ngx http v3 module) of NGINX Plus and NGINX OSS. This can be exploited by a remote attacker using specially crafted HTTP/3 requests, potentially allowing unauthorized access to protected information. The vulnerability is particularly relevant when the network infrastructure supports a Maximum Transmission Unit (MTU) of 4096 or greater without fragmentation, as undisclosed QUIC packets can cause NGINX worker processes to leak previously freed memory.

Recommendations For NGINX Plus, consider disabling the HTTP/3 QUIC module until a patch is available. For NGINX OSS, consider disabling the HTTP/3 QUIC module until a patch is available. As a temporary workaround, restrict the Maximum Transmission Unit (MTU) to less than 4096 to minimize the risk of exploitation.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2024-04386

BIT-NGINX-2024-34161

BIT-NGINX-GATEWAY-2024-34161

CLEANSTART-2026-BA37192

CLEANSTART-2026-MQ02912

CLEANSTART-2026-XB16901

CLEANSTART-2026-ZN32454

CLEANSTART-2026-ZT77083

CVE-2024-34161

Affected Products

Nginx Oss

Nginx Plus

Nginx

Red Os

References · 73

• https://nvd.nist.gov/vuln/detail/CVE-2022-41741 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-3638 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-34161 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-35200 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-20372 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/MLAOKJWDALQZBIV3WKGPJ6T5Z56D3PRD · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46461 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-34161 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-9516 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-9511 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-BA37192 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-44487 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-9513 · Security Note
• https://osv.dev/vulnerability/CVE-2024-34161 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32760 · Security Note