CVE-2024-32760mediumCWE-787

CVE-2024-32760: medium-severity vulnerability in F5 NGINX Plus

NGINX HTTP/3 QUIC vulnerability

Published · Updated

Follow this CVE+ Monitor NGINX Plus+ Monitor NGINX Open Source

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.9%
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 encoder instructions can cause NGINX worker processes to terminate or cause or other potential impact.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected products
F5 · NGINX Open SourceF5 · NGINX Plus
Related CVEs — F5 NGINX Plus

In the same product, most dangerous first.

CVE-2026-42945CRITICALNGINX ngx_http_rewrite_module vulnerabilityEPSS 68.0%CVE-2026-27654HIGHNGINX ngx_http_dav_module vulnerabilityEPSS 26.5%CVE-2026-9256CRITICALNGINX ngx_http_rewrite_module vulnerabilityEPSS 10.9%CVE-2026-42055CRITICALNGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerabilityEPSS 6.5%CVE-2026-42533CRITICALNGINX Map directive and Regex matching vulnerabilityEPSS 6.3%CVE-2026-42530CRITICALNGINX Open-Source ngx_http_v3_module vulnerabilityEPSS 6.2%