CVE-2024-24990highCWE-416

CVE-2024-24990: falha de alta gravidade em F5 NGINX Plus

NGINX HTTP/3 QUIC vulnerability

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar NGINX Plus+ Monitorar NGINX Open Source

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.9%
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
F5 · NGINX Open SourceF5 · NGINX Plus
CVEs relacionadas — F5 NGINX Plus

No mesmo produto, das mais perigosas para as menos.

CVE-2026-42945CRITICALNGINX ngx_http_rewrite_module vulnerabilityEPSS 68.0%CVE-2026-27654HIGHNGINX ngx_http_dav_module vulnerabilityEPSS 25.9%CVE-2026-9256CRITICALNGINX ngx_http_rewrite_module vulnerabilityEPSS 10.9%CVE-2026-42055CRITICALNGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerabilityEPSS 6.5%CVE-2026-42533CRITICALNGINX Map directive and Regex matching vulnerabilityEPSS 6.3%CVE-2026-42530CRITICALNGINX Open-Source ngx_http_v3_module vulnerabilityEPSS 6.2%