Stack-based buffer overflow in NGINX Plus and NGINX Open Source - CVE-2024-31079

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when HTTP/3 requests within the HTTP/3 QUIC module
 (ngx_http_v3_module). A remote attacker can send specially crafted requests to the web server, trigger a stack-based buffer overflow and perform a denial of service (DoS) attack.

This attack requires that a request be specifically timed during the connection draining process, which the attacker has no visibility and limited influence over.

Affected software

How to mitigate CVE-2024-31079

External References

• https://my.f5.com/manage/s/article/K000139611
• https://mailman.nginx.org/pipermail/nginx-announce/2024/GMY32CSHFH6VFTN76HJNX7WNEX4RLHF6.html

Related Security Bulletins

• Multiple vulnerabilities in nginx and NGINX Plus
• Multiple vulnerabilities in IBM Watson Discovery
• Tenable Sensor Proxy update for third-party components