CVE-2024-31079

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate or cause other potential impact. This attack requires that a request be specifically timed during the connection draining process, which the attacker has no visibility and limited influence over.

• CWE-121
• CWE-787

• http://www.openwall.com/lists/oss-security/2024/05/30/4Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLAOKJWDALQZBIV3WKGPJ6T5Z56D3PRD/Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7RPLWC35WHEUFCGKNFG62ESNID25TEZ/Third Party Advisory
• https://my.f5.com/manage/s/article/K000139611Vendor Advisory
• http://www.openwall.com/lists/oss-security/2024/05/30/4Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLAOKJWDALQZBIV3WKGPJ6T5Z56D3PRD/Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7RPLWC35WHEUFCGKNFG62ESNID25TEZ/Third Party Advisory
• https://my.f5.com/manage/s/article/K000139611Vendor Advisory

Published

May 29, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-31071in OpenHarmony v4.0.0 and prior versions allow a local attac…3.3
• CVE-2024-31073Uncontrolled search path for some Intel(R) oneAPI Level Zero…6.7
• CVE-2024-31074Observable timing discrepancy in some Intel(R) QAT Engine fo…8.2
• CVE-2024-31076In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-31077Forminator prior to 1.29.3 contains a SQL injection vulnerab…7.2
• CVE-2024-31078in OpenHarmony v4.0.0 and prior versions allow a local attac…5.5
• CVE-2024-3108 An implicit intent vulnerability was reported for Motorola’…5.5
• CVE-2024-31080A heap-based buffer over-read vulnerability was found in the…7.3
• CVE-2024-31081A heap-based buffer over-read vulnerability was found in the…7.3
• CVE-2024-31082A heap-based buffer over-read vulnerability was found in the…7.3
• CVE-2024-31083A use-after-free vulnerability was found in the ProcRenderAd…7.8
• CVE-2024-31084Improper Neutralization of Input During Web Page Generation …7.1