CVE-2024-34161

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Unit (MTU) of 4096 or greater without fragmentation, undisclosed QUIC packets can cause NGINX worker processes to leak previously freed memory.

• CWE-416
• CWE-416

• http://www.openwall.com/lists/oss-security/2024/05/30/4Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLAOKJWDALQZBIV3WKGPJ6T5Z56D3PRD/Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7RPLWC35WHEUFCGKNFG62ESNID25TEZ/Third Party Advisory
• https://my.f5.com/manage/s/article/K000139627Vendor Advisory
• http://www.openwall.com/lists/oss-security/2024/05/30/4Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MLAOKJWDALQZBIV3WKGPJ6T5Z56D3PRD/Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7RPLWC35WHEUFCGKNFG62ESNID25TEZ/Third Party Advisory
• https://my.f5.com/manage/s/article/K000139627Vendor Advisory

Published

May 29, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-34154Rejected reason: reserved but not needed
• CVE-2024-34155Calling any of the Parse functions on Go source code which c…4.3
• CVE-2024-34156Calling Decoder.Decode on a message which contains deeply ne…7.5
• CVE-2024-34157Rejected reason: reserved but not needed
• CVE-2024-34158Calling Parse on a "// +build" build tag line with deeply ne…7.5
• CVE-2024-3416A vulnerability classified as critical was found in SourceCo…9.8
• CVE-2024-34162The web interface of the affected devices is designed to hid…5.3
• CVE-2024-34163Improper input validation in firmware for some Intel(R) NUC …8.2
• CVE-2024-34164Uncontrolled search path element in some Intel(R) MAS softwa…6.7
• CVE-2024-34165Uncontrolled search path in some Intel(R) oneAPI DPC++/C++ C…6.7
• CVE-2024-34166An os command injection vulnerability exists in the touchlis…9.8
• CVE-2024-34167Uncontrolled search path for the Intel(R) Server Board S2600…6.7