Nginx Plus

nginx_plus

Vendor: F5 • 26 CVEs

CVEs (26)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-32760 2F5 Fedoraproject 3Fedora Nginx Open SourceNginx Plus Jun 17, 2026 May 29, 2024 N/A· v4 6.5 MEDIUM· v3 N/A· v2 When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 encoder instructions can cause NGINX worker processes to terminate or cause or other potential impact.
CVE-2024-31079 2F5 Fedoraproject 3Fedora Nginx Open SourceNginx Plus Jun 17, 2026 May 29, 2024 N/A· v4 4.8 MEDIUM· v3 N/A· v2 When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate or cause other potential impact. This attack requires that a request be...Show more When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate or cause other potential impact. This attack requires that a request be specifically timed during the connection draining process, which the attacker has no visibility and limited influence over.Show less
CVE-2024-24990 1F5 2Nginx Open Source Nginx Plus Jun 17, 2026 Feb 14, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered exp...Show more When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluatedShow less
CVE-2024-24989 1F5 2Nginx Open Source Nginx Plus Jun 17, 2026 Feb 14, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered exp...Show more When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html . NOTE: Software versions which have reached End of Technical Support (EoTS) are not evaluatedShow less
CVE-2023-44487 33Akka AmazonApache+30 more 165.net 3scale Api Management PlatformAdvanced Cluster Management For Kubernetes+162 more Jun 17, 2026 Oct 10, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2022-41743 1F5 2Nginx Ingress Controller Nginx Plus Jun 17, 2026 Oct 19, 2022 N/A· v4 7.0 HIGH· v3 N/A· v2 NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_hls_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its crash or potential other impact using...Show more NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_hls_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its crash or potential other impact using a specially crafted audio or video file. The issue affects only NGINX Plus when the hls directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_hls_module.Show less

Previous 12