CVE-2024-32760: F5 Nginx Open Source DOS Vulnerability

CVE-2024-32760 Overview

CVE-2024-32760 is an out-of-bounds write vulnerability (CWE-787) affecting NGINX Plus and NGINX Open Source when configured to use the HTTP/3 QUIC module. When exploited, specially crafted HTTP/3 encoder instructions can cause NGINX worker processes to terminate unexpectedly or potentially cause other security impacts. This vulnerability affects the QPACK (QUIC Header Compression) processing component within the HTTP/3 implementation.

Critical Impact
Remote attackers can send malicious HTTP/3 encoder instructions to cause denial of service conditions by crashing NGINX worker processes, potentially disrupting web services and load balancing infrastructure.

Affected Products

F5 NGINX Open Source (versions with HTTP/3 QUIC module enabled)
F5 NGINX Plus R30, R30-P1, R30-P2, R31, and R31-P1
Fedora 39 and Fedora 40 (via packaged NGINX)

Discovery Timeline

2024-05-29 - CVE-2024-32760 published to NVD
2025-01-24 - Last updated in NVD database

Technical Details for CVE-2024-32760

Vulnerability Analysis

This vulnerability stems from improper handling of HTTP/3 encoder instructions within the QUIC module. HTTP/3 uses QPACK for header compression, which involves encoder instructions sent from clients to servers. When NGINX processes these instructions, an out-of-bounds write condition can occur, leading to memory corruption in the worker process.

The flaw is network-exploitable without requiring authentication or user interaction, making it accessible to any remote attacker who can establish an HTTP/3 connection to an affected NGINX instance. The vulnerability can result in integrity and availability impacts through memory corruption and process termination.

Root Cause

The root cause is classified as CWE-787 (Out-of-Bounds Write). The HTTP/3 QUIC module fails to properly validate or bounds-check certain encoder instructions during QPACK processing. This allows an attacker to trigger a write operation outside the allocated buffer boundaries, corrupting adjacent memory regions and destabilizing the worker process.

Attack Vector

The attack is conducted over the network by establishing an HTTP/3 (QUIC) connection to a vulnerable NGINX server. The attacker sends specially crafted HTTP/3 encoder instructions that exploit the bounds-checking flaw in the QPACK implementation.

The attack does not require:

Prior authentication to the target system
User interaction or social engineering
Local access to the server

An attacker simply needs network access to a port where NGINX is configured to handle HTTP/3 traffic. The exploitation causes NGINX worker processes to crash, resulting in service disruption. Depending on the NGINX configuration, the master process may respawn workers, but repeated exploitation could lead to sustained denial of service.

Detection Methods for CVE-2024-32760

Indicators of Compromise

Unexpected NGINX worker process crashes or restarts in system logs
Elevated number of worker respawn events recorded by the NGINX master process
Error messages in NGINX logs referencing HTTP/3, QUIC, or QPACK processing failures
Unusual spike in HTTP/3 connection attempts from single sources

Detection Strategies

Monitor NGINX error logs for patterns indicating worker termination related to HTTP/3 handling
Implement network intrusion detection rules to identify malformed QUIC packets or anomalous HTTP/3 traffic patterns
Use application performance monitoring to detect sudden drops in NGINX worker availability
Deploy security solutions capable of inspecting QUIC traffic at the network layer

Monitoring Recommendations

Configure centralized log aggregation for all NGINX instances to correlate crash events
Set up alerting thresholds for worker process restart frequency
Monitor system metrics including process counts and memory usage on NGINX hosts
Enable NGINX debug logging temporarily during incident investigation if exploitation is suspected

How to Mitigate CVE-2024-32760

Immediate Actions Required

Review NGINX configuration to identify if HTTP/3 QUIC module is enabled (listen ... quic directive)
Apply vendor patches from F5 for NGINX Plus or update NGINX Open Source to a patched version
If immediate patching is not possible, disable HTTP/3 support temporarily as a workaround
Monitor NGINX instances for signs of exploitation while remediation is in progress

Patch Information

F5 has released security patches addressing this vulnerability. Administrators should consult the F5 Security Article K000139609 for specific version guidance and download patched releases. Fedora users should apply updates through their package manager as detailed in the Fedora Package Announcements.

Additional technical context is available from the Openwall OSS Security Update.

Workarounds

Disable HTTP/3 QUIC module by removing or commenting out listen ... quic directives in NGINX configuration
If HTTP/3 is required, implement network-level filtering to restrict QUIC traffic to trusted sources only
Deploy a web application firewall (WAF) or reverse proxy that can inspect and filter HTTP/3 traffic upstream of NGINX
Consider temporarily reverting to HTTP/2 until patches can be applied

bash

# Disable HTTP/3 QUIC in NGINX configuration
# Edit your NGINX server block configuration file
# Comment out or remove the 'quic' parameter from listen directives

# Before (vulnerable if HTTP/3 is enabled):
# listen 443 quic reuseport;
# listen 443 ssl;

# After (HTTP/3 disabled):
# listen 443 ssl;

# Reload NGINX configuration
nginx -t && nginx -s reload