CVE-2024-32760: F5 Nginx Open Source DOS Vulnerability

CVE-2024-32760 Overview

CVE-2024-32760 is an out-of-bounds write vulnerability (CWE-787) affecting NGINX Plus and NGINX Open Source when configured to use the HTTP/3 QUIC module. When exploited, specially crafted HTTP/3 encoder instructions can cause NGINX worker processes to terminate unexpectedly or potentially cause other security impacts. This vulnerability affects the QPACK (QUIC Header Compression) processing component within the HTTP/3 implementation.

Critical Impact

Remote attackers can send malicious HTTP/3 encoder instructions to cause denial of service conditions by crashing NGINX worker processes, potentially disrupting web services and load balancing infrastructure.

Affected Products

• F5 NGINX Open Source (versions with HTTP/3 QUIC module enabled)
• F5 NGINX Plus R30, R30-P1, R30-P2, R31, and R31-P1
• Fedora 39 and Fedora 40 (via packaged NGINX)

Discovery Timeline

• 2024-05-29 - CVE-2024-32760 published to NVD
• 2025-01-24 - Last updated in NVD database

Technical Details for CVE-2024-32760

Vulnerability Analysis

This vulnerability stems from improper handling of HTTP/3 encoder instructions within the QUIC module. HTTP/3 uses QPACK for header compression, which involves encoder instructions sent from clients to servers. When NGINX processes these instructions, an out-of-bounds write condition can occur, leading to memory corruption in the worker process.

The flaw is network-exploitable without requiring authentication or user interaction, making it accessible to any remote attacker who can establish an HTTP/3 connection to an affected NGINX instance. The vulnerability can result in integrity and availability impacts through memory corruption and process termination.

Root Cause

The root cause is classified as CWE-787 (Out-of-Bounds Write). The HTTP/3 QUIC module fails to properly validate or bounds-check certain encoder instructions during QPACK processing. This allows an attacker to trigger a write operation outside the allocated buffer boundaries, corrupting adjacent memory regions and destabilizing the worker process.

Attack Vector

The attack is conducted over the network by establishing an HTTP/3 (QUIC) connection to a vulnerable NGINX server. The attacker sends specially crafted HTTP/3 encoder instructions that exploit the bounds-checking flaw in the QPACK implementation.

The attack does not require:

• Prior authentication to the target system
• User interaction or social engineering
• Local access to the server

An attacker simply needs network access to a port where NGINX is configured to handle HTTP/3 traffic. The exploitation causes NGINX worker processes to crash, resulting in service disruption. Depending on the NGINX configuration, the master process may respawn workers, but repeated exploitation could lead to sustained denial of service.

Detection Methods for CVE-2024-32760

Indicators of Compromise

• Unexpected NGINX worker process crashes or restarts in system logs
• Elevated number of worker respawn events recorded by the NGINX master process
• Error messages in NGINX logs referencing HTTP/3, QUIC, or QPACK processing failures
• Unusual spike in HTTP/3 connection attempts from single sources

Detection Strategies

• Monitor NGINX error logs for patterns indicating worker termination related to HTTP/3 handling
• Implement network intrusion detection rules to identify malformed QUIC packets or anomalous HTTP/3 traffic patterns
• Use application performance monitoring to detect sudden drops in NGINX worker availability
• Deploy security solutions capable of inspecting QUIC traffic at the network layer

Monitoring Recommendations

• Configure centralized log aggregation for all NGINX instances to correlate crash events
• Set up alerting thresholds for worker process restart frequency
• Monitor system metrics including process counts and memory usage on NGINX hosts
• Enable NGINX debug logging temporarily during incident investigation if exploitation is suspected

How to Mitigate CVE-2024-32760

Immediate Actions Required

• Review NGINX configuration to identify if HTTP/3 QUIC module is enabled (listen ... quic directive)
• Apply vendor patches from F5 for NGINX Plus or update NGINX Open Source to a patched version
• If immediate patching is not possible, disable HTTP/3 support temporarily as a workaround
• Monitor NGINX instances for signs of exploitation while remediation is in progress

Patch Information

F5 has released security patches addressing this vulnerability. Administrators should consult the F5 Security Article K000139609 for specific version guidance and download patched releases. Fedora users should apply updates through their package manager as detailed in the Fedora Package Announcements.

Additional technical context is available from the Openwall OSS Security Update.

Workarounds

• Disable HTTP/3 QUIC module by removing or commenting out listen ... quic directives in NGINX configuration
• If HTTP/3 is required, implement network-level filtering to restrict QUIC traffic to trusted sources only
• Deploy a web application firewall (WAF) or reverse proxy that can inspect and filter HTTP/3 traffic upstream of NGINX
• Consider temporarily reverting to HTTP/2 until patches can be applied

# Disable HTTP/3 QUIC in NGINX configuration
# Edit your NGINX server block configuration file
# Comment out or remove the 'quic' parameter from listen directives

# Before (vulnerable if HTTP/3 is enabled):
# listen 443 quic reuseport;
# listen 443 ssl;

# After (HTTP/3 disabled):
# listen 443 ssl;

# Reload NGINX configuration
nginx -t && nginx -s reload