CVE-2024-24989: f5 nginx open source NULL Pointer Dereference
Vulnerability summary
CVE-2024-24989 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in f5 nginx open source. EPSS estimates a 1.06% chance of exploitation in the next 30 days, higher than 63.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 6Timeline
- 14-02-2024PublishedVulnerability first disclosed.
- 12-05-2025Last modifiedVulnerability information updated.
Description
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html . NOTE: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS metrics
5 scores · 5 sources · 1 version- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.06%
Chance of exploitation in the next 30 days
Percentile
64%
Versus all other CVEs
30-day change
0.00 pp
From 1.06% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
F52 products
- nginx open source≥ 1.25.3, < 1.25.4 | 1.25.3
- nginx plus≥ R31, < R31 P1 | r31
Chainguard1 product
- nginx-mainline< 1.25.4-r0
Debian1 product
- nginx< 1.26.0-1
Opensuse1 product
- nginx&distro=openSUSE Tumbleweed< 1.25.4-1.1
Wolfi1 product
- nginx-mainline< 1.25.4-r0
5 vendors · 6 products
