ALPINE-CVE-2024-31079

ALPINE-CVE-2024-31079 REJECTED CVSS 4.800000190734863 MEDIUM

Record from OSV · Published May 29, 2024

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate or cause other potential impact. This attack requires that a request be specifically timed during the connection draining process, which the attacker has no visibility and limited influence over.

Risk scores

CVSS 3.1

4.800000190734863

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Affected products

Vendor	Product	Versions
Alpine:v3.24	nginx	0
Alpine:v3.23	nginx	0
Alpine:v3.22	nginx	0
Alpine:v3.20	nginx	0
Alpine:v3.21	nginx	0

Timeline

May 29, 2024 CVE Published
Jul 14, 2026 CVE Rejected
Jul 14, 2026 CVE Updated
Aug 8, 2026 Distribution Patch

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln ALPINE-CVE-2024-31079
vulnetix vdb fixes ALPINE-CVE-2024-31079

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/ALPINE-CVE-2024-31079/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

https://security.alpinelinux.org/vuln/CVE-2024-31079 advisory

Look up in the Resolve Platform →