CVE-2024-24989
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests
CVE-2024-24989: When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests. Not in the CISA KEV catalog.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Get an email when F5 publishes the next one.
VulniPulse checks F5's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.
CVE-2024-24989 key facts
- CISA KEV
- Not listed (catalog checked )
- Highest advisory severity
- High
- CVSS base score
- 7.5 (F5), 7.5 (NetApp)
- Fixed releases
- NetApp: NetApp Console Agent Container (static-file-server): 4.10.0
- VulniPulse record
- Published · Updated
Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2024-24989; bulletin-wide values are not repeated here.
Is CVE-2024-24989 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2024-24989 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2024-24989?
Upgrade to a fixed release named by the vendor:
- NetApp: NetApp Console Agent Container (static-file-server): 4.10.0
- Update affected NetApp products to a fixed release: NetApp Console Agent Container (static-file-server): 4.10.0. (NetApp)
Vendor advisory comparison
F5
1 advisory- Advisory severityHigh7.5
High [CVE-2024-24989] When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests
CVE-2024-24989Source published Source updated
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 . NOTE: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- Related products — impact not confirmed
- NGINX Plus
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
NetApp
1 advisory- Advisory severityHigh7.5
High [CVE-2024-24989] NGINX Vulnerability in NetApp Products
NTAP-20260703-0003Source published Source updated
Nginx version 1.25.3 is susceptible to a vulnerability which when successfully exploited could lead to Denial of Service (DoS). Successful exploitation of this vulnerability could lead to Denial of Service (DoS). Affected products: NetApp Console Agent Container (static-file-server). NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
- Affected products in this advisory
- NetApp Console Agent Container (static-file-server)
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- NetApp Console Agent Container (static-file-server): 4.10.0
- Mitigation guidance
- Update affected NetApp products to a fixed release: NetApp Console Agent Container (static-file-server): 4.10.0.
More F5 advisories
- CVE-2026-95101Oct 14, 2026Description NGINX Plus and NGINX Open Source have a vulnerability
- CVE-2026-97205Oct 14, 2026NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module
- CVE-2026-93479Oct 14, 2026vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex
- CVE-2026-97629Oct 14, 2026Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache
- CVE-2026-15176Oct 14, 2026vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured
- CVE-2026-90439Sep 15, 2026NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module
Follow CVE-2024-24989 in the free weekly digest
Every Monday: whether it was added to CISA KEV, reported exploited, got a fix or changed severity, plus the week's critical and high advisories.
Browse the latest tracked CVEs or the CVEs listed in CISA KEV.
Android app · Google Play
Get alerts for new CVEs on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.