F5 ships out-of-band patches for critical NGINX flaws
Three critical bugs can crash NGINX or, if ASLR is off or bypassed, allow code execution; F5 reports no exploitation.
Stories per day · 30 days
3 RSS
Relateddenial-of-service3qpack3f52heap-overflow2nginx2quic2quic-go2wireshark2amplification1patch1rce1tls1use-after-free1
4 stories, newest first · one card per story
Stories tagged #http3
QPACK flaws can crash HTTP/3 servers via memory amplification
FoxIO released PoCs; quic-go, quiche, lsquic, and Wireshark are patched, while Bun, h3, and aioquic were not.
NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks
NGINX 1.30.6 and 1.31.7 fix five flaws, including possible worker RCE and a TLS client-cert bypass.
CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification
Researchers disclosed two DoS attacks exploiting CDNs' HTTP/3-to-HTTP/1.1 translation to amplify low-bandwidth requests up to 350x against origin servers.
1