CVE-2024-39792 — Expired Pointer Dereference in F5 Nginx Plus

CWE-825 — Expired Pointer DereferenceCWE-672 — Operation on a Resource after Expiration or Release5 documents5 sources
Severity
8.7HIGHNVD
EPSS
1.4%
top 19.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
F5 Nginx Plus
Timeline
PublishedAug 14

Description

When the NGINX Plus is configured to use the MQTT pre-read module, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Packages2 packages

▶CVEListV5f5/nginx_plusR30 — *
▶NVDf5/nginx_plusr30, r31, r32+2

🔴Vulnerability Details

2
GHSA
GHSA-j72m-4pgw-w3qv: When the NGINX Plus is configured to use the MQTT pre-read module, undisclosed requests can cause an increase in memory resource utilization↗2024-08-14
▶
CVEList
NGINX Plus MQTT vulnerability↗2024-08-14
▶

📋Vendor Advisories

2
F5
CVE-2024-39792: When the NGINX Plus is configured to use the MQTT pre-read module, undisclosed requests can cause an increase in memo...↗2024-08-14
▶
Debian
CVE-2024-39792: nginx - When the NGINX Plus is configured to use the MQTT pre-read module, undisclosed r...↗2024
▶
CVE-2024-39792 — Expired Pointer Dereference in F5 | cvebase