CVE-2024-3416: MTU of 4096 or greater without fragmentation may cause NGINX worker processes to leak previously freed memory
该报告还没有中文解读。
原文摘录
摘自原文（383 字符中的一小部分）
When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Unit (MTU) of 4096 or greater without fragmentation, undisclosed QUIC packets can cause NGINX worker processes to leak previously freed memory.
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Internet Bug Bounty 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @noentry · 版权归作者与 Internet Bug Bounty 所有