CVE-2024-2511: Unbounded memory growth with session…

Record summary

CVE-2024-2511 has a selected CVSS score of 5.9 (medium); EIP currently links 1 lab environment.

Description

Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.

Description source: CVE List

Exploitation context

Available material

Lab environments: 1

CISA SSVC decision

ExploitationNone

AutomatableNo

Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 9, 2024 · Source: CVE List

Affected products and versions

Showing 12 of 32

Product	Source	Version range	Status
OpenSSL Browse OpenSSL / OpenSSL Default status: unaffected	CVE List	3.2.0 to < 3.2.2	affected
		3.1.0 to < 3.1.6	affected
		3.0.0 to < 3.0.14	affected
		1.1.1 to < 1.1.1y	affected
RUGGEDCOM RM1224 LTE(4G) EU Browse Siemens / RUGGEDCOM RM1224 LTE(4G) EU Default status: unknown	CVE List	Before V8.2	affected
RUGGEDCOM RM1224 LTE(4G) NAM Browse Siemens / RUGGEDCOM RM1224 LTE(4G) NAM Default status: unknown	CVE List	Before V8.2	affected
RUGGEDCOM RST2428P Browse Siemens / RUGGEDCOM RST2428P Default status: unknown	CVE List	Before V3.1	affected
SCALANCE M804PB Browse Siemens / SCALANCE M804PB Default status: unknown	CVE List	Before V8.2	affected
SCALANCE M812-1 ADSL-Router Browse Siemens / SCALANCE M812-1 ADSL-Router Default status: unknown	CVE List	Before V8.2	affected
SCALANCE M816-1 ADSL-Router Browse Siemens / SCALANCE M816-1 ADSL-Router Default status: unknown	CVE List	Before V8.2	affected
SCALANCE M826-2 SHDSL-Router Browse Siemens / SCALANCE M826-2 SHDSL-Router Default status: unknown	CVE List	Before V8.2	affected
SCALANCE M874-2 Browse Siemens / SCALANCE M874-2 Default status: unknown	CVE List	Before V8.2	affected
SCALANCE M874-3 Browse Siemens / SCALANCE M874-3 Default status: unknown	CVE List	Before V8.2	affected
SCALANCE M874-3 3G-Router (CN) Browse Siemens / SCALANCE M874-3 3G-Router (CN) Default status: unknown	CVE List	Before V8.2	affected
SCALANCE M876-3 Browse Siemens / SCALANCE M876-3 Default status: unknown	CVE List	Before V8.2	affected

Docker lab environments

GitHub

Repository root

BarAppTeam/nginx-cve-fixCreated 2026-05-16Vuln labCVE-2023-2953 CVE-2023-44487 CVE-2023-5678 CVE-2023-6129 CVE-2023-6237 CVE-2024-2511 CVE-2024-4741 CVE-2024-5535 CVE-2024-6119 CVE-2024-9143 CVE-2025-15467 CVE-2025-6297 CVE-2025-69420 CVE-2025-69720 CVE-2026-2219 CVE-2026-33845 CVE-2026-42010 CVE-2026-42945 CVE-2026-4437 CVE-2026-5435 CVE-2026-5450 CVE-2026-5773 CVE-2026-5928 CVE-2026-6276Dockerfile

1 Dockerfile

View exploit

Analysisdeepseek-v4-pro:cloud · 2026-08-06

Environment assessment

A source-built nginx 1.25.5 container image that remediates CVE-2024-6119 (OpenSSL version bump) and CVE-2026-42945 (backported source patch) while preserving upstream runtime behavior. The environment includes a Dockerfile, build scripts, patch files, regression tests, compatibility tests, and VEX generation scripts.

README.md:1-4Containerfile:1-84

Lab assessment

Vulnerability lab

The README explicitly states the project remediates two CVEs (CVE-2024-6119 and CVE-2026-42945) and provides a test suite, patch provenance, and VEX generation to demonstrate the fixes. The Containerfile builds a custom nginx image with these remediations.

README.md:1-4README.md:7-10

Lab shapeDockerfile

ServicesUnknown

Compose manifests0

Dockerfiles1

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

Containerfile

runtime image definition

Defines the final nginx image based on debian:bookworm-slim, installs a custom-built .deb package, copies entrypoint scripts from the upstream nginx:1.25-bookworm image, and sets up log symlinks.

Containerfile:1-84

build/build.sh

build scriptpatch applicationcompilationpackaging

Fetches nginx and NJS source tarballs with SHA256 verification, applies the CVE-2026-42945 patch, compiles nginx with upstream-identical configure flags, builds dynamic modules and debug binaries, and assembles a .deb package.

build/build.sh:1-925

build/patches/CVE-2026-42945.patch

security patch

A one-line backported fix for CVE-2026-42945 that resets e->is_args in ngx_http_script_regex_end_code().

README.md:201-204

build/verify-patch.sh

patch provenance verification

Downloads upstream nginx source tarballs, verifies their integrity, generates a diff, and confirms the committed patch applies cleanly and matches the upstream fix.

build/verify-patch.sh:1-150

build/generate-vex.sh

VEX document generation

Generates an OpenVEX v0.2.0 document declaring CVE-2026-42945 as fixed via backported patch, for use with vulnerability scanners.

build/generate-vex.sh:1-68

test/test_cve_2026_42945.py

regression test

Starts a container with a custom nginx config that exercises the vulnerable rewrite code path, sends HTTP requests that manipulate query string state, and asserts no crashes, buffer overflows, or malformed responses occur.

test/test_cve_2026_42945.py:1-446

test/compat.py

compatibility test

Boots both the baseline nginx:1.25-bookworm and the candidate fixed image, and compares image metadata, nginx -V output, dynamic modules, filesystem layout, HTTP responses, TLS termination, graceful shutdown, config reload, and concurrent request handling.

test/compat.py:1-930

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2023-2953

Insufficient evidence

Listed in the README residual risk table as a vulnerability in libldap-2.5-0 with status 'Won't fix'. No evidence of active remediation or exploitation is provided.

README.md:456-457

CVE-2023-44487

Insufficient evidence

Listed in the README residual risk table as a vulnerability in nginx, noted as mitigated in nginx >= 1.25.3 but still flagged by scanners. No evidence of active remediation or exploitation is provided.

README.md:454-455

CVE-2023-5678

Insufficient evidence

Mentioned in the README as an OpenSSL CVE fixed by the version bump to 3.0.20, but no specific evidence of the vulnerability or its remediation is provided beyond the general statement.

README.md:170-172

CVE-2023-6129

Insufficient evidence

Mentioned in the README as an OpenSSL CVE fixed by the version bump to 3.0.20, but no specific evidence of the vulnerability or its remediation is provided beyond the general statement.

README.md:170-172

CVE-2023-6237

Insufficient evidence

Mentioned in the README as an OpenSSL CVE fixed by the version bump to 3.0.20, but no specific evidence of the vulnerability or its remediation is provided beyond the general statement.

README.md:170-172

CVE-2024-2511

Insufficient evidence

Mentioned in the README as an OpenSSL CVE fixed by the version bump to 3.0.20, but no specific evidence of the vulnerability or its remediation is provided beyond the general statement.

README.md:170-172

CVE-2024-4741

Insufficient evidence

Mentioned in the README as an OpenSSL CVE fixed by the version bump to 3.0.20, but no specific evidence of the vulnerability or its remediation is provided beyond the general statement.

README.md:170-172

CVE-2024-5535

Insufficient evidence

Mentioned in the README as an OpenSSL CVE fixed by the version bump to 3.0.20, but no specific evidence of the vulnerability or its remediation is provided beyond the general statement.

README.md:170-172

CVE-2024-6119

Supported by supplied evidence

The README describes the remediation as a dependency version bump to libssl3 >= 3.0.14, enforced by the .deb package's Depends field. The Containerfile installs libssl3, and the build script declares the dependency. The README also notes that scanners no longer report this CVE.

README.md:7-8README.md:160-172Containerfile:28-30build/build.sh:1-4

CVE-2024-9143

Insufficient evidence

Mentioned in the README as an OpenSSL CVE fixed by the version bump to 3.0.20, but no specific evidence of the vulnerability or its remediation is provided beyond the general statement.

README.md:170-172

CVE-2025-15467

Insufficient evidence

Mentioned in the README as an OpenSSL CVE fixed by the version bump to 3.0.20, but no specific evidence of the vulnerability or its remediation is provided beyond the general statement.

README.md:170-172

CVE-2025-6297

Insufficient evidence

Listed in the README residual risk table as a vulnerability in dpkg with status 'Fixable (upgrade to 1.21.23)'. No evidence of active remediation or exploitation is provided.

README.md:458-459

CVE-2025-69420

Insufficient evidence

Mentioned in the README as an OpenSSL CVE fixed by the version bump to 3.0.20, but no specific evidence of the vulnerability or its remediation is provided beyond the general statement.

README.md:170-172

CVE-2025-69720

Insufficient evidence

Listed in the README residual risk table as a vulnerability in ncurses with status 'Won't fix'. No evidence of active remediation or exploitation is provided.

README.md:460-461

CVE-2026-2219

Insufficient evidence

Listed in the README residual risk table as a vulnerability in dpkg with status 'Fixable (upgrade to 1.21.23)'. No evidence of active remediation or exploitation is provided.

README.md:458-459

CVE-2026-33845

Insufficient evidence

Listed in the README residual risk table as a vulnerability in libgnutls30 with status 'No fix available in bookworm'. No evidence of active remediation or exploitation is provided.

README.md:456-457

CVE-2026-42010

Insufficient evidence

Listed in the README residual risk table as a vulnerability in libgnutls30 with status 'No fix available in bookworm'. No evidence of active remediation or exploitation is provided.

README.md:456-457

CVE-2026-42945

Supported by supplied evidence

The README, build script, patch file, verification script, and regression test all provide evidence of a backported one-line fix from nginx 1.30.1. The build script applies the patch and verifies the fix marker; the verification script re-derives the patch from upstream tarballs; the regression test exercises the vulnerable code path without crashes.

README.md:7-10README.md:201-204build/build.sh:60-80build/verify-patch.sh:1-150test/test_cve_2026_42945.py:1-446

CVE-2026-4437

Insufficient evidence

Listed in the README residual risk table as a vulnerability in libc6/libc-bin with status 'glibc won't-fix for bookworm'. No evidence of active remediation or exploitation is provided.

README.md:458-459

CVE-2026-5435

Insufficient evidence

Listed in the README residual risk table as a vulnerability in libc6/libc-bin with status 'glibc won't-fix for bookworm'. No evidence of active remediation or exploitation is provided.

README.md:458-459

CVE-2026-5450

Insufficient evidence

Listed in the README residual risk table as a vulnerability in libc6/libc-bin with status 'Won't fix in this Debian release'. No evidence of active remediation or exploitation is provided.

README.md:456-457

CVE-2026-5773

Insufficient evidence

Listed in the README residual risk table as a vulnerability in curl/libcurl4 with status 'Won't fix'. No evidence of active remediation or exploitation is provided.

README.md:460-461

CVE-2026-5928

Insufficient evidence

Listed in the README residual risk table as a vulnerability in libc6/libc-bin with status 'glibc won't-fix for bookworm'. No evidence of active remediation or exploitation is provided.

README.md:458-459

CVE-2026-6276

Insufficient evidence

Listed in the README residual risk table as a vulnerability in curl/libcurl4 with status 'Won't fix'. No evidence of active remediation or exploitation is provided.

README.md:460-461

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker must be installed and running to build the image and execute the test suites.README.md:53-55test/test_cve_2026_42945.py:180-185test/compat.py:1
The build script requires network access to download nginx and NJS source tarballs from nginx.org and github.com.build/build.sh:30-35build/build.sh:40-45
The verification script requires network access to download upstream nginx source tarballs.build/verify-patch.sh:30-35
The compatibility test requires the baseline image nginx:1.25-bookworm to be available locally or pulled from a registry.test/compat.py:40-41

Evidence-described exercise path

Build the fixed nginx image using 'make image' or by running the Containerfile with the build context.README.md:53-55
Run the compatibility test suite with 'make test' to verify the fixed image behaves identically to the upstream image.README.md:56-57
Run the CVE-2026-42945 regression test with 'make test-cve' to exercise the vulnerable code path and confirm the patch prevents crashes and buffer overflows.README.md:59-60
Verify patch provenance with 'make verify-patch' to independently re-derive the patch from upstream tarballs.README.md:62-63
Scan the fixed image and demonstrate VEX suppression with 'make scan'.README.md:65-66

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at building, testing, and verifying a patched nginx container image within the lab's own scope. The Containerfile, build scripts, and test suites do not contain any instructions that escape the container boundary, persist data outside the lab, steal credentials, or connect to external systems beyond documented source downloads. The regression test starts a container with a custom config and sends HTTP requests to localhost; the compatibility test compares two local containers. No hidden or unnecessary host compromise is evident.

Containerfile:1-84build/build.sh:1-925test/test_cve_2026_42945.py:1-446test/compat.py:1-930

Review boundaries

What the analysis did not establish

The packet does not include the Makefile, Dockerfile.build, patch files, or scanner output files referenced in the README, so their exact content cannot be verified.
The .deb package and compiled binaries are not included; their behavior is not inspected.
The VEX generation script references a docker inspect command that interacts with the Docker daemon, but this is a standard operation for obtaining image metadata and does not indicate malicious intent.
The compatibility test and regression test both start and stop Docker containers, which requires access to the Docker socket. This is a common requirement for containerized test environments and is not inherently suspicious.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

Showing 12 of 16

openwall.com

http://www.openwall.com/lists/oss-security/2024/04/08/5

cert-portal.siemens.com

https://cert-portal.siemens.com/productcert/html/ssa-265688.html

cert-portal.siemens.com

https://cert-portal.siemens.com/productcert/html/ssa-354112.html

cert-portal.siemens.com

https://cert-portal.siemens.com/productcert/html/ssa-398330.html

cert-portal.siemens.com

https://cert-portal.siemens.com/productcert/html/ssa-613116.html

cert-portal.siemens.com

https://cert-portal.siemens.com/productcert/html/ssa-769027.html

cert-portal.siemens.com

https://cert-portal.siemens.com/productcert/html/ssa-915275.html

3.1.6 git commitpatch

https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce

3.0.14 git commitpatch

https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d

3.2.2 git commitpatch

https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08

1.1.1y git commitpatch

https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640

lists.debian.org

https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html

CVE-2024-2511

Record summary

Description

Exploitation context

Available material

CISA SSVC decision

Affected products and versions

OpenSSL

RUGGEDCOM RM1224 LTE(4G) EU

RUGGEDCOM RM1224 LTE(4G) NAM

RUGGEDCOM RST2428P

SCALANCE M804PB

SCALANCE M812-1 ADSL-Router

SCALANCE M816-1 ADSL-Router

SCALANCE M826-2 SHDSL-Router

SCALANCE M874-2

SCALANCE M874-3

SCALANCE M874-3 3G-Router (CN)

SCALANCE M876-3

Docker lab environments

Repository root

Environment assessment

Lab assessment

Containerfile

build/build.sh

build/patches/CVE-2026-42945.patch

build/verify-patch.sh

build/generate-vex.sh

test/test_cve_2026_42945.py

test/compat.py

Prerequisites

Evidence-described exercise path

No harmful behavior observed

References