CVE-2024-35200

Name of the Vulnerable Software and Affected Versions NGINX Plus (affected versions not specified) NGINX OSS (affected versions not specified)

Description The issue is related to a null pointer dereference in the HTTP/3 QUIC module (ngx http v3 module) of NGINX Plus and NGINX OSS. This can be exploited by a remote attacker using specially crafted HTTP/3 requests, potentially leading to a denial of service. When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.