CVE-2024-35200: F5 Nginx Open Source

Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days.

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate.

Affected products

• F5 Nginx Open Source: from 1.25.0, before 1.26.1 (fixed in 1.26.1)
• F5 Nginx Plus: version r30 only; version r31 only
• Fedoraproject Fedora: version 39 only; version 40 only

Published 2024-05-29. Last modified 2026-06-17.