PT-2024-3974 · Nginx+1 · Nginx Plus+3

Nils Bars · Published 2024-05-29 · Updated 2026-04-01 · CVE-2024-35200

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions NGINX Plus (affected versions not specified) NGINX OSS (affected versions not specified)

Description The issue is related to a null pointer dereference in the HTTP/3 QUIC module (ngx http v3 module) of NGINX Plus and NGINX OSS. This can be exploited by a remote attacker using specially crafted HTTP/3 requests, potentially leading to a denial of service. When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2024-04389

BIT-NGINX-2024-35200

BIT-NGINX-GATEWAY-2024-35200

CLEANSTART-2026-BA37192

CLEANSTART-2026-MQ02912

CLEANSTART-2026-XB16901

CLEANSTART-2026-ZN32454

CLEANSTART-2026-ZT77083

CVE-2024-35200

Affected Products

Nginx Oss

Nginx Plus

Nginx

Red Os

References · 73

• https://nvd.nist.gov/vuln/detail/CVE-2022-41741 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-3638 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-35200 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-20372 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/MLAOKJWDALQZBIV3WKGPJ6T5Z56D3PRD · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-35200 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46461 · Security Note
• https://my.f5.com/manage/s/article/K000139612 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2024-35200 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9516 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-9511 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-35200 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-BA37192 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-44487 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-34161 · Security Note