CVE-2024-35200: F5 Nginx Open Source DOS Vulnerability

CVE-2024-35200 Overview

CVE-2024-35200 affects NGINX Plus and NGINX Open Source when configured with the HTTP/3 QUIC module. A remote attacker can send crafted HTTP/3 requests that trigger a null pointer dereference [CWE-476], causing NGINX worker processes to terminate. The flaw enables a denial of service condition against affected web servers and reverse proxies.

The vulnerability requires no authentication and no user interaction. Exploitation impacts availability only, with no confidentiality or integrity consequences. F5 published advisory K000139612 on May 29, 2024, along with patched builds for NGINX Plus and NGINX OSS.

Critical Impact
Unauthenticated remote attackers can crash NGINX worker processes handling HTTP/3 traffic, disrupting service availability for any application relying on the QUIC module.

Affected Products

F5 NGINX Open Source (versions with the experimental QUIC/HTTP/3 module)
F5 NGINX Plus R30, R30 P1, R30 P2, R31, R31 P1
Fedora Project Fedora 39 and 40

Discovery Timeline

2024-05-29 - CVE-2024-35200 published to NVD
2024-05-29 - F5 releases advisory K000139612
2024-05-30 - Vulnerability disclosed on the Openwall oss-security mailing list
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35200

Vulnerability Analysis

The vulnerability resides in the NGINX HTTP/3 QUIC module, which handles QUIC transport and HTTP/3 request framing. Undisclosed HTTP/3 requests cause the affected worker process to dereference a null pointer and terminate. NGINX master processes typically respawn workers, but sustained exploitation prevents legitimate clients from completing requests.

The HTTP/3 QUIC module was introduced as experimental in NGINX 1.25.0 and became part of the mainline distribution. Deployments that explicitly enable listen ... quic directives or build NGINX with --with-http_v3_module expose the vulnerable code path. Servers without HTTP/3 enabled are not affected.

The issue is tracked as CWE-476: NULL Pointer Dereference. No public proof-of-concept has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

According to the F5 advisory, specific HTTP/3 request patterns trigger a code path in which the worker process accesses an uninitialized or freed pointer. Because QUIC parsing occurs before higher-layer request validation, malformed frames reach the vulnerable logic without prior sanity checks.

Attack Vector

An attacker sends crafted HTTP/3 requests over UDP to a listener configured with the QUIC module. The request does not require valid application credentials or prior session state. Each successful request terminates one worker process, and repeated requests can exhaust NGINX worker capacity or generate excessive process churn.

For technical specifics, refer to the F5 Article K000139612 and the Openwall Security Discussion.

Detection Methods for CVE-2024-35200

Indicators of Compromise

Repeated worker process ... exited on signal entries in NGINX error.log correlated with HTTP/3 traffic
Unexpected spikes in worker process restarts on hosts serving QUIC listeners on UDP/443
Inbound UDP/443 traffic from unfamiliar sources targeting HTTP/3 endpoints

Detection Strategies

Enable NGINX debug logging on QUIC listeners and inspect for abnormal frame parsing errors preceding worker termination
Correlate process exit events with connection metadata to identify source IPs sending malformed HTTP/3 requests
Deploy network monitoring for anomalous QUIC handshake patterns or malformed HTTP/3 frames on UDP/443

Monitoring Recommendations

Alert on elevated NGINX worker restart counts using process supervision or systemd metrics
Track HTTP/3 request error rates and QUIC connection resets at the load balancer or CDN layer
Capture packet samples on UDP/443 during suspected incidents to support post-event analysis

How to Mitigate CVE-2024-35200

Immediate Actions Required

Inventory NGINX deployments and identify hosts built with --with-http_v3_module or configured with listen ... quic directives
Upgrade NGINX Plus to R31 P2 or R32, and NGINX OSS to the patched version referenced in the F5 advisory
Apply the Fedora updates for Fedora 39 and 40 via dnf upgrade nginx
Restrict inbound UDP/443 exposure to trusted networks until patches are deployed

Patch Information

F5 has released fixed builds documented in F5 Article K000139612. Fedora packages are distributed through the Fedora 39 announcement and the Fedora 40 announcement.

Workarounds

Disable the HTTP/3 QUIC module by removing quic from listen directives and reloading NGINX
Block or rate-limit UDP/443 at the perimeter firewall if HTTP/3 is not required
Rebuild NGINX OSS without the --with-http_v3_module flag where HTTP/3 support is not needed

bash

# Configuration example: disable HTTP/3 QUIC listener in nginx.conf
server {
    # Remove or comment out QUIC listener
    # listen 443 quic reuseport;
    listen 443 ssl;
    http2 on;

    ssl_certificate     /etc/nginx/ssl/server.crt;
    ssl_certificate_key /etc/nginx/ssl/server.key;

    # Remove Alt-Svc advertisement so clients stop attempting HTTP/3
    # add_header Alt-Svc 'h3=":443"; ma=86400';
}

# Reload NGINX after applying changes
sudo nginx -t && sudo nginx -s reload