An unauthenticated attacker can exploit NGINX Plus or NGINX Open Source when the ssl_verify_client directive is set to "on" or "optional" and the ssl_ocsp directive is on or leaf parameters use a resolver. By sending specially crafted HTTPS requests, the attacker may trigger a heap‑use‑after‑free error in the NGINX worker process, which can result in limited modification of data or cause the worker process to restart, effectively creating a denial‑of‑service scenario.

The vulnerability affects F5 NGINX Open Source and NGINX Plus installations that use the ngx_http_ssl_module with the conditions described above. No specific version numbers are provided, so all unpatched releases prior to the fix are potentially vulnerable.

The CVSS score of 6.3 indicates a moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. The attack vector is inferred to be remote, via HTTPS requests, since the flaw is triggered by unauthenticated traffic to the SSL module.