The vulnerability is a heap-based buffer overflow that occurs in the NGINX proxy modules when redirecting HTTP/2 traffic. A remote attacker can send oversized HTTP headers while an upstream request is being created if the configuration enables proxy_http_version 2 or grpc_pass, the ignore_invalid_headers directive is off, and the large_client_header_buffers size exceeds two megabytes. The overflow can cause the worker process to crash and restart, and under conditions where Address Space Layout Randomization is disabled or bypassed, can allow arbitrary code execution on the host.

This flaw affects the F5 NGINX Open Source and F5 NGINX Plus products. The specific product versions that are vulnerable are not listed, but any install that is still receiving support and meets the configuration conditions described in the advisory is at risk. End‑of‑support releases are not evaluated by the advisory.

The CVSS score of 9.2 indicates a high‑severity vulnerability, yet the EPSS score of less than 1% suggests a low probability of exploitation on the current date. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote network access to the NGINX server, requiring an ability to send configured HTTP/2 requests with large headers. Successful exploitation could lead to denial of service through worker crashes or, if ASLR is disabled, remote code execution. The attacker can achieve this without authentication but only under the configuration conditions noted above.