The vulnerability is a use‑after‑free in the NGINX Open Source ngx_http_v3_module. An unauthenticated attacker can craft a special HTTP/3 session to reopen a QPACK encoder stream, which leads to use of uninitialized memory inside the worker process. When Address Space Layout Randomization is disabled or bypassed, this flaw can be turned into code execution on the affected system.

Affects all NGINX Open Source installations provided by F5 that enable the HTTP/3 QUIC module and load the ngx_http_v3_module. No specific product version is listed, but any instance configured with the module is potentially vulnerable. End‑of‑support releases are not evaluated and therefore are considered outside the scope of this assessment.

The CVSS score of 9.2 indicates a high‑severity weakness, but the EPSS score of 2% indicates exploitation is unlikely and low probability. The flaw is not listed in CISA’s KEV catalog. Attackers must be able to send malicious HTTP/3 traffic and control the QUIC connection; they also need the target to be running with ASLR disabled or to bypass ASLR to gain code‑execution capability.