By vendor

F5 vulnerabilities

Known CVEs affecting F5 products, prioritized by severity, with SEC.co remediation and detection guidance.

5 published vulnerabilities

• CVE-2026-11311HIGH 8.1

  NGINX Gateway Fabric contains a configuration injection vulnerability that allows authenticated users with permission to create or modify certain Kubernetes Custom Resources to inject malicious NGINX directives. By crafting specially-formatted values in the serverTokens field (NginxProxy resource) or extraAuthArgs field (AuthenticationFilter resource), an attacker can insert arbitrary configuration that alters how NGINX processes requests. The vulnerability requires valid cluster credentials and appropriate RBAC permissions to exploit, making it a control-plane risk rather than a direct data-plane exposure.

• CVE-2026-42055HIGH 8.1

  NGINX Plus and NGINX Open Source contain a heap buffer overflow vulnerability in their HTTP/2 and gRPC proxy modules. When specific configuration conditions are met—proxy_http_version set to 2 or grpc_pass enabled, ignore_invalid_headers turned off, and large_client_header_buffers exceeding 2MB—an attacker can craft oversized headers to trigger a buffer overflow. This can crash the NGINX worker process or, under certain circumstances (particularly when ASLR is disabled), lead to remote code execution. The vulnerability requires specific configuration and network conditions but poses significant risk to affected deployments.

• CVE-2026-42530HIGH 8.1

  NGINX Open Source contains a vulnerability in its HTTP/3 (QUIC) module that allows remote attackers to trigger a crash in worker processes by sending specially crafted HTTP/3 session packets. Under specific conditions—particularly on systems without ASLR protection or where ASLR has been bypassed—attackers may achieve code execution. The flaw stems from improper memory management when handling QPACK encoder streams, creating a use-after-free condition that can be exploited without authentication.

• CVE-2026-50107HIGH 8.1

  NGINX Gateway Fabric contains a configuration injection vulnerability in how it processes user-supplied access log format settings. When an authenticated user modifies the NginxProxy resource definition, their input is directly inserted into NGINX configuration files without proper validation. An attacker with control-plane access can inject malicious NGINX directives, potentially compromising system integrity and confidentiality. This is a control-plane issue, not a data-plane vulnerability, but it creates a significant security boundary violation for multi-tenant or role-based access control scenarios.

• CVE-2026-32682MEDIUM 6.5

  NGINX Gateway Fabric can be crashed by an authenticated user who has permission to create or modify GRPCRoute resources. By submitting specially crafted GRPCRoute configurations that include certain backendRef filters, an attacker can force the control plane to shut down unexpectedly. This requires valid credentials and explicit permissions on the system, limiting but not eliminating the risk.