CVE-2025-58474

BIG-IP Advanced WAF and ASM and NGINX App Protect DNS lookup vulnerability

State: Published
Severity: 6.9 Medium
Published: Oct 15, 2025
Updated: Feb 26, 2026
Reserved: Oct 6, 2025

Description

When BIG-IP Advanced WAF is configured on a virtual server with Server-Side Request Forgery (SSRF) protection or when an NGINX server is configured with App Protect Bot Defense, undisclosed requests can disrupt new client requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L	f5
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	f5

Weaknesses

CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

Product	Versions
BIG-IPF5	17.5.0 and laterNot affected 17.1.0 to before 17.1.2Affected 16.1.0 and laterNot affected 15.1.0 and laterNot affected
NGINX App Protect WAFF5	5.0.0 and laterNot affected 4.0.0 to before 4.7.0Affected

References

https://my.f5.com/manage/s/article/K000148512vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.