PT-2025-42341 · F5 · F5 Nginx+1

Published 2025-10-15 · Updated 2025-10-22 · CVE-2025-58474

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions (affected versions not specified) F5 NGINX versions (affected versions not specified)

Description When BIG-IP Advanced WAF is configured on a virtual server with Server-Side Request Forgery (SSRF) protection, or when an NGINX server is configured with App Protect Bot Defense, undisclosed requests can disrupt new client requests. Server-Side Request Forgery (SSRF) is a web security flaw that allows an attacker to cause the server to make HTTP requests to an arbitrary domain of the attacker's choosing.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2025-58474

Affected Products

F5 Big-Ip

F5 Nginx

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-58474 · Security Note
• https://osv.dev/vulnerability/CVE-2025-58474 · Vendor Advisory
• https://my.f5.com/manage/s/article/K000148512 · Vendor Advisory
• https://t.me/cveNotify/139953 · Telegram Post
• https://twitter.com/CVEnew/status/1978545093490753782 · Twitter Post