F5-K000162101: Low severity F5 NGINX Plus vulnerability
Published Jul 15, 2026
·Updated
When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngxstreammqttfiltermodule), unauthenticated attackers can send requests with conditions beyond the attacker's control to cause a heap buffer over-read in the NGINX worker process, leading to a restart.
Affected Software
10 affected componentsFixes available
F5 NGINX Plus>=37.0.0.1<=37.0.2.1
37.0.3.1
F5 NGINX Plus=33
36
F5 F5 WAF for NGINX>=5.9.0<=5.13.3
5.13.4
F5 NGINX App Protect WAF>=5.2.0<=5.8.0
F5 NGINX App Protect WAF>=4.11.0<=4.16.0
F5 NGINX Gateway Fabric>=2.0.0<=2.6.6
2.6.7
F5 NGINX Gateway Fabric>=1.3.0<=1.6.2
F5 NGINX Ingress Controller>=1<=2026, =2026, >=5.0.0<=5.5.2
2026-
F5 NGINX Ingress Controller>=4.0.0<=4.0.1
F5 NGINX Ingress Controller>=3.5.0<=3.7.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 37.0.3.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 36 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.13.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.6.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026-
Event History
Jul 15, 2026
Advisory Published
via F5·01:44 PM
Data Sourced
via F5·01:44 PM
DescriptionSeverityWeaknessAffected Software