CVE-2025-58474CWE-770denial-of-service

CVE-2025-58474

Medium · published October 15, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
31.7
In the wild
Unconfirmed
What it is

When BIG-IP Advanced WAF is configured on a virtual server with Server-Side Request Forgery (SSRF) protection or when an NGINX server is configured with App Protect Bot Defense, undisclosed requests can disrupt new client requests.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00388 · 31.7th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2025-10-15T18:15Z
Affected products (2)
ProductVersionsFixed in
f5/big-ip_advanced_web_application_firewall≥ 17.1.0, < 17.1.217.1.2
f5/big-ip_application_security_manager≥ 17.1.0, < 17.1.217.1.2
References (1)
https://my.f5.com/manage/s/article/K000148512 · [email protected]
EPSS history
Timeline
  • 15 OCT 13:55Z
    BIG-IP Advanced WAF and ASM and NGINX App Protect DNS lookup vulnerability
    cvelistv5