Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-58474: BIG-IP Advanced WAF and NGINX App Protect: Malicious requests can block legitimate traffic

CVE-2025-58474 · published 1 year ago

Summary

Certain configurations of BIG-IP's Advanced Web Application Firewall and NGINX's App Protect Bot Defense can allow malicious requests to disrupt new client requests. This means that your website or service may become unavailable to legitimate users. To protect against this, ensure you have the latest software updates installed and review your configuration settings.

What to do

Update f5 big-ip_advanced_web_application_firewall to version 17.1.2 or later.
Update f5 big-ip_application_security_manager to version 17.1.2 or later.

Affected software

Vendor	Product	Affected versions
f5	big-ip_advanced_web_application_firewall	>= 17.1.0, < 17.1.2 `cpe:2.3:a:f5:big-ip_advanced_web_application_firewall::::::::`
f5	big-ip_application_security_manager	>= 17.1.0, < 17.1.2 `cpe:2.3:a:f5:big-ip_application_security_manager::::::::`

Original advisory text

When BIG-IP Advanced WAF is configured on a virtual server with Server-Side Request Forgery (SSRF) protection or when an NGINX server is configured with App Protect Bot Defense, undisclosed requests can disrupt new client requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

References

https://my.f5.com/manage/s/article/K000148512 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

6.9 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-770Allocation of Resources Without Limits

Timeline

Published15 Oct 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-58474 · NVD

Track software like this

Free during beta