This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] F5 fixes 5 vulnerabilities in various products

F5 fixes 5 vulnerabilities in various products. The most severe ones are described below; the remaining ones can be found at [1]. Fixed versions of individual products: BIG-IP Advanced WAF/ASM [2] - 17.1.3 NGINX Plus [3] - R36 P2, R35 P1, R32 P4 NGINX Open Source [3] - 1.29.5, 1.28.2 NGINX Ingress Controller [3] - 5.3.3 NGINX Gateway Fabric [3] - 2.4.1 BIG-IP Container Ingress Services (Kubernetes and OpenShift) [4] - 2.20.2 (or 2.20.1 with Helm in version 0.0.36)

BIG-IP Advanced WAF/ASM - DoS (CVE-2026-22548)
CVSS 8.2 (High)

Allows an unauthenticated remote attacker, under certain conditions and due to a race condition vulnerability in BIG-IP Advanced WAF/ASM, to restart the bd process and potentially carry out a DoS attack on the system [2]. If it is not possible to update to a fixed version immediately, it is recommended, as a temporary mitigation of the impact of potential exploitation, to configure the system in high availability (HA) mode [5][6].

The vulnerability is present in products:

  • BIG-IP Advanced WAF; >=17.1.0, <=17.1.2;
  • BIG-IP Advanced ASM; >=17.1.0, <=17.1.2;

CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

More information:

  • CVE-2026-22548 at cve.org, NVD
  • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') at cwe.mitre.org

The vulnerability was publicly disclosed 4. 2. 2026.

NGINX Plus, Open Source, Ingress Controller, Gateway Fabric, Instance Manager - response injection (CVE-2026-1642)
CVSS 8.2 (High)

Allows an unauthenticated remote attacker in a MITM position between an NGINX proxy server (Plus/Open Source) and upstream TLS servers to inject their own plain-text data into responses sent to clients under certain conditions [3].

The vulnerability is present in products:

  • NGINX Plus; >=R32, <=R36 P1;
  • NGINX Open Source; >=1.3.0 <=1.29.4;
  • NGINX Ingress Controller; >=3.4.0, <=3.7.2; >=4.0.0, <=4.0.1; >=5.0.0, <=5.3.2;
  • NGINX Gateway Fabric; >=1.2.0, <=1.6.2; >=2.0.0, <=2.4.0;
  • NGINX Instance Manager; >=2.15.1, <=2.21.0;

CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 4. 2. 2026.

BIG-IP Container Ingress Services (Kubernetes, OpenShift) - unauthorized read (CVE-2026-22549)
CVSS 6.9 (Medium)

Allows an authenticated remote attacker with elevated privileges in BIG-IP Container Ingress Services for Kubernetes and OpenShift to read sensitive data (secrets) within the cluster without authorization [4].

The vulnerability is present in product:

  • BIG-IP Container Ingress Services; >=1.0.0, <=1.14.0; >=2.0.0, <2.20.2;

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 4. 2. 2026.

By CESNET, z.s.p.o. Michaela Ručková on 12. 2. 2026.

CESNET, z.s.p.o. Logo