Heap-based buffer overflow in F5 Networks products - CVE-2026-15176

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service or execute arbitrary code.

The vulnerability exists due to a heap-based buffer overflow in ngx_http_core_module when handling HTTP requests. A remote attacker can send specially crafted HTTP requests to cause a denial of service or execute arbitrary code.

Exploitation requires a location configured with the alias and rewrite directives together with a set or return directive referencing $request_filename; alternatively, $request_filename can be used in an access log_format directive. Code execution requires ASLR to be disabled or bypassed. Only the data plane is exposed; the control plane is not affected.

Affected software

How to mitigate CVE-2026-15176

External References

• https://my.f5.com/manage/s/article/K000162416

Related Security Bulletins

• Multiple vulnerabilities in nginx