Main Vulnerability Database Vulnerabilities #VU155772

Use-after-free in F5 Networks products - CVE-2026-97205

Published: October 14, 2026

Vulnerability identifier: #VU155772

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-97205

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service, corrupt memory, or potentially execute arbitrary code.

The vulnerability exists due to use-after-free in ngx_http_core_module when processing server side includes (SSI) pages containing include virtual commands. A remote attacker can trigger processing of such pages to cause a denial of service, corrupt memory, or potentially execute arbitrary code.

Exploitation requires asynchronous file I/O (AIO) to be enabled in certain configurations. Code execution requires address space layout randomization (ASLR) to be disabled or bypassed. The issue affects only the data plane; there is no control plane exposure.

Affected software

NGINX Open Source
NGINX Instance Manager
NGINX Ingress Controller
NGINX Plus
NGINX Gateway Fabric
NGINX App Protect DoS
F5 DoS for NGINX
NGINX App Protect WAF
F5 WAF for NGINX

How to mitigate CVE-2026-97205

Install security update from vendor's website.

NGINX Open Source - addressed in versions 1.30.6, 1.31.7
NGINX Gateway Fabric - update to 2.8.0
NGINX Instance Manager - update to 2.24.0
F5 DoS for NGINX - update to 4.11.0
NGINX Ingress Controller - update to 5.7.0
F5 WAF for NGINX - addressed in versions 5.14.2, 5.16.0
NGINX Plus - addressed in versions 37.0.5.1, 37.1.0.1

External References

https://my.f5.com/manage/s/article/K000162608

Related Security Bulletins