BIG-IP
CVE-2025-58474: BIG-IP Advanced WAF and ASM and NGINX App Protect DNS lookup vulnerability
When BIG-IP Advanced WAF is configured on a virtual server with Server-Side Request Forgery (SSRF) protection or when an NGINX server is configured with App Protect Bot Defense, undisclosed requests can disrupt new client requests.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| BIG-IP 15.1, 16.1, 17.5 | Not affected |
| BIG-IP 17.1 | 17.1.2 or later |
| NGINX App Protect WAF 5.0 | Not affected |
| NGINX App Protect WAF 4.0 | 4.7.0 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
When BIG-IP Advanced WAF is configured on a virtual server with Server-Side Request Forgery (SSRF) protection or when an NGINX server is configured with App Protect Bot Defense, undisclosed requests can disrupt new client requests. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 12 Oct 2026.