CVE-2025-58474: F5 BIG-IP Advanced WAF SSRF Vulnerability

CVE-2025-58474 Overview

CVE-2025-58474 is a denial-of-service vulnerability affecting F5 BIG-IP Advanced Web Application Firewall (WAF) and NGINX App Protect. The flaw is triggered when BIG-IP Advanced WAF runs on a virtual server with Server-Side Request Forgery (SSRF) protection enabled, or when an NGINX server is configured with App Protect Bot Defense. Undisclosed requests processed by these protection features can disrupt new client requests, degrading availability of protected applications. The issue is tracked under [CWE-770] Allocation of Resources Without Limits or Throttling. Software versions that have reached End of Technical Support (EoTS) were not evaluated by the vendor.

Critical Impact
Remote unauthenticated attackers can send crafted requests that disrupt legitimate client traffic passing through BIG-IP Advanced WAF SSRF protection or NGINX App Protect Bot Defense, resulting in availability loss for protected web applications.

Affected Products

F5 BIG-IP Advanced Web Application Firewall (Advanced WAF) with SSRF protection enabled on a virtual server
F5 BIG-IP Application Security Manager (ASM)
NGINX with App Protect Bot Defense configured

Discovery Timeline

2025-10-15 - CVE-2025-58474 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58474

Vulnerability Analysis

The vulnerability resides in two specific request-inspection code paths within F5 security products. On BIG-IP Advanced WAF, the SSRF protection module inspects outbound-style URL parameters and destination indicators inside HTTP requests to detect attempts against internal resources. On NGINX App Protect, the Bot Defense module classifies clients and validates request telemetry before forwarding traffic. Both features process attacker-controlled input during early request handling. When specific undisclosed request patterns reach these modules, request-processing resources are consumed in a way that interferes with servicing of new inbound client connections.

Because the affected features sit on the request-processing hot path, the disruption impacts users beyond the attacker. Legitimate clients attempting to reach the protected virtual server experience delayed or dropped requests while the condition is active. The vulnerability does not expose confidential data and does not permit modification of application data, but it undermines the availability of both the WAF and the application it protects.

Root Cause

The root cause is classified as [CWE-770] Allocation of Resources Without Limits or Throttling. The SSRF protection and Bot Defense code paths do not enforce sufficient bounds on the resources consumed while inspecting certain request shapes. Attacker-supplied input can push the request pipeline into a state where per-request processing cost grows disproportionately, starving new client sessions of processing capacity.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends crafted HTTP requests directly to a virtual server that has SSRF protection enabled on BIG-IP Advanced WAF, or to an NGINX endpoint with App Protect Bot Defense configured. The specific request structure that triggers the condition is not disclosed in the vendor advisory. F5 has published mitigation and version guidance in F5 Technical Article K000148512. No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploitation code is publicly available. Refer to the vendor advisory for technical impact details.

Detection Methods for CVE-2025-58474

Indicators of Compromise

Spikes in BIG-IP TMM CPU utilization or NGINX worker CPU utilization correlated with elevated request rates against WAF-protected virtual servers.
Sudden increases in dropped, reset, or timed-out client TCP connections on virtual servers where SSRF protection or Bot Defense is enabled.
WAF or Bot Defense log entries showing repeated processing of unusual URL-structured parameters or bot-classification requests from a small set of source addresses.
Application front-end latency growth or health-check failures despite the origin servers reporting normal load.

Detection Strategies

Correlate WAF module CPU and memory metrics with per-virtual-server connection statistics to surface resource-exhaustion patterns.
Baseline normal SSRF-protection and Bot Defense inspection rates, then alert on sustained deviations.
Inspect access logs for repeated request patterns that trigger SSRF or Bot Defense evaluation without matching legitimate application flows.

Monitoring Recommendations

Enable verbose logging on the SSRF protection policy and App Protect Bot Defense policy and forward logs to a central SIEM for correlation.
Monitor F5 iHealth diagnostics and NGINX status endpoints for connection queue growth and worker saturation.
Track availability SLOs of applications behind the WAF so that request-service degradation surfaces quickly.

How to Mitigate CVE-2025-58474

Immediate Actions Required

Review F5 Technical Article K000148512 to identify fixed versions applicable to your BIG-IP Advanced WAF, ASM, or NGINX App Protect deployment.
Upgrade affected instances to a version listed as fixed by F5. Versions that have reached End of Technical Support were not evaluated and should be replaced.
Rate-limit inbound traffic to virtual servers that use SSRF protection or Bot Defense while patching is scheduled.
Restrict source networks permitted to reach externally exposed WAF virtual servers where business requirements allow.

Patch Information

F5 has published fixed software versions in F5 Technical Article K000148512. Administrators should confirm the fixed release for their specific product edition (BIG-IP Advanced WAF, BIG-IP ASM, or NGINX App Protect) and apply the vendor-recommended upgrade. Software builds beyond End of Technical Support are not evaluated by F5 and require migration to a supported branch.

Workarounds

Where SSRF protection is not required for a given virtual server, disable the SSRF protection feature on that virtual server until a fixed version is deployed.
Where App Protect Bot Defense is not required, disable Bot Defense on the affected NGINX server until patched.
Apply upstream rate limiting or connection limits at a load balancer or CDN to reduce the volume of requests reaching the WAF inspection path.

bash

# Configuration example
# Refer to F5 Technical Article K000148512 for authoritative guidance.
# Vendor advisory: https://my.f5.com/manage/s/article/K000148512