F5 NGINX Plus prior 37.0.3.1/R36 P7 MQTT Filter heap-based overflow

Summaryinfo

A vulnerability was found in F5 NGINX Plus. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component MQTT Filter Module. Such manipulation leads to heap-based overflow. This vulnerability is referenced as CVE-2026-60065. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in F5 NGINX Plus. Affected by this issue is some unknown processing of the component MQTT Filter Module. The manipulation with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is availability. CVE summarizes:

When NGINX Plus is configured to use the Message Queuing Telemetry Transport (MQTT) filter module (ngx_stream_mqtt_filter_module), unauthenticated attackers can send requests with conditions beyond the attacker's control to cause a heap buffer over-read in the NGINX worker process, leading to a restart. Impact: This vulnerability may allow remote unauthenticated attackers to have limited control to restart the NGINX worker process. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The advisory is shared for download at my.f5.com. This vulnerability is handled as CVE-2026-60065 since 07/08/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/15/2026).

Upgrading to version 37.0.3.1 or R36 P7 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Web Server

Vendor

• F5

Name

• NGINX Plus

License

• commercial

Website

• Vendor: https://f5.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion