Executive brief
F5 NGINX Ingress Controller, a tool used to manage external access to services in a Kubernetes cluster, is vulnerable to a denial-of-service attack. An authorized user with permissions to modify network resources can submit a specially crafted configuration that causes the controller to crash repeatedly. This results in a disruption of the management system (control plane), though existing network traffic (data plane) remains unaffected.
Technical details
A NULL pointer dereference vulnerability (CWE-476) exists in the F5 NGINX Ingress Controller when processing Ingress or TransportServer resources. An authenticated remote attacker with write access to these Kubernetes resources can inject malformed data that triggers a process termination. The affected control plane process then enters a persistent crash loop as long as the malformed resource exists in the cluster. This issue affects versions 5.0.0 through 5.5.1 and 2026-lts-r1 through 2026-lts-r2; fixes are available in versions 5.5.2 and 2026-lts-r3.
Affected products
- F5 NGINX Ingress Controller 5.0.0 to 5.5.1, 2026-lts-r1 to 2026-lts-r2
Timeline
- 2026-07-15: advisory: Original publication date