CVE-2026-52865

Analyzed Analyzed - Analysis Complete

Denial-of-Service in NGINX Ingress Controller

Publication date: 2026-07-15

Last updated on: 2026-07-16

Assigner: F5 Networks

Description

When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with permission to create or modify Ingress or TransportServer resources can cause the NGINX Ingress Controller process to terminate. Impact: The NGINX Ingress Controller control plane process terminates and enters a persistent crash loop while the malformed Ingress or TransportServer resource remains in the cluster. This vulnerability allows a remote, authenticated attacker with at least Ingress or TransportServer resource write access to cause a denial-of-service (DoS) on the NGINX Ingress Controller system. There is no data plane exposure; this is a control plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-16

Generated

2026-08-04

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-52865

EUVD

EUVD-2026-44681

Affected Vendors & Products

Vendor	Product	Version / Range
f5	nginx_ingress_controller	From 4.0.0 (inc) to 4.0.1 (inc)
f5	nginx_ingress_controller	From 3.5.0 (inc) to 3.7.2 (inc)
f5	nginx_ingress_controller	From 5.0.0 (inc) to 5.5.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability in NGINX Ingress Controller allows an authenticated remote attacker with write access to Ingress or TransportServer resources to cause the control plane process to crash and enter a persistent crash loop. The issue stems from improper handling of malformed resources, leading to a denial-of-service (DoS) condition.

Detection Guidance

This vulnerability can be detected by monitoring the NGINX Ingress Controller process for unexpected terminations or crash loops. Check logs for errors related to Ingress or TransportServer resource processing. Use commands like 'kubectl get pods -n <namespace>' to verify pod status and 'kubectl logs <pod-name> -n <namespace>' to inspect logs for crash messages.

Impact Analysis

The impact is a DoS on the NGINX Ingress Controller, disrupting traffic routing and management for affected systems. The data plane remains unaffected, but the control plane's failure can cause service disruptions for applications relying on the controller.

Compliance Impact

This vulnerability may impact compliance by causing service unavailability, potentially violating availability requirements in GDPR or HIPAA. Downtime could lead to disruptions in data processing or access, requiring mitigation to maintain regulatory adherence.

Mitigation Strategies

Update NGINX Ingress Controller to the latest patched version to prevent the crash loop caused by malformed Ingress or TransportServer resources.

Hi! I’m here to help you understand CVE-2026-52865. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70