Technical impact
This vulnerability allows an authenticated, remote attacker who can create or modify GRPCRoute resources in NGINX Gateway Fabric to send specially crafted GRPCRoute configurations that contain backendRef filters. The control plane parses these configurations and, due to undisclosed parsing logic errors, terminates, effectively rendering the gateway unavailable. The attack grants the ability to stop traffic routing for the whole control plane rather than just injecting malicious traffic. The weakness corresponds to CWE‑129, indicating potential integer overflow or wrap‑around issues during configuration parsing.
Affected Systems
The affected product is F5’s NGINX Gateway Fabric. No specific version numbers are listed in the advisory; however, any installation that supports GRPCRoute configuration is potentially impacted. End‑of‑Technical‑Support releases are not evaluated, so only supported, actively maintained versions should be considered.
Risk and Exploitability
The CVSS score of 7.1 classifies the vulnerability as medium‑to‑high severity. The EPSS score is less than 1%, suggesting a low probability of exploitation at this time. Because the issue is not listed in the CISA KEV catalog, there is no evidence of active exploitation, though the attack vector requires authenticated access to GRPC resources. Even with low exploitation probability, the impact of control‑plane failure can be critical for services relying on the gateway, making timely remediation important.
