This vulnerability involves improper memory allocation handling in the ngx_http_scgi_module and ngx_http_uwsgi_module of F5 NGINX Plus (versions R32 and R36). When configured with scgi_pass or uwsgi_pass, an attacker capable of intercepting and modifying upstream server responses (MITM) may trigger excessive memory allocation or cause an over-read of the NGINX worker process memory. This can result in partial memory disclosure or cause the worker process to restart, impacting availability. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, high confidentiality impact, no integrity impact, and low availability impact. The vulnerability is tracked as CWE-789 (Memory Allocation with Excessive Size Value) and CWE-823 (Use of Out-of-bounds Pointer). There is no vendor advisory or patch available at this time, and the product is not a cloud service.

An attacker with man-in-the-middle capability can exploit this vulnerability to read memory from the NGINX worker process or cause it to restart, potentially leading to information disclosure and temporary denial of service. The impact on confidentiality is high, while integrity is unaffected and availability impact is low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider mitigating the risk by restricting network paths to prevent man-in-the-middle attacks on upstream server communications or disabling the affected modules if not in use. Monitor vendor channels for updates and apply patches promptly once available.