F5 released patches for CVE-2024-6533, a critical vulnerability in nginx that allows remote attackers to trigger a heap buffer overflow in worker processes. The flaw affects nginx versions before 1.30.4 (stable branch) and 1.31.3 (mainline), as well as NGINX Plus versions before 37.0.3.1.
An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests to a vulnerable nginx instance. The heap buffer overflow can crash or restart worker processes, resulting in denial of service. F5 has not publicly disclosed evidence of remote code execution, though the buffer overflow nature of the vulnerability presents potential execution risks depending on heap layout and exploitation technique.
Organizations running nginx as a reverse proxy, load balancer, or web server face immediate risk. Any internet-facing nginx deployment running unpatched versions becomes a target for exploitation. The attack requires no authentication and no user interaction, making it trivially exploitable at scale.
F5 released patches on July 15 across all affected versions. Administrators should prioritize upgrades to nginx 1.30.4, 1.31.3, or NGINX Plus 37.0.3.1 depending on their deployment model. For organizations unable to patch immediately, network segmentation and request filtering can temporarily reduce exposure, though patching remains the only reliable mitigation.
The timing of this disclosure aligns with responsible disclosure practices, giving organizations a window to deploy fixes before active exploitation. Given the simplicity of triggering denial of service and the critical CVSS severity rating, threat actors will likely attempt mass exploitation against unpatched nginx instances within weeks.