Read the docs
TI-2022-15921 Aliases CVE-2022-35241GHSA-cxjf-pr27-7q48

NGINX Instance Manager vulnerability CVE-2022-35241

Priority LOW 30CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

In versions 2.x before 2.3.1 and all versions of 1.x, when NGINX Instance Manager is in use, undisclosed requests can cause an increase in disk resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Why it matters now

EPSS 0.00758 55th percentileScored 2026-11-07
Fix Fixed NGINX Instance Manager (F5): 2.3.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
F5NGINX Instance Manager2.x to before 2.3.1; 1.0.0 and later2.3.1Patch availableCNA
  • NGINX Instance Manager VendorF5 Affected 2.x to before 2.3.1; 1.0.0 and later Fixed in 2.3.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:*1.0.0 – 1.0.4; 2.0.0 to before 2.3.1VulnerableF5
  • cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:* Versions 1.0.0 – 1.0.4; 2.0.0 to before 2.3.1 Vulnerable ·F5

Remediation

  • Fix · CNA NGINX Instance Manager (F5) Fixed in 2.3.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-35241
  2. 2026-10-03 Alias added: GHSA-cxjf-pr27-7q48

References

Advisory 1

  • TI-2026-31136 NGINX ngx_http_rewrite_module vulnerability CVSS 4.0CRITICAL 9.2
  • TI-2026-08132 NGINX ngx_http_rewrite_module vulnerability CVSS 4.0CRITICAL 9.2
  • TI-2026-30812 NGINX Open-Source ngx_http_v3_module vulnerability CVSS 4.0CRITICAL 9.2
  • TI-2026-30432 NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability CVSS 4.0CRITICAL 9.2
  • TI-2026-42786 NGINX ngx_http_slice_module vulnerability CVSS 4.0HIGH 8.8
  • TI-2026-31137 NGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerability CVSS 4.0HIGH 8.3
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences