CVE-2026-52865: nginx ingress controller from 3.5.0 (inclusive), through 3.7.2 (inclusive), from 4.0.0 (inclusive), through 4.0.1…

Affected technology

nginx ingress controller · from 3.5.0 (inclusive), through 3.7.2 (inclusive)
f5

nginx ingress controller · from 4.0.0 (inclusive), through 4.0.1 (inclusive)
f5

nginx ingress controller · from 5.0.0 (inclusive), before 5.5.2 (exclusive)
f5

NGINX Ingress Controller · 5.0.0 to before 5.5.2, 2026-lts-r1 to before 2026-lts-r3
F5

Component: Ingress, TransportServer

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

A remote, authenticated attacker with at least Ingress or TransportServer resource write access can cause a denial-of-service (DoS) on the NGINX Ingress Controller system. Vendor/CNA’s CVSS 4.0 assessment (base score 7.1/10) rates confidentiality and integrity impact as none; availability impact as high.