CVE-2025-1695
📋 TL;DR
This vulnerability in NGINX Unit with the Java Language Module allows remote attackers to send specific requests that trigger an infinite loop, causing high CPU usage and potential denial-of-service. It affects NGINX Unit versions before 1.34.2 when the Java module is enabled. Only the data plane is exposed, not the control plane.
💻 Affected Systems
- NGINX Unit
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service degradation due to CPU exhaustion, making the application unavailable to legitimate users.
Likely Case
Performance degradation and intermittent service disruptions under sustained attack.
If Mitigated
Minimal impact with proper monitoring and rate limiting in place.
🎯 Exploit Status
Attack requires sending specific requests to the Java module endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.34.2
Vendor Advisory: https://my.f5.com/manage/s/article/K000149959
Restart Required: Yes
Instructions:
1. Download NGINX Unit 1.34.2 or later from official sources. 2. Stop the NGINX Unit service. 3. Install the updated version. 4. Restart the NGINX Unit service.
🔧 Temporary Workarounds
Disable Java Module
allTemporarily disable the Java Language Module if not required
Edit NGINX Unit configuration to remove or disable Java module settings
Restart NGINX Unit service
Implement Rate Limiting
allConfigure rate limiting at network or application level to limit request frequency
Configure rate limiting in NGINX Unit or upstream proxy
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit access to Java module endpoints
- Deploy monitoring and alerting for abnormal CPU usage patterns
🔍 How to Verify
Check if Vulnerable:
Check if NGINX Unit version is below 1.34.2 and Java module is enabled in configurationCheck Version:
unitd --versionVerify Fix Applied:
Verify NGINX Unit version is 1.34.2 or higher and test Java module functionality📡 Detection & Monitoring
Log Indicators:
- Unusually high number of requests to Java endpoints
- Extended request processing times
Network Indicators:
- Sustained high-volume traffic to Java module ports
- Abnormal request patterns to Java endpoints
SIEM Query:
source="nginx-unit" AND (message="*java*" OR message="*high cpu*")