What’s Vulnerable › Vulnerabilities

CVE-2020-5416: CF clusters with NGINX in front of them may be vulnerable to DoS

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-08-21 · updated 2026-06-17
• Weakness: CWE-404

Description

Cloud Foundry Routing (Gorouter), versions prior to 0.204.0, when used in a deployment with NGINX reverse proxies in front of the Gorouters, is potentially vulnerable to denial-of-service attacks in which an unauthenticated malicious attacker can send specially-crafted HTTP requests that may cause the Gorouters to be dropped from the NGINX backend pool.

Affected products

• Cloud Foundry cf-deployment: before 13.13.0 — fixed in 13.13.0
• Cloudfoundry Routing-Release: before 0.204.0 — fixed in 0.204.0

How to fix

Upgrade to a fixed version: Cloud Foundry cf-deployment 13.13.0; Cloudfoundry Routing-Release 0.204.0. Check the vendor advisory for mitigations.

References

• https://www.cloudfoundry.org/blog/cve-2020-5416
• https://www.cloudfoundry.org/blog/cve-2020-5416

Get alerted when CVE-2020-5416 or the next vulnerability affects your stack