F5 BIG-IP CVE-2025-46706

Exploitation is only possible when an iRule containing the HTTP::respond command is configured on a BIG-IP virtual server - this is the exact, mandatory prerequisite named in the description, making the vulnerability dependent on a specific operator-defined traffic-management configuration rather than a default state. On systems without such an iRule, the attack surface does not exist. No authentication is required (PR:N) and no user interaction is needed, so where the condition is met, any remote attacker who can reach the virtual server can attempt exploitation. Impact is limited to availability (memory exhaustion / denial of service); there is no confidentiality or integrity effect. Additionally, software versions that have reached End of Technical Support were not evaluated by the vendor, so EoTS deployments have undetermined status.

This is a denial-of-service vulnerability (CWE-770, uncontrolled resource consumption) in F5 BIG-IP affecting availability only - the vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) rates it 8.7 because it is remotely reachable, low-complexity, and requires no authentication or user interaction, with VA:H but VC:N/VI:N (no confidentiality or integrity impact). The elevated 8.7 score is driven entirely by easy unauthenticated reachability combined with high availability impact; there is no data compromise or code execution. Real-world risk is meaningfully gated by a configuration prerequisite: exploitation only works when an iRule containing the HTTP::respond command is configured on a virtual server, so default or unaffected configurations are not exposed. The EPSS score of 0.43% (36th percentile) indicates low near-term exploitation probability, and there is no CISA KEV listing and no public exploit code identified - signals that are consistent with each other and argue against treating this as an urgent, actively-exploited threat. No SSVC decision record was provided in the input. Net assessment: a legitimately high-CVSS availability issue on a widely deployed appliance, but the real priority is moderate - patch in normal cycles, prioritizing virtual servers known to use HTTP::respond iRules; it is not a drop-everything emergency absent exploitation evidence.

A remote, unauthenticated attacker sends a stream of undisclosed crafted HTTP requests to a BIG-IP virtual server whose iRule invokes the HTTP::respond command, driving progressive memory consumption on the device. Sustained requests exhaust memory resources and degrade or disrupt traffic processing for services fronted by that virtual server. No public proof-of-concept exploit has been identified at time of analysis.