F5 BIG-IP ASM CVE-2025-55669
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach HTTP/2-enabled virtual server over network
-
ExploitSend crafted undisclosed HTTP/2 traffic
-
ExecutionTrigger resource-release flaw in TMM
-
ImpactCrash Traffic Management Microkernel (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Operation on resource after expiration or release
|
| Exploitation Conditions | Exploitable only when a virtual server is configured with BOTH an Advanced WAF/ASM security policy AND a server-side HTTP/2 profile simultaneously - this specific combination is the required precondition, so devices without a bound WAF/ASM policy or without server-side HTTP/2 are not affected. Within that configuration, no further limits apply: the CVSS vector (PR:N/UI:N/AV:N) confirms unauthenticated remote attackers can trigger it without user interaction. Software versions that have reached End of Technical Support (EoTS) were not evaluated by the vendor and may carry unassessed exposure. |
| Impact | This is a remote, unauthenticated availability (denial-of-service) vulnerability - the F5-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network reachability with no privileges or user interaction, while the impact metrics (VC:N/VI:N/VA:H, SA:L) show pure availability loss with no confidentiality or integrity impact. CWE-672 (operation on a resource after expiration/release) is consistent with a crash of the Traffic Management Microkernel (TMM) rather than code execution or data exposure. The 8.7 score is driven entirely by the ease of remote triggering plus total loss of availability, NOT by a severe technical impact class. Real-world risk is moderate and strongly gated by configuration: the flaw only manifests when BOTH an Advanced WAF/ASM security policy AND a server-side HTTP/2 profile are bound to the same virtual server, so it is not a blanket default-config exposure. Corroborating signals point to lower urgency: EPSS is only 0.38% (30th percentile), there is no CISA KEV listing, and no public exploit code was identified - so despite the high CVSS, this is a DoS-only issue with no evidence of active or imminent exploitation. Note a tag conflict: the input Tags label this 'Information Disclosure,' which directly contradicts the CVSS vector (VC:N, VA:H) and the description (TMM termination) - this is a denial-of-service issue, not information disclosure. No SSVC/POC data was provided to further weight the decision. |
| Exploit ScenarioDerived | An attacker with network access to a BIG-IP virtual server that has both an Advanced WAF/ASM policy and a server-side HTTP/2 profile sends specially crafted (undisclosed) HTTP/2 traffic. The malformed traffic triggers a use-after-release condition that causes TMM to terminate, dropping all traffic the device is processing until it restarts. No public exploit code was identified at time of analysis, and no authentication or user interaction is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
A configuration-dependent denial-of-service vulnerability in F5 BIG-IP Application Security Manager (ASM) and BIG-IP Advanced WAF allows unauthenticated remote attackers to crash the Traffic Management Microkernel (TMM), disrupting traffic on the affected virtual server. Exploitation requires a specific prerequisite configuration: a virtual server must have BOTH an Advanced WAF/ASM security policy and a server-side HTTP/2 profile bound simultaneously; virtual servers lacking either element are not affected. The F5-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:N/VI:N/VA:H) confirms network reachability with no privileges or user interaction and pure availability impact, with no public exploit identified at time of analysis and a low EPSS score of 0.38% (30th percentile).
RemediationAI
No vendor-released patch version is identifiable from the provided data; consult F5 advisory K000150752 (https://my.f5.com/manage/s/article/K000150752) for the fixed BIG-IP releases and upgrade to a supported, non-EoTS branch, since end-of-support versions were not evaluated and will not receive fixes. Until an upgrade can be scheduled, the most effective compensating control is to break the required precondition on exposed virtual servers: either remove the server-side HTTP/2 profile (falling back to HTTP/1.1 toward pool members, at the cost of losing HTTP/2 multiplexing and header-compression performance benefits) or unbind the ASM/Advanced WAF security policy from that virtual server (which sacrifices WAF protection and should only be done on virtual servers where the DoS risk outweighs the inspection requirement). Because exploitation is remote and unauthenticated, additionally constrain reachability - restrict the affected virtual server with network ACLs or upstream firewalls so only trusted client networks can connect - and monitor TMM restart events or failover activity as an indicator of attempted triggering. If neither profile nor policy can be removed, isolate the affected virtual server from business-critical traffic so a TMM restart does not cascade into service-wide outages.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified under CWE-672 (Operation on a Resource after Expiration or Release), indicating a lifecycle/use-after-release style defect in the Traffic Management Microkernel - F5 BIG-IP's user-space data-plane process responsible for terminating connections, running protocol stacks, and enforcing security policies. The trigger combines two distinct code paths: the ASM/Advanced WAF inspection engine (which parses and validates HTTP traffic against security policies) and the server-side HTTP/2 profile (which governs BIG-IP's HTTP/2 connection toward backend pool members, including stream and header handling). When both are attached to the same virtual server, undisclosed traffic causes TMM to dereference or operate on a resource that has already been released, terminating the TMM process. The affected component is tracked under CPE cpe:2.3:a:f5:big-ip_application_security_manager, so exposure is scoped to BIG-IP platforms licensed and configured with ASM/Advanced WAF rather than the base BIG-IP product alone. F5 notes that software versions which have reached End of Technical Support (EoTS) were not evaluated and therefore carry unassessed risk.
Know when Big Ip Application Security Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Remote unauthenticated HTTP/2 traffic with no interaction (AV:N/AC:L/PR:N/UI:N); the config requirement is environmental, not attack complexity; impact is availability-only (A:H), no confidentiality/integrity loss.
Primary rating from Vendor (f5).
CVSS VectorVendor: f5
DescriptionCVE.org
When the BIG-IP Advanced WAF and ASM security policy and a server-side HTTP/2 profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Executive ViewAI
F5 BIG-IP Application Security Manager (ASM) and BIG-IP Advanced WAF are affected by a high-severity, configuration-dependent denial-of-service vulnerability that unauthenticated remote attackers can exploit to crash the Traffic Management Microkernel (TMM), disrupting traffic on virtual servers that simultaneously bind both an ASM/Advanced WAF security policy and a server-side HTTP/2 profile. With no public exploit identified at time of analysis and no vendor patch available, the risk of service outages on critical applications remains, particularly for organizations relying on these F5 products for application delivery and security. Leadership should ensure that security and network teams prioritize assessing exposure and implementing interim controls to maintain availability.
No vendor-released patch identified at time of analysis. Interim mitigations include removing either the Advanced WAF/ASM security policy or the server-side HTTP/2 profile from affected virtual servers, or disabling HTTP/2 entirely if not required, to break the prerequisite configuration. Additionally, monitor TMM crash logs and restrict network access to affected virtual servers where possible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, a
The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver a
F5 BIG-IP APM (Access Policy Manager) contains a remote code execution vulnerability triggered by specific malicious tra
The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5
A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may
F5 BIG-IP contains an authenticated command injection in the iControl REST API and TMOS Shell (tmsh) save command. Authe
Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BI
GitHub PoC
Exploit-DB