F5 BIG-IP CVE-2025-59781

Exploitable only when the DNS cache feature is configured on a BIG-IP or BIG-IP Next CNF virtual server; the vulnerable code path is not reachable without this non-default DNS-caching configuration. Where configured, the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation requiring no user interaction against the DNS-serving virtual server. Limiting factors: the feature must be enabled, the attacker must be able to deliver DNS queries to that virtual server, and software versions past End of Technical Support were not evaluated (status unknown).

This is a remote, unauthenticated availability (resource-exhaustion) flaw in F5 BIG-IP / BIG-IP Next CNF, not an information disclosure issue despite the 'Information Disclosure' tag. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network-reachable, low-complexity, no-auth, no-interaction exploitation, and the impact profile (VC:N/VI:N/VA:H) shows the sole effect is availability - consistent with CWE-459 (Incomplete Cleanup) and the description's 'increase in memory resource utilization.' The 8.7 score is driven entirely by availability. Real-world risk is moderated by two signals: exploitation requires the DNS cache feature to be configured on a virtual server (a non-default, specific deployment mode), and EPSS is low at 0.35% (27th percentile). There is no CISA KEV listing and no public POC, so this is not confirmed to be actively exploited. Net: a credible denial-of-service risk for environments that actually run DNS caching on BIG-IP, but not an across-the-board emergency - prioritize patching on DNS-caching virtual servers, treat others as lower urgency.

An attacker who can send DNS traffic to a BIG-IP virtual server configured with DNS cache issues a stream of specially crafted (undisclosed) DNS queries that are not properly cleaned up, steadily consuming device memory. As memory exhausts, DNS resolution and potentially co-located services degrade or fail, causing a denial of service. No public exploit code or active exploitation has been identified at time of analysis.