BIG-IP Advanced WAF CVE-2025-61938

Requires a BIG-IP Advanced WAF or ASM security policy with Data Guard Protection Enforcement configured to contain a URL exceeding 1024 characters - introduced either by an administrator manually or automatically by Policy Builder learning. It is not exploitable against a default BIG-IP that lacks a Data Guard-enabled WAF/ASM policy. Remote attacker-driven exploitation realistically depends on Policy Builder running in automatic learning mode so an oversized URL from traffic is learned into the setting; otherwise the condition is operator-created. Software versions past End of Technical Support were not evaluated by the vendor.

This is a denial-of-service vulnerability (CWE-1284, improper input validation), not an information disclosure issue despite the tag. The F5-assigned CVSS 4.0 vector scores it 8.7 with VA:H and VC:N/VI:N - confirming availability-only impact (the bd traffic-processing daemon terminates repeatedly). The vector claims AV:N/AC:L/PR:N (remote, unauthenticated, low complexity), but the description states the crash occurs when a policy 'is configured with a URL greater than 1024 characters' for Data Guard Protection Enforcement - a configuration-dependent trigger, either set manually (implying admin/PR:H) or auto-learned by Policy Builder. This is a meaningful tension: the PR:N/AC:L rating only holds if an attacker can get an oversized URL auto-learned into the Data Guard setting via Policy Builder in automatic mode, which is a non-default, condition-specific path - verify the exploitation path with F5. EPSS is low (0.35%, 26th percentile), there is no CISA KEV listing and no public exploit identified, consistent with a config-triggered stability bug rather than a widely weaponized flaw. Net: real but bounded priority - patch on normal cadence for exposed BIG-IP WAF/ASM units, not an emergency unless Data Guard with Policy Builder automatic learning is in use.

On a BIG-IP running Advanced WAF/ASM with Data Guard Protection Enforcement and Policy Builder in automatic learning mode, an attacker repeatedly sends HTTP requests containing a URL longer than 1024 characters; Policy Builder learns the oversized URL into the policy, after which the bd process crashes and restarts in a loop, disrupting traffic inspection. No public exploit code has been identified at time of analysis, and the simpler path is an administrator manually configuring such a URL, which self-inflicts the same crash.