F5 BIG-IP Next CVE-2025-61974

Requires that a client SSL profile be configured on a virtual server (i.e., the device is performing TLS termination for client-side connections) - without this configuration the vulnerable code path is not reached, so default/non-TLS-terminating deployments are not affected. When that condition is met, the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low complexity are needed; the attacker only needs network reachability to the affected virtual server. The specific request content that triggers the leak is undisclosed by the vendor. Products past End of Technical Support were not evaluated, so EoTS versions are outside the assessed scope.

Signals are consistent and point to a moderate, availability-only risk rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated condition, but impact is confined to availability (VA:H; VC:N/VI:N) - consistent with CWE-401 (missing memory release) causing memory exhaustion / denial of service, not code execution or data theft. The 8.7 score is driven entirely by that unauthenticated reachability plus high availability impact. Real-world urgency is tempered: EPSS is low at 0.46% (38th percentile), the CVE is not in CISA KEV, and no public POC is referenced, so this is 'no public exploit identified at time of analysis.' Note the tension between the high CVSS and the low EPSS/absence of KEV - the base score reflects worst-case reachability, while the exploitation probability signals this is not currently seeing opportunistic mass exploitation. One caveat: exploitation is gated on a specific configuration (a client SSL profile bound to a virtual server), which the CVSS base metrics do not capture - verify your deployment uses SSL termination before treating this as unconditionally remote-unauthenticated. The 'Information Disclosure' tag conflicts with the CVSS (VC:N) and CWE-401; this is a resource-exhaustion/DoS issue, not disclosure.

An attacker who can reach a BIG-IP Next virtual server that is configured with a client SSL profile sends a stream of specially crafted (undisclosed) requests that each leak memory the system never reclaims. Sustained over time, memory utilization climbs until the data plane degrades or the service becomes unavailable. No authentication or user interaction is required, but no public exploit code is identified at time of analysis.