Skip to main content

F5 BIG-IP CVE-2026-34019

| EUVDEUVD-2026-29963 MEDIUM
Insufficient Resource Pool (CWE-410)
2026-05-13 f5 GHSA-996c-hhrm-w2q5
Information Disclosure Big Ip
6.3
CVSS 4.0 · Vendor: f5
Share

Severity by source

Vendor (f5) PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
CVSS changed
May 13, 2026 - 16:22 NVD
5.3 (MEDIUM) 6.3 (MEDIUM)
Analysis Generated
May 13, 2026 - 15:52 vuln.today
CVE Published
May 13, 2026 - 14:12 nvd
MEDIUM 5.3

DescriptionCVE.org

When Bidirectional Forwarding Detection (BFD) is configured in Static and Dynamic routing protocols, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to stop processing BFD packets and cause the configured routing protocol to fail over.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Denial of service in F5 BIG-IP affects the Traffic Management Microkernel (TMM) when Bidirectional Forwarding Detection (BFD) is configured with static or dynamic routing protocols. Undisclosed traffic patterns cause TMM to stop processing BFD packets, triggering unintended failover of the configured routing protocol. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft undisclosed traffic pattern
Delivery
Send traffic to BIG-IP over network
Exploit
TMM fails to validate/handle traffic
Execution
BFD packet processing halts
Persist
Routing protocol detects BFD timeout
Impact
Failover event triggered
Sign in to reveal

Vulnerability AssessmentAI

Exploitation BFD must be configured in the BIG-IP system as part of static or dynamic routing protocol configuration. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment CVSS 5.3 with vector AV:N/AC:L/PR:N/UI:N indicates network-accessible denial of service with low attack complexity and no authentication required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker on the network sends a stream of crafted or undisclosed traffic patterns to a BIG-IP system configured with BFD for routing failover. The TMM packet processor fails to properly handle the traffic, stops processing legitimate BFD packets, and the routing protocol detects the loss of BFD heartbeats, triggering failover to a secondary device. …
Remediation Apply the vendor-released patch from F5 advisory K000150508 (https://my.f5.com/manage/s/article/K000150508) to affected BIG-IP systems. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Big Ip

View all
CVE-2026-41957 HIGH
8.7 May 13

Remote code execution in F5 BIG-IP and BIG-IQ Configuration utility allows authenticated attackers with low privileges t
CVE-2026-39455 HIGH
8.7 May 13

Resource exhaustion in BIG-IP Configuration utility allows remote unauthenticated attackers to trigger file descriptor e
CVE-2026-42409 HIGH
8.7 May 13

Remote unauthenticated attackers can crash F5 BIG-IP and BIG-IP Next Traffic Management Microkernel (TMM) processes via

CVE-2026-40423 HIGH
8.7 May 13

Traffic Management Microkernel (TMM) crash in F5 BIG-IP versions 16.1.0 through 21.0.0.1 allows unauthenticated remote a
CVE-2026-39458 HIGH
8.7 May 13

Traffic Management Microkernel (TMM) denial-of-service in F5 BIG-IP DNS affects systems with DNS cache-enabled profiles

CVE-2026-40060 HIGH
8.7 May 13

F5 BIG-IP Advanced WAF and Application Security Manager (ASM) suffer from a denial-of-service vulnerability when process
CVE-2026-41227 HIGH
8.7 May 13

Remote memory exhaustion in F5 BIG-IP virtual servers crashes Traffic Management Microkernel when HTTP/2 Layer 7 DoS Pro
CVE-2026-40618 HIGH
8.7 May 13

Traffic Management Microkernel (TMM) crashes in F5 BIG-IP Virtual Edition and hardware platforms when SSL profiles are c
CVE-2026-41956 HIGH
8.7 May 13

Remote denial-of-service in F5 BIG-IP allows unauthenticated attackers to crash the Traffic Management Microkernel (TMM)
CVE-2026-42920 HIGH
8.7 May 13

Traffic Management Microkernel (TMM) in F5 BIG-IP terminates when processing specific traffic against UDP virtual server
CVE-2026-40629 HIGH
8.7 May 13

Denial of service in F5 BIG-IP virtual servers with SSL profiles allows remote unauthenticated attackers to exhaust conn
CVE-2026-41218 HIGH
8.7 May 13

Remote denial-of-service in F5 BIG-IP Policy Enforcement Manager (PEM) allows unauthenticated attackers to crash the Tra

Same weakness CWE-410 – Insufficient Resource Pool

View all
CVE-2025-27479 HIGH
7.5
CVE-2025-0453 HIGH POC
7.5
CVE-2025-12986 MEDIUM
6.0
CVE-2025-20103 MEDIUM
5.7
CVE-2025-27694 MEDIUM
5.3
CVE-2025-2134 LOW
3.5
CVE-2025-41653 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2014-6324 HIGH POC
8.8
CVE-2017-0213 HIGH POC
7.3
CVE-2016-7255 HIGH POC
7.8
CVE-2010-0232 HIGH POC
7.8
CVE-2025-30066 HIGH POC
8.6
CVE-2025-54236 CRITICAL POC
9.1

Share

CVE-2026-34019 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy