Is there a patch available for CVE-2026-34019?

Yes, a patch is available for CVE-2026-34019. Update the affected software to the latest version immediately.

F5 BIG-IP CVE-2026-34019

Q: What is the CVSS score of CVE-2026-34019?

CVE-2026-34019 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-29963 MEDIUM

Insufficient Resource Pool (CWE-410)

2026-05-13 f5

GHSA-996c-hhrm-w2q5

Information Disclosure Big Ip F5

6.3

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

May 13, 2026 - 16:22 NVD

5.3 (MEDIUM) 6.3 (MEDIUM)

Analysis Generated

May 13, 2026 - 15:52 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

MEDIUM 5.3

DescriptionCVE.org

When Bidirectional Forwarding Detection (BFD) is configured in Static and Dynamic routing protocols, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to stop processing BFD packets and cause the configured routing protocol to fail over. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Denial of service in F5 BIG-IP affects the Traffic Management Microkernel (TMM) when Bidirectional Forwarding Detection (BFD) is configured with static or dynamic routing protocols. Undisclosed traffic patterns cause TMM to stop processing BFD packets, triggering unintended failover of the configured routing protocol. Remote unauthenticated attackers can trigger this condition over the network with low complexity, resulting in availability loss for BFD-dependent routing operations.

Technical ContextAI

Bidirectional Forwarding Detection is an RFC 5880-compliant protocol used for rapid detection of forwarding path failures in routing protocols. F5 BIG-IP's TMM is the core packet processing engine responsible for handling network traffic and routing decisions. The vulnerability exists when BFD is enabled in conjunction with static or dynamic routing protocols (such as BGP, OSPF, or RIP). The underlying issue is classified as CWE-410 (Insufficient Resource Validation), indicating that the TMM fails to properly validate or throttle undisclosed traffic patterns destined for or related to BFD processing. This causes resource exhaustion or improper state handling in the BFD packet processing pipeline, leading to cessation of legitimate BFD packet handling and subsequent routing protocol failover.

RemediationAI

Apply the vendor-released patch from F5 advisory K000150508 (https://my.f5.com/manage/s/article/K000150508) to affected BIG-IP systems. The advisory specifies exact patched versions; deploy the recommended version appropriate to your BIG-IP product line. As an interim compensating control, disable BFD or remove it from active routing protocol configuration if operationally feasible, though this sacrifices rapid failover detection capabilities and may impact availability design. Alternatively, restrict network access to BFD protocol ports (UDP 3784/3785) at upstream network boundaries using firewall rules or ACLs to reduce the attack surface for traffic that triggers the TMM failure, though this is a containment measure and does not eliminate the underlying vulnerability. Verify that deployed BIG-IP versions have not reached End of Technical Support; EoTS versions are not eligible for patches per F5 policy and require upgrade or decommissioning.