Which versions of F5 BIG-IP are affected by CVE-2026-40629?

F5 BIG-IP virtual servers with SSL profiles are vulnerable to remote denial-of-service attacks that can exhaust connection processing and force rejection of legitimate client connections.. A patch is available.

How to fix or mitigate CVE-2026-40629?

Within 24 hours: Identify all F5 BIG-IP instances in your environment and document current versions. Within 7 days: Apply vendor patch K000158978 to all affected BIG-IP systems (classic BIG-IP and BIG-IP Next variants including SPK, CNF, and Kubernetes deployments); coordinate patching during maintenance windows to minimize service disruption. Within 30 days: Validate patch application across all instances and conduct traffic pattern monitoring to detect exploitation attempts.

F5 BIG-IP CVE-2026-40629

Q: What is the CVSS score of CVE-2026-40629?

CVE-2026-40629 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-29977 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-05-13 f5

GHSA-x2rm-72v8-7794

Denial Of Service Big Ip Big Ip Next Spk Big Ip Next Cnf Big Ip Next For Kubernetes

8.7

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 13, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 13, 2026 - 16:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

May 13, 2026 - 15:46 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

HIGH 7.5

DescriptionCVE.org

When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Denial of service in F5 BIG-IP virtual servers with SSL profiles allows remote unauthenticated attackers to exhaust connection processing via undisclosed traffic patterns, forcing affected servers to reject new client connections. The vulnerability affects multiple BIG-IP product lines including classic BIG-IP and all BIG-IP Next variants (SPK, CNF, Kubernetes). F5 has released vendor patches (K000158978), and with CVSS 7.5 (AV:N/AC:L/PR:N/UI:N), this represents a straightforward network-based DoS attack requiring no authentication or special complexity.

Technical ContextAI

F5 BIG-IP products function as application delivery controllers (ADC) providing load balancing, SSL/TLS offloading, and traffic management. Virtual servers with SSL profiles handle encrypted client connections, performing TLS termination and re-encryption. The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), indicating insufficient resource management when processing SSL/TLS traffic. The CPE identifiers confirm impact across the entire BIG-IP ecosystem: classic BIG-IP appliances (cpe:2.3:a:f5:big-ip), BIG-IP Next SPK (Service Proxy for Kubernetes), BIG-IP Next CNF (Cloud-Native Functions), and BIG-IP Next for Kubernetes environments. The 'undisclosed traffic' mention suggests F5 has not publicly detailed the specific malformed packets or protocol sequences that trigger resource exhaustion, likely to prevent trivial weaponization while patches are deployed.

RemediationAI

Apply vendor-supplied patches detailed in F5 Security Advisory K000158978 at https://my.f5.com/manage/s/article/K000158978, which specifies exact patched versions for each affected BIG-IP product line. Patching should be prioritized for internet-facing BIG-IP instances and those handling SSL termination for critical applications. If immediate patching is not feasible during change control windows, implement rate-limiting at upstream network devices targeting the affected virtual server IP addresses to constrain potential resource exhaustion, though effectiveness depends on the undisclosed attack pattern. Connection limits and TCP SYN flood protections may provide partial mitigation but are not substitutes for patching since the specific trigger mechanism is not publicly detailed. For organizations with multiple BIG-IP devices, prioritize patching edge devices with SSL profiles before internal instances. Disabling SSL profiles is not a viable workaround as it eliminates core ADC functionality. Monitor virtual server connection statistics and availability metrics during the patching window to detect exploitation attempts. F5 support should be contacted for guidance on deployment-specific compensating controls if patching must be delayed beyond standard maintenance cycles.