Which versions of F5 BIG-IP are affected by CVE-2026-41227?

F5 BIG-IP virtual servers are vulnerable to unauthenticated remote denial-of-service attacks that exhaust memory and crash the Traffic Management Microkernel, directly disrupting application delivery…. A patch is available.

How to fix or mitigate CVE-2026-41227?

Within 24 hours: Inventory all F5 BIG-IP instances and document current versions and deployed virtual servers with HTTP/2 enabled. Within 7 days: Apply vendor patch F5 K000158979 to all affected BIG-IP systems during maintenance windows, starting with production-critical instances. Implement network-level rate limiting on HTTP/2 traffic as interim protection. Within 30 days: Validate patch deployment across all instances, review HTTP/2 DoS protection policies, and conduct traffic baseline analysis post-patch.

F5 BIG-IP CVE-2026-41227

Q: What is the CVSS score of CVE-2026-41227?

CVE-2026-41227 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-29987 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-05-13 f5

GHSA-mggm-3mvj-fj65

Denial Of Service Big Ip

8.7

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 13, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 13, 2026 - 16:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

May 13, 2026 - 15:47 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

HIGH 7.5

DescriptionCVE.org

On an HTTP/2 virtual server with Layer 7 DoS Protection configured, undisclosed traffic can result in an increase in memory consumption causing the Traffic Management Microkernel (TMM) process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Remote memory exhaustion in F5 BIG-IP virtual servers crashes Traffic Management Microkernel when HTTP/2 Layer 7 DoS Protection receives undisclosed malformed traffic. Unauthenticated remote attackers can reliably terminate TMM processes, disrupting application delivery services. CVSS 7.5 (High) with network-exploitable, low-complexity characteristics and EPSS data not provided. Vendor patch available via F5 K000158979.

Technical ContextAI

BIG-IP's Traffic Management Microkernel (TMM) is the core traffic processing engine for F5's Application Delivery Controller. HTTP/2 is a binary multiplexing protocol that allows multiple concurrent streams over a single TCP connection. This vulnerability involves CWE-770 (Allocation of Resources Without Limits or Throttling), specifically affecting the Layer 7 DoS Protection feature when processing HTTP/2 traffic. The DoS protection mechanism itself becomes the vulnerability vector when it encounters certain undisclosed traffic patterns, causing unbounded memory allocation until TMM crashes. The CPE string indicates widespread potential impact across BIG-IP product lines, though F5 has not disclosed which specific versions are affected beyond those still receiving technical support.

RemediationAI

Apply vendor-released patches immediately per F5 Security Advisory K000158979 (https://my.f5.com/manage/s/article/K000158979), which provides version-specific upgrade paths and hotfix availability. If immediate patching is not feasible, disable Layer 7 DoS Protection on HTTP/2 virtual servers as a temporary mitigation - this removes the vulnerable feature but also eliminates application-layer DDoS defenses, potentially exposing applications to volumetric or slowloris-style attacks that the feature was designed to prevent. Alternatively, downgrade affected virtual servers from HTTP/2 to HTTP/1.1 protocol handling, which eliminates the vulnerable code path but degrades performance for modern clients expecting HTTP/2 multiplexing and header compression benefits - assess application latency impact before implementing. Organizations unable to patch or mitigate should implement upstream rate limiting at network edge or CDN layer to constrain potential memory exhaustion attempts, though this provides only partial defense against low-and-slow exploitation patterns. Monitor TMM process memory consumption and configure automated restart policies to reduce service disruption duration if exploitation occurs.