F5 BIG-IP CVE-2026-41227

Requires F5 BIG-IP virtual server configured with BOTH HTTP/2 protocol handling AND Layer 7 DoS Protection feature simultaneously enabled - deployments using only HTTP/1.1 or those without Layer 7 DoS Protection are not affected. Virtual server must be network-accessible to the attacker. Default BIG-IP installations do not automatically enable Layer 7 DoS Protection, limiting exposure to organizations that explicitly configured this security feature. The specific 'undisclosed traffic' pattern required for exploitation has not been publicly detailed by F5, temporarily constraining mass exploitation until independent researchers reverse-engineer or rediscover the trigger condition. No authentication or user interaction required once an affected virtual server is identified.

High real-world risk for organizations using HTTP/2 virtual servers with Layer 7 DoS Protection enabled. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms worst-case exploitability: network-accessible, low attack complexity, no authentication required, and no user interaction needed. The availability impact is rated High (A:H), meaning complete service disruption. However, impact scope is Unchanged (S:U), limiting damage to the vulnerable component rather than broader systems. Attack complexity rated Low suggests reliable exploitation once the trigger traffic pattern is identified. The vendor's decision to withhold specifics about the 'undisclosed traffic' pattern may temporarily limit exploitation risk, but also prevents defenders from implementing targeted detection rules. No EPSS score, KEV listing, or public POC identified at time of analysis - suggesting either recent disclosure or controlled information sharing. The combination of network exposure, zero authentication requirements, and complete service disruption warrants immediate attention for affected deployments, particularly in environments where BIG-IP provides critical application delivery or security services. Risk is tempered only by the requirement for the specific Layer 7 DoS Protection + HTTP/2 configuration combination.

An unauthenticated remote attacker identifies a BIG-IP virtual server handling HTTP/2 traffic with Layer 7 DoS Protection enabled, likely through banner grabbing or service fingerprinting. The attacker crafts or sends undisclosed HTTP/2 traffic patterns (potentially malformed frames, excessive streams, or specific header combinations) to the virtual server's exposed IP address. The Layer 7 DoS Protection feature attempts to process this traffic but enters an unbounded memory allocation loop due to CWE-770 flaw. Memory consumption in the TMM process rapidly increases until the process crashes, causing immediate outage of all application services dependent on that TMM instance.