F5 BIG-IP CVE-2026-42409

Exploitation requires the targeted BIG-IP virtual server to be configured with BOTH an HTTP/2 profile (enabling HTTP/2 protocol support) AND an iRule containing HTTP::redirect commands (for URL redirection) or HTTP::respond commands (for custom HTTP responses). This is a specific but relatively common configuration in production environments using BIG-IP for modern web application delivery, particularly for HTTPS redirect enforcement, domain canonicalization, or custom error pages. The vulnerability is remotely exploitable with no authentication required (PR:N) and low attack complexity (AC:L), meaning any network-reachable attacker can exploit vulnerable instances without credentials. No user interaction is required (UI:N), allowing fully automated attacks. Organizations NOT using HTTP/2 profiles or NOT using these specific iRule commands are not vulnerable regardless of F5 product version. Default BIG-IP configurations without custom iRules or with HTTP/1.1-only profiles are not exploitable.

Real-world risk is MODERATE to HIGH for organizations meeting the specific configuration prerequisites, despite the 7.5 CVSS score suggesting high severity. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivially exploitable remote attacks requiring no authentication, which is accurate for internet-facing BIG-IP instances. However, exploitation requires the targeted virtual server to have BOTH an HTTP/2 profile enabled AND iRules containing HTTP::redirect or HTTP::respond commands - a common but not universal configuration in load balancing and application delivery scenarios. The impact is purely availability (A:H, C:N, I:N), causing TMM process crashes that disrupt traffic processing but do not compromise data confidentiality or system integrity. F5 BIG-IP devices typically have TMM restart capabilities, but repeated exploitation could prevent service recovery. No EPSS score provided to gauge real-world exploitation likelihood. No CISA KEV listing indicates no confirmed widespread exploitation at time of analysis. No public POC identified, but the vulnerability disclosure from F5 with available patches suggests responsible disclosure rather than active exploitation discovery. The SSVC framework assessment: Exploitation Status=unconfirmed, Automatable=yes (network-based, no auth), Technical Impact=partial (availability only) - this places it in a 'scheduled patch' category rather than emergency response for most organizations. Priority should increase for organizations with internet-facing BIG-IP instances using HTTP/2 and custom iRule logic, particularly in high-availability environments where TMM crashes directly impact revenue-generating services.

An attacker identifies an internet-facing F5 BIG-IP virtual server configured with HTTP/2 support and iRule-based redirect logic (common in modern web application deployments for HTTP-to-HTTPS upgrades or domain canonicalization). The attacker crafts HTTP/2 frames with undisclosed properties that trigger the null pointer dereference when TMM attempts to execute HTTP::redirect or HTTP::respond commands. Upon sending the malformed request to the target virtual server, the TMM process immediately terminates, dropping all active connections and preventing new connections until TMM restarts. The attacker can repeatedly send these requests to cause sustained denial of service, effectively taking the application offline.