Skip to main content

F5 BIG-IP CVE-2026-59762

| EUVDEUVD-2026-44679 HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-07-15 f5 GHSA-3vvh-xmcx-wpgh
Denial Of Service Big Ip Big Ip Next For Kubernetes Big Ip Next Spk Big Ip Next Cnf
8.7
CVSS 4.0 · Vendor: f5
Share

Severity by source

Vendor (f5) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-reachable, unauthenticated, low-complexity request flood with no user interaction; impact is availability-only (TMM restart), so C:N/I:N/A:H and scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (f5).

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

5
Analysis Updated
Jul 15, 2026 - 15:29 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 15, 2026 - 15:22 vuln.today
cvss_changed
CVSS changed
Jul 15, 2026 - 15:22 NVD
7.5 (HIGH) 8.7 (HIGH)
Analysis Generated
Jul 15, 2026 - 15:20 vuln.today
CVE Published
Jul 15, 2026 - 14:33 cve.org
HIGH 7.5

DescriptionCVE.org

When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.

Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. This vulnerability allows a remote, unauthenticated attacker to cause a degradation of service that can lead to a denial-of-service (DoS) on the BIG-IP system. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Memory-exhaustion denial of service in F5 BIG-IP affects any virtual server configured with an HTTP/2 profile, where a remote unauthenticated attacker sends undisclosed crafted requests that drive Traffic Management Microkernel (TMM) memory consumption upward until TMM restarts. This is a data-plane-only issue with no control-plane exposure, and it also impacts the BIG-IP Next family (Kubernetes, SPK, CNF). …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach HTTP/2-enabled BIG-IP virtual server
Delivery
Send crafted HTTP/2 requests
Exploit
Trigger unbounded TMM memory allocation
Execution
Exhaust memory resources
Impact
TMM restart / denial of service
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target virtual server be configured with an HTTP/2 profile - this is the exact, named prerequisite from the description; virtual servers without an HTTP/2 profile are not affected. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The signals are consistent and point to a genuine availability threat rather than an inflated score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who can reach an internet-facing BIG-IP virtual server that has an HTTP/2 profile sends a stream of crafted HTTP/2 requests that force TMM to allocate memory faster than it frees it. Sustained requests grow memory utilization until system performance degrades and TMM is forced to restart, dropping all traffic the device is proxying. …
Remediation Patch available per vendor advisory - apply the fixed BIG-IP/BIG-IP Next release identified in F5 article K000162231 (https://my.f5.com/manage/s/article/K000162231); exact fixed version numbers are not present in the provided data and must be taken from that advisory for your specific branch. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, audit your F5 BIG-IP infrastructure to identify all virtual servers with HTTP/2 profiles enabled and assess their external network exposure. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Big Ip

View all
CVE-2026-41957 HIGH
8.7 May 13

Remote code execution in F5 BIG-IP and BIG-IQ Configuration utility allows authenticated attackers with low privileges t
CVE-2026-39455 HIGH
8.7 May 13

Resource exhaustion in BIG-IP Configuration utility allows remote unauthenticated attackers to trigger file descriptor e
CVE-2026-42409 HIGH
8.7 May 13

Remote unauthenticated attackers can crash F5 BIG-IP and BIG-IP Next Traffic Management Microkernel (TMM) processes via

CVE-2026-40423 HIGH
8.7 May 13

Traffic Management Microkernel (TMM) crash in F5 BIG-IP versions 16.1.0 through 21.0.0.1 allows unauthenticated remote a
CVE-2026-39458 HIGH
8.7 May 13

Traffic Management Microkernel (TMM) denial-of-service in F5 BIG-IP DNS affects systems with DNS cache-enabled profiles

CVE-2026-40060 HIGH
8.7 May 13

F5 BIG-IP Advanced WAF and Application Security Manager (ASM) suffer from a denial-of-service vulnerability when process
CVE-2026-41227 HIGH
8.7 May 13

Remote memory exhaustion in F5 BIG-IP virtual servers crashes Traffic Management Microkernel when HTTP/2 Layer 7 DoS Pro
CVE-2026-40618 HIGH
8.7 May 13

Traffic Management Microkernel (TMM) crashes in F5 BIG-IP Virtual Edition and hardware platforms when SSL profiles are c
CVE-2026-41956 HIGH
8.7 May 13

Remote denial-of-service in F5 BIG-IP allows unauthenticated attackers to crash the Traffic Management Microkernel (TMM)
CVE-2026-42920 HIGH
8.7 May 13

Traffic Management Microkernel (TMM) in F5 BIG-IP terminates when processing specific traffic against UDP virtual server
CVE-2026-40629 HIGH
8.7 May 13

Denial of service in F5 BIG-IP virtual servers with SSL profiles allows remote unauthenticated attackers to exhaust conn
CVE-2026-41218 HIGH
8.7 May 13

Remote denial-of-service in F5 BIG-IP Policy Enforcement Manager (PEM) allows unauthenticated attackers to crash the Tra

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2025-26466 MEDIUM
5.9
CVE-2020-37067 CRITICAL POC
9.8
CVE-2021-47875 CRITICAL POC
9.8
CVE-2023-38507 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-59762 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy