Which versions of F5 BIG-IP are affected by CVE-2026-59762?

F5 BIG-IP virtual servers configured with HTTP/2 profiles are vulnerable to remote denial-of-service attacks that trigger Traffic Management Microkernel restarts, creating availability risks for…. A patch is available.

How to fix or mitigate CVE-2026-59762?

Within 24 hours, audit your F5 BIG-IP infrastructure to identify all virtual servers with HTTP/2 profiles enabled and assess their external network exposure. Within 7 days, obtain the vendor-released patch from F5 and test it in a non-production environment to validate compatibility with your current BIG-IP versions and configurations. Within 30 days, deploy the patch across all affected BIG-IP systems, prioritizing production environments and systems handling business-critical traffic.

F5 BIG-IP CVE-2026-59762

Q: What is the CVSS score of CVE-2026-59762?

CVE-2026-59762 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-44679 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-15 f5

GHSA-3vvh-xmcx-wpgh

Denial Of Service Big Ip Big Ip Next For Kubernetes Big Ip Next Spk Big Ip Next Cnf

8.7

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable, unauthenticated, low-complexity request flood with no user interaction; impact is availability-only (TMM restart), so C:N/I:N/A:H and scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (f5).

CVSS VectorVendor: f5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 15, 2026 - 15:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 15, 2026 - 15:22 vuln.today

cvss_changed

CVSS changed

Jul 15, 2026 - 15:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

Jul 15, 2026 - 15:20 vuln.today

CVE Published

Jul 15, 2026 - 14:33 cve.org

HIGH 7.5

DescriptionCVE.org

When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.

Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. This vulnerability allows a remote, unauthenticated attacker to cause a degradation of service that can lead to a denial-of-service (DoS) on the BIG-IP system. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Memory-exhaustion denial of service in F5 BIG-IP affects any virtual server configured with an HTTP/2 profile, where a remote unauthenticated attacker sends undisclosed crafted requests that drive Traffic Management Microkernel (TMM) memory consumption upward until TMM restarts. This is a data-plane-only issue with no control-plane exposure, and it also impacts the BIG-IP Next family (Kubernetes, SPK, CNF). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the vendor rates it CVSS 4.0 8.7 (High).

Technical ContextAI

The affected component is the TMM data-plane process that terminates and proxies traffic on F5 BIG-IP and BIG-IP Next platforms. The flaw is triggered specifically through the HTTP/2 protocol handling of a virtual server's HTTP/2 profile. The root cause maps to CWE-770 (Allocation of Resources Without Limits or Throttling): HTTP/2's multiplexed streams, header/stream state, and flow-control structures let a client cause the server to allocate memory faster than it is reclaimed, and without an enforced ceiling this allocation grows unbounded. CPE data confirms the affected products are cpe:2.3:a:f5:big-ip, big-ip_next_for_kubernetes, big-ip_next_spk, and big-ip_next_cnf across all listed versions.

RemediationAI

Patch available per vendor advisory - apply the fixed BIG-IP/BIG-IP Next release identified in F5 article K000162231 (https://my.f5.com/manage/s/article/K000162231); exact fixed version numbers are not present in the provided data and must be taken from that advisory for your specific branch. As a compensating control until patching, remove the HTTP/2 profile from affected virtual servers or disable HTTP/2 where it is not required, which eliminates the attack surface at the cost of losing HTTP/2 performance benefits for clients. Where HTTP/2 must remain enabled, restrict data-plane reachability of affected virtual servers to trusted networks and consider connection/rate limiting in front of the device to blunt request floods; these reduce but do not fully remove the memory-growth risk. Monitor TMM memory utilization and configure alerting so an attack is detected before a forced restart. Note that End-of-Technical-Support versions are not evaluated and should be upgraded to a supported, patched release.