Which versions of F5 BIG-IP are affected by EUVD-2026-29999?

F5 BIG-IP and BIG-IP Next systems can be remotely crashed by unauthenticated attackers sending malformed HTTP/2 requests, causing complete loss of traffic management services for affected virtual…. A patch is available.

How to fix or mitigate EUVD-2026-29999?

Within 24 hours: Identify all BIG-IP and BIG-IP Next instances using HTTP/2 profiles combined with HTTP::redirect or HTTP::respond iRules via configuration audit. Within 7 days: Apply vendor patch F5 K000159034 to all affected systems following F5 change management procedures; test in staging first. Within 30 days: Complete patch deployment to production and validate HTTP/2 virtual server functionality post-remediation.

F5 BIG-IP EUVD-2026-29999

Q: What is the CVSS score of EUVD-2026-29999?

EUVD-2026-29999 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-42409 HIGH

NULL Pointer Dereference (CWE-476)

2026-05-13 f5

GHSA-qj39-79pv-x52r

Denial Of Service Null Pointer Dereference Big Ip Big Ip Next Spk Big Ip Next Cnf Big Ip Next For Kubernetes

8.7

CVSS 4.0 · Vendor: f5

Severity by source

Vendor (f5) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (f5) · only source for this CVE.

CVSS VectorVendor: f5

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 13, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

May 13, 2026 - 16:22 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

May 13, 2026 - 15:48 vuln.today

CVE Published

May 13, 2026 - 14:12 nvd

HIGH 7.5

DescriptionCVE.org

When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

AnalysisAI

Remote unauthenticated attackers can crash F5 BIG-IP and BIG-IP Next Traffic Management Microkernel (TMM) processes via undisclosed malformed HTTP/2 requests when virtual servers are configured with both an HTTP/2 profile and iRules using HTTP::redirect or HTTP::respond commands. Exploitation requires no authentication or user interaction (CVSS AV:N/AC:L/PR:N/UI:N) and results in complete service disruption. Vendor patch available via F5 K000159034. EPSS data not provided, but the specific configuration requirement limits exposure to organizations using HTTP/2 with custom iRule redirects or responses.

Technical ContextAI

This null pointer dereference vulnerability (CWE-476) affects F5's Traffic Management Microkernel (TMM), the core data plane component responsible for processing all traffic through BIG-IP devices. TMM handles HTTP/2 frame processing, iRule execution, and connection management. The vulnerability occurs specifically when TMM processes certain HTTP/2 requests while executing iRule commands that manipulate HTTP responses (HTTP::redirect for 3xx redirects, HTTP::respond for custom responses). A null pointer dereference typically occurs when code attempts to access memory through an uninitialized or invalid pointer, causing immediate process termination in safety-critical systems. The affected CPE strings indicate impact across F5's entire next-generation product line: traditional BIG-IP appliances, BIG-IP Next SPK (Software for Per-app Virtual Editions), BIG-IP Next CNF (Cloud-Native Functions for containerized environments), and BIG-IP Next for Kubernetes. This suggests the vulnerable code exists in a shared HTTP/2 processing library across F5's modernized architecture.

RemediationAI

Apply vendor-released patches specified in F5 Security Advisory K000159034 (https://my.f5.com/manage/s/article/K000159034), which provides version-specific fixes for BIG-IP, BIG-IP Next SPK, BIG-IP Next CNF, and BIG-IP Next for Kubernetes platforms. Exact fixed versions are not provided in the CVE data but are documented in the advisory, which requires F5 customer portal access. Before patching, organizations can implement compensating controls with trade-offs: (1) Disable HTTP/2 profiles on affected virtual servers and revert to HTTP/1.1 - this eliminates vulnerability but sacrifices HTTP/2 performance benefits including multiplexing, header compression, and server push; client applications expecting HTTP/2 may experience compatibility issues. (2) Temporarily remove or comment out HTTP::redirect and HTTP::respond commands from iRules and implement redirects/custom responses at the application layer instead - this shifts logic from the load balancer to backend servers, increasing application complexity and potentially reducing redirect performance. (3) Implement connection rate limiting and HTTP/2 stream limits to slow potential exploitation attempts - this reduces attack surface but may impact legitimate high-volume traffic. Organizations running EoTS versions with no patch path should prioritize migration to supported BIG-IP releases or consider alternative application delivery solutions.