F5 BIG-IP EUVD-2026-30004

Exploitation requires F5 BIG-IP deployment with UDP protocol virtual servers configured with attached Client SSL profiles having the Allow Dynamic Record Sizing feature explicitly enabled. This represents a narrow deployment subset - most BIG-IP implementations use TCP virtual servers, and even UDP deployments rarely enable dynamic record sizing on SSL profiles. The feature is a performance optimization not enabled by default. Network reachability to the UDP virtual server is required (AV:N), but standard firewall rules protecting management interfaces do not prevent exploitation against legitimate service ports. No authentication required (PR:N) for accessing the vulnerable UDP service endpoint. The specific traffic pattern required to trigger the loop is undisclosed by F5, limiting immediate exploitation risk but not preventing determined attackers from reverse-engineering the trigger condition.

CVSS 7.5 (High) accurately reflects significant availability impact with network-based exploitation requiring no authentication or user interaction. The AV:N/AC:L/PR:N vector indicates straightforward remote exploitation, but real-world risk is substantially limited by narrow deployment preconditions: requires UDP virtual servers (less common than TCP), Client SSL profile attachment to UDP (specialized use case), AND specific Allow Dynamic Record Sizing feature enablement (non-default optimization). Organizations not using DTLS or SSL-over-UDP configurations face zero risk despite high CVSS score. No EPSS data provided, but network-reachable DoS with no authentication typically sees moderate-to-high exploitation probability once details emerge. No KEV listing indicates no confirmed active exploitation at time of publication. F5's disclosure with immediate patch availability and no mention of prior exploitation suggests responsible disclosure rather than observed attacks. Primary concern is service disruption for internet-facing BIG-IP deployments with vulnerable configurations - TMM crashes affect all traffic through the device until restart. Defense priority should focus on configuration audit rather than emergency patching for most environments.

An attacker identifies an internet-facing F5 BIG-IP device with UDP services exposed (commonly DTLS VPN endpoints or secure UDP application proxies). By crafting specific UDP packet sequences targeting the SSL handshake or data transfer phases against the vulnerable virtual server, the attacker triggers the infinite loop condition in TMM's dynamic record sizing logic. TMM process terminates, causing complete service outage for all traffic processed by that TMM instance until administrators restart the service or device. Attacker can repeatedly send trigger packets to maintain persistent denial of service.