EUVD-2026-44679
GHSA-3vvh-xmcx-wpgh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach HTTP/2-enabled BIG-IP virtual server
-
DeliverySend crafted HTTP/2 requests
-
ExploitTrigger unbounded TMM memory allocation
-
ExecutionExhaust memory resources
-
ImpactTMM restart / denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target virtual server be configured with an HTTP/2 profile - this is the exact, named prerequisite from the description; virtual servers without an HTTP/2 profile are not affected. The attacker needs only network reachability to that data-plane virtual server (AV:N) and no authentication (PR:N), no user interaction (UI:N), and low attack complexity (AC:L). Limiting factors that reduce real-world exposure: the HTTP/2 profile must be enabled (not the default for every virtual server), only the data plane is reachable for this attack (no control-plane exposure), the impact is confined to availability with no data compromise, and EoTS software versions are outside the evaluated/patched scope. |
| Impact | The signals are consistent and point to a genuine availability threat rather than an inflated score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and impact is isolated to availability (VA:H) with no confidentiality or integrity effect (VC:N/VI:N) and no scope/subsequent-system change (SC:N/SI:N/SA:N), which precisely matches a pure DoS. No EPSS score was provided, so exploitation probability cannot be quantified from this data; no KEV listing and no POC reference exist, so there is no evidence of active or public exploitation. The practical priority driver is exposure: only virtual servers with an HTTP/2 profile are affected, so the real-world risk is high for internet-facing BIG-IP devices fronting HTTP/2 services and materially lower where HTTP/2 is not enabled. Note the impact is limited to service degradation/restart of TMM - there is no code execution or data exposure. |
| Exploit ScenarioDerived | An attacker who can reach an internet-facing BIG-IP virtual server that has an HTTP/2 profile sends a stream of crafted HTTP/2 requests that force TMM to allocate memory faster than it frees it. Sustained requests grow memory utilization until system performance degrades and TMM is forced to restart, dropping all traffic the device is proxying. No authentication, credentials, or user interaction are required, and no public POC is known at this time. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 15, 2026
Memory-exhaustion denial of service in F5 BIG-IP affects any virtual server configured with an HTTP/2 profile, where a remote unauthenticated attacker sends undisclosed crafted requests that drive Traffic Management Microkernel (TMM) memory consumption upward until TMM restarts. This is a data-plane-only issue with no control-plane exposure, and it also impacts the BIG-IP Next family (Kubernetes, SPK, CNF). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the vendor rates it CVSS 4.0 8.7 (High).
Earlier versions of this analysis (1)
Uncontrolled memory consumption in F5 BIG-IP occurs when an HTTP/2 profile is bound to a virtual server, allowing a remote unauthenticated attacker to send undisclosed requests that steadily grow TMM memory usage until the Traffic Management Microkernel restarts. This data-plane-only flaw (no control plane exposure) results in denial of service and carries a CVSS 7.5 with an availability-only impact; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Patch available per vendor advisory - apply the fixed BIG-IP/BIG-IP Next release identified in F5 article K000162231 (https://my.f5.com/manage/s/article/K000162231); exact fixed version numbers are not present in the provided data and must be taken from that advisory for your specific branch. As a compensating control until patching, remove the HTTP/2 profile from affected virtual servers or disable HTTP/2 where it is not required, which eliminates the attack surface at the cost of losing HTTP/2 performance benefits for clients. Where HTTP/2 must remain enabled, restrict data-plane reachability of affected virtual servers to trusted networks and consider connection/rate limiting in front of the device to blunt request floods; these reduce but do not fully remove the memory-growth risk. Monitor TMM memory utilization and configure alerting so an attack is detected before a forced restart. Note that End-of-Technical-Support versions are not evaluated and should be upgraded to a supported, patched release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the TMM data-plane process that terminates and proxies traffic on F5 BIG-IP and BIG-IP Next platforms. The flaw is triggered specifically through the HTTP/2 protocol handling of a virtual server's HTTP/2 profile. The root cause maps to CWE-770 (Allocation of Resources Without Limits or Throttling): HTTP/2's multiplexed streams, header/stream state, and flow-control structures let a client cause the server to allocate memory faster than it is reclaimed, and without an enforced ceiling this allocation grows unbounded. CPE data confirms the affected products are cpe:2.3:a:f5:big-ip, big-ip_next_for_kubernetes, big-ip_next_spk, and big-ip_next_cnf across all listed versions.
Know when Big Ip Next For Kubernetes gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable, unauthenticated, low-complexity request flood with no user interaction; impact is availability-only (TMM restart), so C:N/I:N/A:H and scope unchanged.
Primary rating from Vendor (f5).
CVSS VectorVendor: f5
Lifecycle Timeline
3DescriptionCVE.org
When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.
Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. This vulnerability allows a remote, unauthenticated attacker to cause a degradation of service that can lead to a denial-of-service (DoS) on the BIG-IP system. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Executive ViewAI
F5 BIG-IP virtual servers configured with HTTP/2 profiles are vulnerable to remote denial-of-service attacks that trigger Traffic Management Microkernel restarts, creating availability risks for applications dependent on affected load balancers. Organizations should prioritize assessment and patching of HTTP/2-enabled virtual servers to maintain critical application availability.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Big Ip Next For Kubernetes
View allUncontrolled memory consumption in F5 BIG-IP Next for Kubernetes, BIG-IP Next Cloud-Native Network Functions and BIG-IP
Denial of service in F5 BIG-IP allows remote, unauthenticated attackers to terminate the Traffic Management Microkernel
Denial of service in F5 BIG-IP allows remote, unauthenticated attackers to terminate the Traffic Management Microkernel
Denial of service in F5 BIG-IP Next deployments with HTTP/2 Ingress enabled allows unauthenticated network attackers to
A remote, unauthenticated denial-of-service condition exists in F5 BIG-IP Policy Enforcement Manager (and the BIG-IP Nex
Remote unauthenticated attackers can crash F5 BIG-IP and BIG-IP Next Traffic Management Microkernel (TMM) processes via
Traffic Management Microkernel (TMM) crashes in F5 BIG-IP Virtual Edition and hardware platforms when SSL profiles are c
Remote denial-of-service in F5 BIG-IP allows unauthenticated attackers to crash the Traffic Management Microkernel (TMM)
Denial of service in F5 BIG-IP virtual servers with SSL profiles allows remote unauthenticated attackers to exhaust conn
Repeated calls to an undisclosed API endpoint can force the Traffic Management Microkernel (TMM) to terminate on F5 BIG-
Memory exhaustion in F5 BIG-IP Next can be induced when iRules configured through the declarative API are repeatedly re-
An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in order to bre
Exploit-DB