Big Ip Next Cloud Native Network Functions
Monthly
Denial of service in F5 BIG-IP allows remote, unauthenticated attackers to terminate the Traffic Management Microkernel (TMM) and disrupt data-plane traffic processing. The flaw is a double-free (CWE-415) triggered by undisclosed network traffic, but exploitation is gated by a hardware precondition: the BIG-IP system must run on a multi-bladed chassis platform with more than one active blade, so single-blade and standard appliance deployments are not described as affected. No public exploit code has been identified at time of analysis, KEV status is not indicated, and EPSS is low at 0.35% (27th percentile); nevertheless, a TMM crash on a production load balancer can cause an immediate traffic outage. Vendor advisory: K000156912.
Denial of service in F5 BIG-IP allows remote, unauthenticated attackers to terminate the Traffic Management Microkernel (TMM) and disrupt traffic handling, but only on systems where IPsec is configured - deployments without an IPsec configuration are not exposed. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:N/VI:N/VA:H) and the corresponding CVSS 3.1 assessment agree that the effect is purely availability loss (a TMM crash), with no confidentiality or integrity impact, which makes this a high-severity (8.7) but non-compromising availability issue against appliances that are common internet-facing edge devices. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS score of roughly 0.37% (29th percentile) indicates low predicted exploitation likelihood in the near term, though the broad install base of BIG-IP keeps this worth prompt patching on IPsec-enabled systems.
Uncontrolled memory consumption in F5 BIG-IP Next for Kubernetes, BIG-IP Next Cloud-Native Network Functions and BIG-IP Next Service Proxy for Kubernetes lets remote attackers steadily exhaust memory on an affected appliance or pod by sending undisclosed crafted requests to a virtual server that has a client SSL profile attached. The assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N, with C:N/I:N/A:H) means no credentials and no user interaction are required once the TLS-terminating virtual server is reachable over the network, and the leak accumulates across requests until the service degrades or becomes unavailable. No public exploit code has been identified at time of analysis, EPSS is a low 0.46% (38th percentile), and the issue is not in CISA KEV, so this reads as a moderate availability-only risk rather than an emergency.
Denial of service in F5 BIG-IP Next Cloud-Native Network Functions and Service Proxy for Kubernetes allows unauthenticated network attackers to terminate the Traffic Management Microkernel (TMM) when a virtual server uses an SSL profile with Diffie-Hellman ECC Brainpool curves in its Cipher Rule or Cipher Group. Only deployments with this explicit non-default cipher configuration are exposed; default or non-Brainpool profiles are not affected. No public exploit identified at time of analysis and no CISA KEV entry is present, with EPSS at 0.44% (37th percentile), but the availability-only impact is rated high severity (CVSS 8.7).
Resource exhaustion in F5 BIG-IP and BIG-IP Next CNF DNS cache allows remote unauthenticated attackers to increase memory utilization on a DNS-caching virtual server, causing a high availability impact when malicious DNS queries are delivered. The flaw is only reachable when the non-default DNS cache feature is configured on a virtual server, and software versions past End of Technical Support were not evaluated. No public exploit was identified at time of analysis, CISA KEV status is not indicated, and EPSS is low at 0.35%.
Denial of service in F5 BIG-IP Next deployments with HTTP/2 Ingress enabled allows unauthenticated network attackers to terminate the Traffic Management Microkernel (TMM) by sending HTTP/2 traffic that triggers the flaw, affecting BIG-IP Next Service Proxy for Kubernetes, Cloud-Native Network Functions, and BIG-IP Next for Kubernetes. The flaw is a NULL pointer dereference (CWE-476) with availability-only impact; no public exploit was identified at time of analysis, it is not in CISA KEV, and EPSS is 0.35% (27th percentile). This is a genuine but conditional denial-of-service risk rather than a code-execution emergency, since only instances configured for HTTP/2 Ingress are exposed.
Repeated calls to an undisclosed API endpoint can force the Traffic Management Microkernel (TMM) to terminate on F5 BIG-IP Next Cloud-Native Network Functions, BIG-IP Next Service Proxy for Kubernetes, and BIG-IP Next for Kubernetes, letting an attacker disrupt traffic processing on affected clusters. Exploitation requires network reach to the management/API surface plus valid low-privilege API credentials (CVSS PR:L), and impact is confined to availability with no confidentiality or integrity effect. EPSS is low at roughly 0.31% (22nd percentile), and no public exploit code or CISA KEV entry was identified at time of analysis; releases that have reached End of Technical Support are out of scope per the vendor.
Memory exhaustion in F5 BIG-IP Next can be induced when iRules configured through the declarative API are repeatedly re-instantiated, causing the Traffic Management Microkernel (TMM) cleanup process to leak memory and gradually degrade availability. The issue affects BIG-IP Next CNF, BIG-IP Next for Kubernetes 2.0.0, and BIG-IP Next Service Proxy for Kubernetes deployments that use declarative API-managed iRules, and requires authenticated low-privilege access to that API. Exploitation is not confirmed in CISA KEV, no public exploit code was identified at time of analysis, and EPSS is low at 0.31% (22nd percentile).
A remote, unauthenticated denial-of-service condition exists in F5 BIG-IP Policy Enforcement Manager (and the BIG-IP Next Cloud-Native Network Functions and BIG-IP Next for Kubernetes variants) when a classification profile is attached to a virtual server that lacks an HTTP or HTTP/2 profile - a non-default configuration. Undisclosed requests to such a virtual server can trigger memory corruption in the Traffic Management Microkernel (TMM), causing it to terminate and disrupting traffic processing. No public exploit code or CISA KEV entry is associated with this CVE, and EPSS is low (0.35%, 27th percentile), though the prerequisite profile combination sharply limits real-world exposure; F5 EoTS versions were not evaluated.
A use-after-free (CWE-416) in F5 BIG-IP's Traffic Management Microkernel (TMM) allows remote unauthenticated attackers to crash the data-plane process when a TCP profile with Multipath TCP (MPTCP) explicitly enabled is applied to a virtual server. Only deployments with non-default MPTCP-enabled TCP profiles are exposed; successful triggering also depends on undisclosed traffic patterns and conditions beyond the attacker's control, so the crash cannot be forced reliably. Impact is availability-only (CVSS 4.0: 8.7, VA:H with VC:N/VI:N), no public exploit code or confirmed active exploitation is identified at time of analysis, and EPSS is low (~0.44%, 37th percentile).
Denial of service in F5 BIG-IP allows remote unauthenticated attackers to exhaust memory resources on virtual servers configured with an iRule containing the HTTP::respond command. The issue affects multiple BIG-IP modules and BIG-IP Next variants, excluding releases that have reached End of Technical Support, and successful exploitation only impacts availability with no confidentiality or integrity effect. No public exploit code has been identified at time of analysis, and EPSS estimates a low exploitation likelihood of 0.43%.
An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit (HTTP/2 MadeYouReset Attack). Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When HTTP/2 client and server profile is configured on a virtual server, undisclosed requests can cause TMM to terminate. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When a Stream Control Transmission Protocol (SCTP) profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When an HTTP profile with the Enforce RFC Compliance option is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When a BIG-IP HTTP/2 httprouter profile is configured on a virtual server, undisclosed responses can cause an increase in memory resource utilization. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When BIG-IP AFM is provisioned with IPS module enabled and protocol inspection profile is configured on a virtual server or firewall rule or policy, undisclosed traffic can cause an increase in CPU. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When TCP profile with Multipath TCP enabled (MPTCP) is configured on a Virtual Server, undisclosed traffic along with conditions beyond the attackers control can cause TMM to terminate. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Exposure of Sensitive Information vulnerability exists in the GSLB container, which may allow an authenticated attacker with local access to view sensitive information. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
When BIG-IP AFM is licensed and provisioned, undisclosed DNS traffic can cause the Traffic Management Microkernel (TMM) to terminate. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability exists in BIG-IP Next CNF and SPK systems that may allow access to undisclosed sensitive files. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
The BGP daemon (bgpd) in IP Infusion ZebOS through 7.10.6 allow remote attackers to cause a denial of service by sending crafted BGP update messages containing a malformed attribute. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Denial of service in F5 BIG-IP allows remote, unauthenticated attackers to terminate the Traffic Management Microkernel (TMM) and disrupt data-plane traffic processing. The flaw is a double-free (CWE-415) triggered by undisclosed network traffic, but exploitation is gated by a hardware precondition: the BIG-IP system must run on a multi-bladed chassis platform with more than one active blade, so single-blade and standard appliance deployments are not described as affected. No public exploit code has been identified at time of analysis, KEV status is not indicated, and EPSS is low at 0.35% (27th percentile); nevertheless, a TMM crash on a production load balancer can cause an immediate traffic outage. Vendor advisory: K000156912.
Denial of service in F5 BIG-IP allows remote, unauthenticated attackers to terminate the Traffic Management Microkernel (TMM) and disrupt traffic handling, but only on systems where IPsec is configured - deployments without an IPsec configuration are not exposed. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:N/VI:N/VA:H) and the corresponding CVSS 3.1 assessment agree that the effect is purely availability loss (a TMM crash), with no confidentiality or integrity impact, which makes this a high-severity (8.7) but non-compromising availability issue against appliances that are common internet-facing edge devices. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS score of roughly 0.37% (29th percentile) indicates low predicted exploitation likelihood in the near term, though the broad install base of BIG-IP keeps this worth prompt patching on IPsec-enabled systems.
Uncontrolled memory consumption in F5 BIG-IP Next for Kubernetes, BIG-IP Next Cloud-Native Network Functions and BIG-IP Next Service Proxy for Kubernetes lets remote attackers steadily exhaust memory on an affected appliance or pod by sending undisclosed crafted requests to a virtual server that has a client SSL profile attached. The assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N, with C:N/I:N/A:H) means no credentials and no user interaction are required once the TLS-terminating virtual server is reachable over the network, and the leak accumulates across requests until the service degrades or becomes unavailable. No public exploit code has been identified at time of analysis, EPSS is a low 0.46% (38th percentile), and the issue is not in CISA KEV, so this reads as a moderate availability-only risk rather than an emergency.
Denial of service in F5 BIG-IP Next Cloud-Native Network Functions and Service Proxy for Kubernetes allows unauthenticated network attackers to terminate the Traffic Management Microkernel (TMM) when a virtual server uses an SSL profile with Diffie-Hellman ECC Brainpool curves in its Cipher Rule or Cipher Group. Only deployments with this explicit non-default cipher configuration are exposed; default or non-Brainpool profiles are not affected. No public exploit identified at time of analysis and no CISA KEV entry is present, with EPSS at 0.44% (37th percentile), but the availability-only impact is rated high severity (CVSS 8.7).
Resource exhaustion in F5 BIG-IP and BIG-IP Next CNF DNS cache allows remote unauthenticated attackers to increase memory utilization on a DNS-caching virtual server, causing a high availability impact when malicious DNS queries are delivered. The flaw is only reachable when the non-default DNS cache feature is configured on a virtual server, and software versions past End of Technical Support were not evaluated. No public exploit was identified at time of analysis, CISA KEV status is not indicated, and EPSS is low at 0.35%.
Denial of service in F5 BIG-IP Next deployments with HTTP/2 Ingress enabled allows unauthenticated network attackers to terminate the Traffic Management Microkernel (TMM) by sending HTTP/2 traffic that triggers the flaw, affecting BIG-IP Next Service Proxy for Kubernetes, Cloud-Native Network Functions, and BIG-IP Next for Kubernetes. The flaw is a NULL pointer dereference (CWE-476) with availability-only impact; no public exploit was identified at time of analysis, it is not in CISA KEV, and EPSS is 0.35% (27th percentile). This is a genuine but conditional denial-of-service risk rather than a code-execution emergency, since only instances configured for HTTP/2 Ingress are exposed.
Repeated calls to an undisclosed API endpoint can force the Traffic Management Microkernel (TMM) to terminate on F5 BIG-IP Next Cloud-Native Network Functions, BIG-IP Next Service Proxy for Kubernetes, and BIG-IP Next for Kubernetes, letting an attacker disrupt traffic processing on affected clusters. Exploitation requires network reach to the management/API surface plus valid low-privilege API credentials (CVSS PR:L), and impact is confined to availability with no confidentiality or integrity effect. EPSS is low at roughly 0.31% (22nd percentile), and no public exploit code or CISA KEV entry was identified at time of analysis; releases that have reached End of Technical Support are out of scope per the vendor.
Memory exhaustion in F5 BIG-IP Next can be induced when iRules configured through the declarative API are repeatedly re-instantiated, causing the Traffic Management Microkernel (TMM) cleanup process to leak memory and gradually degrade availability. The issue affects BIG-IP Next CNF, BIG-IP Next for Kubernetes 2.0.0, and BIG-IP Next Service Proxy for Kubernetes deployments that use declarative API-managed iRules, and requires authenticated low-privilege access to that API. Exploitation is not confirmed in CISA KEV, no public exploit code was identified at time of analysis, and EPSS is low at 0.31% (22nd percentile).
A remote, unauthenticated denial-of-service condition exists in F5 BIG-IP Policy Enforcement Manager (and the BIG-IP Next Cloud-Native Network Functions and BIG-IP Next for Kubernetes variants) when a classification profile is attached to a virtual server that lacks an HTTP or HTTP/2 profile - a non-default configuration. Undisclosed requests to such a virtual server can trigger memory corruption in the Traffic Management Microkernel (TMM), causing it to terminate and disrupting traffic processing. No public exploit code or CISA KEV entry is associated with this CVE, and EPSS is low (0.35%, 27th percentile), though the prerequisite profile combination sharply limits real-world exposure; F5 EoTS versions were not evaluated.
A use-after-free (CWE-416) in F5 BIG-IP's Traffic Management Microkernel (TMM) allows remote unauthenticated attackers to crash the data-plane process when a TCP profile with Multipath TCP (MPTCP) explicitly enabled is applied to a virtual server. Only deployments with non-default MPTCP-enabled TCP profiles are exposed; successful triggering also depends on undisclosed traffic patterns and conditions beyond the attacker's control, so the crash cannot be forced reliably. Impact is availability-only (CVSS 4.0: 8.7, VA:H with VC:N/VI:N), no public exploit code or confirmed active exploitation is identified at time of analysis, and EPSS is low (~0.44%, 37th percentile).
Denial of service in F5 BIG-IP allows remote unauthenticated attackers to exhaust memory resources on virtual servers configured with an iRule containing the HTTP::respond command. The issue affects multiple BIG-IP modules and BIG-IP Next variants, excluding releases that have reached End of Technical Support, and successful exploitation only impacts availability with no confidentiality or integrity effect. No public exploit code has been identified at time of analysis, and EPSS estimates a low exploitation likelihood of 0.43%.
An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit (HTTP/2 MadeYouReset Attack). Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When HTTP/2 client and server profile is configured on a virtual server, undisclosed requests can cause TMM to terminate. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When a Stream Control Transmission Protocol (SCTP) profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When an HTTP profile with the Enforce RFC Compliance option is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When a BIG-IP HTTP/2 httprouter profile is configured on a virtual server, undisclosed responses can cause an increase in memory resource utilization. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When BIG-IP AFM is provisioned with IPS module enabled and protocol inspection profile is configured on a virtual server or firewall rule or policy, undisclosed traffic can cause an increase in CPU. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
When TCP profile with Multipath TCP enabled (MPTCP) is configured on a Virtual Server, undisclosed traffic along with conditions beyond the attackers control can cause TMM to terminate. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Exposure of Sensitive Information vulnerability exists in the GSLB container, which may allow an authenticated attacker with local access to view sensitive information. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
When BIG-IP AFM is licensed and provisioned, undisclosed DNS traffic can cause the Traffic Management Microkernel (TMM) to terminate. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability exists in BIG-IP Next CNF and SPK systems that may allow access to undisclosed sensitive files. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
The BGP daemon (bgpd) in IP Infusion ZebOS through 7.10.6 allow remote attackers to cause a denial of service by sending crafted BGP update messages containing a malformed attribute. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.