Big Ip Next For Kubernetes
Monthly
Memory-exhaustion denial of service in F5 BIG-IP affects any virtual server configured with an HTTP/2 profile, where a remote unauthenticated attacker sends undisclosed crafted requests that drive Traffic Management Microkernel (TMM) memory consumption upward until TMM restarts. This is a data-plane-only issue with no control-plane exposure, and it also impacts the BIG-IP Next family (Kubernetes, SPK, CNF). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the vendor rates it CVSS 4.0 8.7 (High).
Remote unauthenticated attackers can crash F5 BIG-IP and BIG-IP Next Traffic Management Microkernel (TMM) processes via undisclosed malformed HTTP/2 requests when virtual servers are configured with both an HTTP/2 profile and iRules using HTTP::redirect or HTTP::respond commands. Exploitation requires no authentication or user interaction (CVSS AV:N/AC:L/PR:N/UI:N) and results in complete service disruption. Vendor patch available via F5 K000159034. EPSS data not provided, but the specific configuration requirement limits exposure to organizations using HTTP/2 with custom iRule redirects or responses.
Traffic Management Microkernel (TMM) crashes in F5 BIG-IP Virtual Edition and hardware platforms when SSL profiles are configured without hardware crypto acceleration, allowing remote unauthenticated attackers to cause denial of service via undisclosed traffic patterns. CVSS 7.5 (High) with network attack vector and no prerequisites. EPSS data not provided, no CISA KEV listing identified, indicating theoretical rather than observed exploitation. Vendor patch available per F5 advisory K000158082.
Remote denial-of-service in F5 BIG-IP allows unauthenticated attackers to crash the Traffic Management Microkernel (TMM) by sending specially crafted UDP requests to virtual servers with classification profiles enabled. The vulnerability affects BIG-IP, BIG-IP Next CNF, and BIG-IP Next for Kubernetes platforms. No public exploit identified at time of analysis, with EPSS data unavailable for this recent CVE. Vendor-released patch available per F5 advisory K000158038.
Denial of service in F5 BIG-IP virtual servers with SSL profiles allows remote unauthenticated attackers to exhaust connection processing via undisclosed traffic patterns, forcing affected servers to reject new client connections. The vulnerability affects multiple BIG-IP product lines including classic BIG-IP and all BIG-IP Next variants (SPK, CNF, Kubernetes). F5 has released vendor patches (K000158978), and with CVSS 7.5 (AV:N/AC:L/PR:N/UI:N), this represents a straightforward network-based DoS attack requiring no authentication or special complexity.
Denial of service in F5 BIG-IP allows remote, unauthenticated attackers to terminate the Traffic Management Microkernel (TMM) and disrupt data-plane traffic processing. The flaw is a double-free (CWE-415) triggered by undisclosed network traffic, but exploitation is gated by a hardware precondition: the BIG-IP system must run on a multi-bladed chassis platform with more than one active blade, so single-blade and standard appliance deployments are not described as affected. No public exploit code has been identified at time of analysis, KEV status is not indicated, and EPSS is low at 0.35% (27th percentile); nevertheless, a TMM crash on a production load balancer can cause an immediate traffic outage. Vendor advisory: K000156912.
Denial of service in F5 BIG-IP allows remote, unauthenticated attackers to terminate the Traffic Management Microkernel (TMM) and disrupt traffic handling, but only on systems where IPsec is configured - deployments without an IPsec configuration are not exposed. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:N/VI:N/VA:H) and the corresponding CVSS 3.1 assessment agree that the effect is purely availability loss (a TMM crash), with no confidentiality or integrity impact, which makes this a high-severity (8.7) but non-compromising availability issue against appliances that are common internet-facing edge devices. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS score of roughly 0.37% (29th percentile) indicates low predicted exploitation likelihood in the near term, though the broad install base of BIG-IP keeps this worth prompt patching on IPsec-enabled systems.
Uncontrolled memory consumption in F5 BIG-IP Next for Kubernetes, BIG-IP Next Cloud-Native Network Functions and BIG-IP Next Service Proxy for Kubernetes lets remote attackers steadily exhaust memory on an affected appliance or pod by sending undisclosed crafted requests to a virtual server that has a client SSL profile attached. The assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N, with C:N/I:N/A:H) means no credentials and no user interaction are required once the TLS-terminating virtual server is reachable over the network, and the leak accumulates across requests until the service degrades or becomes unavailable. No public exploit code has been identified at time of analysis, EPSS is a low 0.46% (38th percentile), and the issue is not in CISA KEV, so this reads as a moderate availability-only risk rather than an emergency.
Denial of service in F5 BIG-IP Next deployments with HTTP/2 Ingress enabled allows unauthenticated network attackers to terminate the Traffic Management Microkernel (TMM) by sending HTTP/2 traffic that triggers the flaw, affecting BIG-IP Next Service Proxy for Kubernetes, Cloud-Native Network Functions, and BIG-IP Next for Kubernetes. The flaw is a NULL pointer dereference (CWE-476) with availability-only impact; no public exploit was identified at time of analysis, it is not in CISA KEV, and EPSS is 0.35% (27th percentile). This is a genuine but conditional denial-of-service risk rather than a code-execution emergency, since only instances configured for HTTP/2 Ingress are exposed.
Repeated calls to an undisclosed API endpoint can force the Traffic Management Microkernel (TMM) to terminate on F5 BIG-IP Next Cloud-Native Network Functions, BIG-IP Next Service Proxy for Kubernetes, and BIG-IP Next for Kubernetes, letting an attacker disrupt traffic processing on affected clusters. Exploitation requires network reach to the management/API surface plus valid low-privilege API credentials (CVSS PR:L), and impact is confined to availability with no confidentiality or integrity effect. EPSS is low at roughly 0.31% (22nd percentile), and no public exploit code or CISA KEV entry was identified at time of analysis; releases that have reached End of Technical Support are out of scope per the vendor.
Memory exhaustion in F5 BIG-IP Next can be induced when iRules configured through the declarative API are repeatedly re-instantiated, causing the Traffic Management Microkernel (TMM) cleanup process to leak memory and gradually degrade availability. The issue affects BIG-IP Next CNF, BIG-IP Next for Kubernetes 2.0.0, and BIG-IP Next Service Proxy for Kubernetes deployments that use declarative API-managed iRules, and requires authenticated low-privilege access to that API. Exploitation is not confirmed in CISA KEV, no public exploit code was identified at time of analysis, and EPSS is low at 0.31% (22nd percentile).
A remote, unauthenticated denial-of-service condition exists in F5 BIG-IP Policy Enforcement Manager (and the BIG-IP Next Cloud-Native Network Functions and BIG-IP Next for Kubernetes variants) when a classification profile is attached to a virtual server that lacks an HTTP or HTTP/2 profile - a non-default configuration. Undisclosed requests to such a virtual server can trigger memory corruption in the Traffic Management Microkernel (TMM), causing it to terminate and disrupting traffic processing. No public exploit code or CISA KEV entry is associated with this CVE, and EPSS is low (0.35%, 27th percentile), though the prerequisite profile combination sharply limits real-world exposure; F5 EoTS versions were not evaluated.
An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit (HTTP/2 MadeYouReset Attack). Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Memory-exhaustion denial of service in F5 BIG-IP affects any virtual server configured with an HTTP/2 profile, where a remote unauthenticated attacker sends undisclosed crafted requests that drive Traffic Management Microkernel (TMM) memory consumption upward until TMM restarts. This is a data-plane-only issue with no control-plane exposure, and it also impacts the BIG-IP Next family (Kubernetes, SPK, CNF). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the vendor rates it CVSS 4.0 8.7 (High).
Remote unauthenticated attackers can crash F5 BIG-IP and BIG-IP Next Traffic Management Microkernel (TMM) processes via undisclosed malformed HTTP/2 requests when virtual servers are configured with both an HTTP/2 profile and iRules using HTTP::redirect or HTTP::respond commands. Exploitation requires no authentication or user interaction (CVSS AV:N/AC:L/PR:N/UI:N) and results in complete service disruption. Vendor patch available via F5 K000159034. EPSS data not provided, but the specific configuration requirement limits exposure to organizations using HTTP/2 with custom iRule redirects or responses.
Traffic Management Microkernel (TMM) crashes in F5 BIG-IP Virtual Edition and hardware platforms when SSL profiles are configured without hardware crypto acceleration, allowing remote unauthenticated attackers to cause denial of service via undisclosed traffic patterns. CVSS 7.5 (High) with network attack vector and no prerequisites. EPSS data not provided, no CISA KEV listing identified, indicating theoretical rather than observed exploitation. Vendor patch available per F5 advisory K000158082.
Remote denial-of-service in F5 BIG-IP allows unauthenticated attackers to crash the Traffic Management Microkernel (TMM) by sending specially crafted UDP requests to virtual servers with classification profiles enabled. The vulnerability affects BIG-IP, BIG-IP Next CNF, and BIG-IP Next for Kubernetes platforms. No public exploit identified at time of analysis, with EPSS data unavailable for this recent CVE. Vendor-released patch available per F5 advisory K000158038.
Denial of service in F5 BIG-IP virtual servers with SSL profiles allows remote unauthenticated attackers to exhaust connection processing via undisclosed traffic patterns, forcing affected servers to reject new client connections. The vulnerability affects multiple BIG-IP product lines including classic BIG-IP and all BIG-IP Next variants (SPK, CNF, Kubernetes). F5 has released vendor patches (K000158978), and with CVSS 7.5 (AV:N/AC:L/PR:N/UI:N), this represents a straightforward network-based DoS attack requiring no authentication or special complexity.
Denial of service in F5 BIG-IP allows remote, unauthenticated attackers to terminate the Traffic Management Microkernel (TMM) and disrupt data-plane traffic processing. The flaw is a double-free (CWE-415) triggered by undisclosed network traffic, but exploitation is gated by a hardware precondition: the BIG-IP system must run on a multi-bladed chassis platform with more than one active blade, so single-blade and standard appliance deployments are not described as affected. No public exploit code has been identified at time of analysis, KEV status is not indicated, and EPSS is low at 0.35% (27th percentile); nevertheless, a TMM crash on a production load balancer can cause an immediate traffic outage. Vendor advisory: K000156912.
Denial of service in F5 BIG-IP allows remote, unauthenticated attackers to terminate the Traffic Management Microkernel (TMM) and disrupt traffic handling, but only on systems where IPsec is configured - deployments without an IPsec configuration are not exposed. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:N/VI:N/VA:H) and the corresponding CVSS 3.1 assessment agree that the effect is purely availability loss (a TMM crash), with no confidentiality or integrity impact, which makes this a high-severity (8.7) but non-compromising availability issue against appliances that are common internet-facing edge devices. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS score of roughly 0.37% (29th percentile) indicates low predicted exploitation likelihood in the near term, though the broad install base of BIG-IP keeps this worth prompt patching on IPsec-enabled systems.
Uncontrolled memory consumption in F5 BIG-IP Next for Kubernetes, BIG-IP Next Cloud-Native Network Functions and BIG-IP Next Service Proxy for Kubernetes lets remote attackers steadily exhaust memory on an affected appliance or pod by sending undisclosed crafted requests to a virtual server that has a client SSL profile attached. The assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N, with C:N/I:N/A:H) means no credentials and no user interaction are required once the TLS-terminating virtual server is reachable over the network, and the leak accumulates across requests until the service degrades or becomes unavailable. No public exploit code has been identified at time of analysis, EPSS is a low 0.46% (38th percentile), and the issue is not in CISA KEV, so this reads as a moderate availability-only risk rather than an emergency.
Denial of service in F5 BIG-IP Next deployments with HTTP/2 Ingress enabled allows unauthenticated network attackers to terminate the Traffic Management Microkernel (TMM) by sending HTTP/2 traffic that triggers the flaw, affecting BIG-IP Next Service Proxy for Kubernetes, Cloud-Native Network Functions, and BIG-IP Next for Kubernetes. The flaw is a NULL pointer dereference (CWE-476) with availability-only impact; no public exploit was identified at time of analysis, it is not in CISA KEV, and EPSS is 0.35% (27th percentile). This is a genuine but conditional denial-of-service risk rather than a code-execution emergency, since only instances configured for HTTP/2 Ingress are exposed.
Repeated calls to an undisclosed API endpoint can force the Traffic Management Microkernel (TMM) to terminate on F5 BIG-IP Next Cloud-Native Network Functions, BIG-IP Next Service Proxy for Kubernetes, and BIG-IP Next for Kubernetes, letting an attacker disrupt traffic processing on affected clusters. Exploitation requires network reach to the management/API surface plus valid low-privilege API credentials (CVSS PR:L), and impact is confined to availability with no confidentiality or integrity effect. EPSS is low at roughly 0.31% (22nd percentile), and no public exploit code or CISA KEV entry was identified at time of analysis; releases that have reached End of Technical Support are out of scope per the vendor.
Memory exhaustion in F5 BIG-IP Next can be induced when iRules configured through the declarative API are repeatedly re-instantiated, causing the Traffic Management Microkernel (TMM) cleanup process to leak memory and gradually degrade availability. The issue affects BIG-IP Next CNF, BIG-IP Next for Kubernetes 2.0.0, and BIG-IP Next Service Proxy for Kubernetes deployments that use declarative API-managed iRules, and requires authenticated low-privilege access to that API. Exploitation is not confirmed in CISA KEV, no public exploit code was identified at time of analysis, and EPSS is low at 0.31% (22nd percentile).
A remote, unauthenticated denial-of-service condition exists in F5 BIG-IP Policy Enforcement Manager (and the BIG-IP Next Cloud-Native Network Functions and BIG-IP Next for Kubernetes variants) when a classification profile is attached to a virtual server that lacks an HTTP or HTTP/2 profile - a non-default configuration. Undisclosed requests to such a virtual server can trigger memory corruption in the Traffic Management Microkernel (TMM), causing it to terminate and disrupting traffic processing. No public exploit code or CISA KEV entry is associated with this CVE, and EPSS is low (0.35%, 27th percentile), though the prerequisite profile combination sharply limits real-world exposure; F5 EoTS versions were not evaluated.
An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit (HTTP/2 MadeYouReset Attack). Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.