K61367237 : BIG-IP HTTP/3 QUIC vulnerability CVE-2020-5859

Security Advisory Description

Specially formatted HTTP/3 messages may cause the Traffic Management Microkernel (TMM) to produce a core file. (CVE-2020-5859)

Impact

TMM may restart and temporarily fail to process traffic on BIG-IP hosts with the HTTP/3 QUIC profile configured. High availability (HA) configurations will fail over the the standby host.

Note: Beginning in BIG-IP 15.1.0.1, F5 introduced HTTP/3 and QUIC as an experimental feature. For more information, refer to K60235402: Overview of the BIG-IP HTTP/3 and QUIC profiles. F5 recommends that you test experimental features only in your staging environment and not in production.