CVE-2025-54809

CVE-2025-54809 (F5 Access for Android) affects Android clients of F5 Access prior to version 3.1.2. The vulnerability arises because, when using HTTPS, the client does not verify the remote endpoint identity, enabling potential man-in-the-middle interception. Affected versions are 3.1.0–3.1.1; a ...

CVE-2025-54809 F5 Access for Android vulnerability

F5 Access for Android before version 3.1.2 which uses HTTPS does not verify the remote endpoint identity. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

K000152635: Quarterly Security Notification (August 2025)

Security Advisory Description On August 13, 2025, F5 announced the following security issues. This document is intended to serve as an overview of these vulnerabilities to help determine the impact to your F5 devices. You can find the details of each issue in the associated articles. You can watc...

K000152049: F5 Access for Android vulnerability CVE-2025-54809

Security Advisory Description F5 Access for Android before version 3.1.2, which uses HTTPS, does not verify the remote endpoint identity. CVE-2025-54809 Impact An attacker with a network position that allows them to intercept network traffic may be able to read and/or modify data in transit. The...

PT-2025-32984

Name of the Vulnerable Software and Affected Versions AMPHP affected versions not specified Apache Tomcat affected versions not specified Eclipse Foundation affected versions not specified F5 affected versions not specified Fastly affected versions not specified gRPC affected versions not specifi...

F5 BIG-IP APM 安全漏洞

F5 BIG-IP APM is a suite of access and security solutions from F5 USA. The product provides unified access to business-critical applications and networks. A security vulnerability exists in F5 BIG-IP APM that stems from configuring network access without properly handling specific traffic, which...

F5 BIG-IP APM 安全漏洞

F5 BIG-IP APM is a suite of access and security solutions from F5 USA. The product provides unified access to business-critical applications and networks. A security vulnerability exists in F5 BIG-IP APM that stems from an HTTP/2 implementation flaw that could lead to a denial-of-service attack...

F5 NGINX Plus和F5 NGINX Open Source 缓冲区错误漏洞

F5 NGINX Plus and F5 NGINX Open Source are both products of F5 Corporation, U.S.A. F5 NGINX Plus is a software-based application delivery platform.F5 NGINX Open Source is a high-performance web server, reverse proxy server, load balancer, and API gateway. A buffer error vulnerability exists in F5...

PT-2025-33006 · F5 · F5 Access For Android

Name of the Vulnerable Software and Affected Versions: F5 Access for Android versions prior to 3.1.2 Description: F5 Access for Android, when using HTTPS, does not verify the identity of the remote endpoint. Recommendations: Update to version 3.1.2 or later...

F5 BIG-IP 代码问题漏洞

F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, and load balancing from F5 USA. A code issue vulnerability exists in the F5 BIG-IP LTM, which stems from the fact that enabling the ADH encryption suite when configuring the...

K000152958: Curl vulnerability CVE-2021-22876

Security Advisory Description curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header. libcurl does not strip off user credentials from the URL when automatically populating the...

K000152955: PHP vulnerability CVE-2024-8927

Security Advisory Description In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, HTTPREDIRECTSTATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the...

K000152952: libxml2 vulnerability CVE-2025-6021

Security Advisory Description A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input. CVE-2025-6021 Impact...

F5 Networks BIG-IP : libuv vulnerability (K000152876)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K000152876 advisory. libuv is a multi-platform support library with a focus on asynchronous I/O. The uvgetaddrinfo function in...

K000152831: Oracle Java SE vulnerability CVE-2025-50059

Security Advisory Description Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for...

K000152788: Golang net/http vulnerability CVE-2025-22871

Security Advisory Description The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext...

K000152785: Linux kernel vulnerability CVE-2023-31436

Security Advisory Description qfqchangeclass in net/sched/schqfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQMINLMAX. CVE-2023-31436 Impact There is no impact; F5 products are not affected by this vulnerability. Security Advisory Status F5 Product...

K000152723: Golang crypto/tls vulnerabilities CVE-2023-39321 and CVE-2023-39322

Security Advisory Description CVE-2023-39321 Processing an incomplete post-handshake message for a QUIC connection can cause a panic. CVE-2023-39322 QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection...

K000152702: Node.js vulnerability CVE-2025-27209

Security Advisory Description The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the HashDoS vulnerability as an attacker who can control the strings to be hashed can generate many hash collisions - an attacker can...

K000152676: Golang net vulnerabilities CVE-2023-45290 and CVE-2024-24784

Security Advisory Description CVE-2023-45290 When parsing a multipart form either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile, limits on the total size of the parsed form were not applied to the memory consumed while...