CVE-2026-59762

CVE-2026-59762 affects BIG-IP’s TMM when an HTTP/2 profile is configured on a virtual server. Affected: HTTP/2 profile handling can cause undisclosed requests to increase memory resource utilization, leading to degraded system performance and potential DoS. This is a remote, unauthenticated data-...

CVE-2023-45886

The CVE-2023-45886 issue affects the BGP daemon (bgpd) in IP Infusion ZebOS up to version 7.10.6. It allows remote attackers to cause a DoS by sending crafted BGP UPDATE messages with a malformed attribute. Public sources (Red Hat advisory, CERT VU, and F5/K000137315) corroborate the vulnerabilit...

CVE-2026-40629

CVE-2026-40629 affects BIG-IP SSL/TLS when SSL profiles are configured on a virtual server. The issue can cause the virtual server to stop processing new client connections, effectively a DoS for new connections. The F5 advisory confirms this is a data plane issue; no control plane exposure. Miti...

CVE-2024-25560

CVE-2024-25560 affects F5 BIG-IP AFM/TMM: when a DNS profile is applied to a virtual server, undisclosed DNS traffic can cause the Traffic Management Microkernel (TMM) to terminate, leading to DoS. The advisory K000139037 lists affected branches and fixes: BIG-IP (all modules) 17.x (17.1.0 vulner...

CVE-2024-41164

CVE-2024-41164 affects BIG-IP when a TCP profile with Multipath TCP (MPTCP) is configured on a Virtual Server. Undisclosed traffic and conditions outside the attacker’s control can cause the Traffic Management Microkernel (TMM) to terminate, resulting in DoS. MODE C documents concrete details fro...

CVE-2024-28132

CVE-2024-28132 affects BIG-IP Next CNF and is a Sensitive Information disclosure in the GSLB container. An authenticated attacker with administrator privileges may exploit it locally to view sensitive information. Affected versions: 1.2.0–1.2.1 . Root cause: exposure within the GSLB container; fi...

CVE-2025-36557

CVE-2025-36557 affects F5 BIG-IP BIG-IP Next and related platforms where an HTTP profile configured with Enforce RFC Compliance can cause the Traffic Management Microkernel (TMM) to terminate due to undisclosed requests. Impact is described as DoS with TMM restart disruption and potential data-pl...

CVE-2025-41414

Summary of CVE-2025-41414 (BIG-IP HTTP/2 vulnerability) Issue: When HTTP/2 client and server profiles are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate, resulting in DoS via traffic disruption as the TMM restarts. This is a da...

CVE-2025-41399

CVE-2025-41399 affects BIG-IP products when a Stream Control Transmission Protocol (SCTP) profile is configured on a virtual server, causing undisclosed requests to increase memory resource utilization and potentially degrade performance or cause DoS via a reset/restart of the TMM process. The Re...

CVE-2025-36504

CVE-2025-36504 affects BIG-IP when an HTTP/2 httprouter profile is configured on a virtual server. The issue can cause undisclosed responses that lead to increased memory/resource utilization, potentially degrading performance and causing DoS-like impact on the BIG-IP system. Security advisory K0...

CVE-2025-61974

CVE-2025-61974 describes a memory-resource vulnerability in F5 BIG‑IP where, when a client SSL profile is configured on a virtual server, undisclosed requests can cause increased memory usage, leading to degraded performance or DoS. Affected BIG‑IP versions include 15.1.x (up to 15.1.10.8), 16.1....

CVE-2026-42409

CVE-2026-42409 affects BIG-IP: when an HTTP/2 profile is used with an iRule containing HTTP::redirect or HTTP::respond on a virtual server, undisclosed requests can crash the Traffic Management Microkernel (TMM), causing DoS. Evidence in connected docs shows affected products: BIG-IP (all modules...

CVE-2025-24312

CVE-2025-24312 affects BIG-IP AFM. When IPS is enabled and a protocol inspection profile is configured on a virtual server or policy, undisclosed traffic can cause CPU resource utilization, potentially leading to DoS. Affected fixes are provided in: BIG-IP AFM 17.1.0–17.1.1 (fix 17.1.2); BIG-IP A...

CVE-2024-23306

CVE-2024-23306 affects BIG-IP Next CNF. An authenticated attacker with enough privileges can access undisclosed sensitive files, impacting confidentiality and integrity (CVSSv3 7.1). Vulnerable: BIG-IP Next CNF 1.1.0–1.1.1. Fix available in 1.2.0 per F5 advisory K000137886. Recommend upgrading to...

CVE-2026-40618

CVE-2026-40618 affects BIG-IP SSL/TLS when an SSL profile is on a virtual server and either QAT is not available (VE) or crypto.hwacceleration is disabled on hardware. This can cause TMM to terminate, resulting in a data-plane DoS with traffic disruption as TMM restarts. Affected BIG-IP lines inc...

CVE-2026-41956

CVE-2026-41956 affects BIG-IP TMM. When a classification profile is configured on a UDP virtual server, undisclosed requests can cause TMM termination, producing DoS on the BIG-IP data plane. From F5 advisories, vulnerable lines include BIG-IP (all modules) UDP virtual servers across 17.x and 21....

CVE-2025-54500

CVE-2025-54500 describes an HTTP/2 implementation flaw that allows a DoS via malformed HTTP/2 control frames to break the max concurrent streams limit (the MadeYouReset attack). Affected products are F5 BIG-IP and BIG-IP Next families with multiple vulnerable branches; affected versions include B...

CVE-2025-59781

CVE-2025-59781 affects BIG-IP and BIG-IP Next CNF DNS cache configurations. When DNS cache is enabled on a BIG-IP virtual server, undisclosed DNS queries can cause increased memory utilization, potentially degrading performance or causing DoS via TMM process restart. Affected products include BIG...

CVE-2025-61990

CVE-2025-61990 affects F5 BIG-IP Traffic Management Microkernel (TMM) on multi-bladed platforms. An undisclosed traffic pattern can cause TMM to terminate, producing a DoS as the TMM restarts. Affected products include BIG-IP (various modules) and BIG-IP Next branches (SPK/CNF/Kubernetes) with vu...

CVE-2025-58071

CVE-2025-58071 affects F5 BIG-IP IPsec: undisclosed IPsec traffic can trigger a DoS by terminating the Traffic Management Microkernel (TMM). The vulnerability is confirmed across multiple vendor advisories and CVE feeds (NVD/CNVD/EUVD/CIRCL), with remediation provided in F5 advisories. Affected b...

CVE-2025-58120

CVE-2025-58120 affects BIG-IP Next SPK, CNF, and Kubernetes (2.x branches). When HTTP/2 Ingress is configured, undisclosed traffic can trigger a NULL pointer dereference in the Traffic Management Microkernel (TMM), causing termination and a denial-of-service condition. Vulnerable known versions i...

CVE-2025-60016

CVE-2025-60016 affects BIG-IP/TMM when a Diffie-Hellman ECC Brainpool curve is configured in an SSL profile (Cipher Rule or Cipher Group) and that profile is applied to a virtual server. Traffic that is not disclosed can cause the Traffic Management Microkernel (TMM) to terminate, resulting in Do...

CVE-2025-46706

CVE-2025-46706 affects BIG-IP BIG-IP Next where iRules containing HTTP::respond can cause memory/resource exhaustion on the data plane, enabling a remote, unauthenticated DoS. Affected product/version sets include BIG-IP Next SPK/CNF and BIG-IP (all modules) on 16.1.x (1.0–1.5) and 17.1.x (0–2). ...

CVE-2025-48008

CVE-2025-48008 affects BIG-IP BIG-IP Next SPK/CNF and BIG-IP when a TCP profile with MPTCP is enabled; undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate, producing a DoS condition. Remediation information in the associated advisory indicates fixes were introduced...

CVE-2025-54479

CVE-2025-54479 affects F5 BIG-IP BIG-IP PEM/Traffic Management Microkernel (TMM) when a classification profile is configured on a virtual server without an HTTP or HTTP/2 profile, causing TMM termination and potential DoS. Multiple sources corroborate the issue and list affected products/branches...

CVE-2025-55670

The CVE-2025-55670 entry concerns BIG-IP Next CNF, BIG-IP Next SPK, and BIG-IP Next for Kubernetes. Repeated undisclosed API calls can cause the Traffic Management Microkernel (TMM) to terminate, resulting in DoS for affected systems. Public references (NVD/Red Hat EU V) corroborate the same desc...

CVE-2025-54805

CVE-2025-54805 describes a memory resource management vulnerability in F5 BIG-IP Next TMM. When an iRule is configured on a virtual server via the declarative API, cleanup on re-instantiation can increase TMM memory utilization, potentially degrading system performance and enabling a DoS-like imp...