Description
When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. This vulnerability allows a remote, unauthenticated attacker to cause a degradation of service that can lead to a denial-of-service (DoS) on the BIG-IP system. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity (CVSS)
| Base score | 8.7 |
|---|---|
| Severity | High |
| Version | CVSS 4.0 |
| Vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| Provided by | CNA |
Weaknesses
- CWE-770 — CWE-770: Allocation of Resources Without Limits or Throttling
Affected products
| Vendor | Product | Versions |
|---|---|---|
| F5 | BIG-IP | 21.1.0 to <21.1.0.1; 21.0.0 to <21.0.0.3; 17.5.0 to <17.5.1.8; 17.1.0 to <17.1.3.4 |
| F5 | BIG-IP Next for Kubernetes | 2.3.0 to <2.3.2; 2.0.0 to <2.2.3 |
| F5 | BIG-IP Next SPK | 1.9.0 to <*; 1.7.0 to <1.7.18 |
| F5 | BIG-IP Next CNF | 2.3.0 to <2.3.2; 2.0.0 to <2.2.3; 1.1.0 to <1.4.3 |
References
- https://my.f5.com/manage/s/article/K000162231 (vendor-advisory patch)
Generated from the official CVE List on 16 Jul 2026 07:01 UTC.