Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24

Export CSV
CVE-2023-44487

HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS 3.1 · 7.5 High EPSS 100.0% KEV · Listed
Vendors
Akka Amazon Apache and 30 more
Products
Http Server Opensearch Data Prepper Apisix and 375 more
CVE-2026-59762

BIG-IP HTTP/2 vulnerability

When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.   Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. This vulnerability allows a remote, unauthenticated attacker to cause a degradation of service that can lead to a denial-of-service (DoS) on the BIG-IP system. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Next Cloud-native Network Functions Big-ip Next Cnf and 3 more
CVE-2026-40629

BIG-IP SSL/TLS vulnerability

When SSL profiles are configured on a virtual server, undisclosed traffic can cause the virtual server to stop processing new client connections.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 24 more
CVE-2026-40618

BIG-IP SSL/TLS vulnerability

When an SSL profile is configured on a virtual server on BIG-IP Virtual Edition (VE) without Intel QuickAssist Technology (QAT) or on BIG-IP hardware platforms with the database variable crypto.hwacceleration set to disabled, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 24 more
CVE-2025-60016

BIG-IP SSL/TLS vulnerability

When Diffie-Hellman (DH) group Elliptic Curve Cryptography (ECC) Brainpool curves are configured in an SSL profile's Cipher Rule or Cipher Group, and that profile is applied to a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Next Cloud-native Network Functions Big-ip Next Service Proxy For Kubernetes
CVE-2025-48008

BIG-IP MPTCP vulnerability

When a TCP profile with Multipath TCP (MPTCP) enabled is configured on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 21 more
CVE-2025-46706

BIG-IP iRules vulnerability

When an iRule containing the HTTP::respond command is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 21 more
CVE-2025-55670

BIG-IP Next (CNF, SPK, and Kubernetes) vulnerability

On BIG-IP Next CNF, BIG-IP Next SPK, and BIG-IP Next for Kubernetes systems, repeated undisclosed API calls can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Next Big-ip Next Cloud-native Network Functions and 3 more
CVE-2025-54805

TMM Vulnerability

When an iRule is configured on a virtual server via the declarative API, upon re-instantiation, the cleanup process can cause an increase in the Traffic Management Microkernel (TMM) memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Next Big-ip Next Cloud-native Network Functions and 3 more
CVE-2025-58120

BIG-IP Next (CNF, SPK, and Kubernetes) vulnerability

When HTTP/2 Ingress is configured, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Next Big-ip Next Cloud-native Network Functions and 3 more
CVE-2025-61974

BIG-IP SSL/TLS vulnerability

When a client SSL profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Next Big-ip Next Cloud-native Network Functions and 3 more
CVE-2025-54500

HTTP/2 Vulnerability

An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit (HTTP/2 MadeYouReset Attack).  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 25 more
CVE-2025-41399

SCTP Vulnerability

When a Stream Control Transmission Protocol (SCTP) profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 22 more
CVE-2025-36504

BIG-IP HTTP/2 vulnerability

When a BIG-IP HTTP/2 httprouter profile is configured on a virtual server, undisclosed responses can cause an increase in memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 22 more
CVE-2025-22846

BIG-IP SIP Vulnerability

When SIP Session and Router ALG profiles are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 10 more
CVE-2025-36557

BIG-IP HTTP vulnerability

When an HTTP profile with the Enforce RFC Compliance option is configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Big-ip Access Policy Manager Big-ip Advanced Firewall Manager and 11 more
CVE-2023-24594

BIG-IP TMM SSL vulnerability

When an SSL profile is configured on a Virtual Server, undisclosed traffic can cause an increase in CPU or SSL accelerator resource utilization.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
F5
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Advanced Web Application Firewall and 17 more