BIG-IP HTTP/2 vulnerability
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| F5 | BIG-IP | unknown |
|
|||||||||||||||
| F5 | BIG-IP Next for Kubernetes | unknown |
|
|||||||||||||||
| F5 | BIG-IP Next SPK | unknown |
|
|||||||||||||||
| F5 | BIG-IP Next CNF | unknown |
|
Configuration 1 [-]
|
No data.
| Vendor | Product | Versions | ||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| F5 | Big-ip |
|
||||||||||||||||||||
| F5 | Big-ip Next Cnf |
|
||||||||||||||||||||
| F5 | Big-ip Next For Kubernetes |
|
||||||||||||||||||||
| F5 | Big-ip Next Spk |
|
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.573% probability within 30 days)
| Link | Providers |
|---|---|
| https://my.f5.com/manage/s/article/K000162231 |
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
F5
F5 big-ip F5 big-ip Next Cnf F5 big-ip Next For Kubernetes F5 big-ip Next Spk |
|
| Vendors & Products |
F5
F5 big-ip F5 big-ip Next Cnf F5 big-ip Next For Kubernetes F5 big-ip Next Spk |
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. This vulnerability allows a remote, unauthenticated attacker to cause a degradation of service that can lead to a denial-of-service (DoS) on the BIG-IP system. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | |
| Title | BIG-IP HTTP/2 vulnerability | |
| Weaknesses | CWE-770 | |
| References |
| |
| Metrics |
cvssV3_1
|