← Back

CVE-2026-41227

nvd nist
Published: May 13, 2026Modified: Jun 24, 2026

JSON object

Loading...
8.7
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: f5sirt@f5.com (Secondary)

Description

On an HTTP/2 virtual server with Layer 7 DoS Protection configured, undisclosed traffic can result in an increase in memory consumption causing the Traffic Management Microkernel (TMM) process to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected (9)

F5
3 products
Big Ip Advanced Web Application Firewall
Big Ip Application Security Manager
Big Ip Ddos Hybrid Defender
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
F5
Big Ip Advanced Web Application Firewall
From 17.1.0 to 17.1.3
Big Ip Advanced Web Application Firewall
From 17.5.0 to 17.5.1
F5
Big Ip Application Security Manager
From 17.1.0 to 17.1.3
Big Ip Application Security Manager
From 17.5.0 to 17.5.1
F5
Big Ip Ddos Hybrid Defender
From 17.1.0 to 17.1.3
Big Ip Ddos Hybrid Defender
From 17.5.0 to 17.5.1
Configuration B
3 vulnerable
Vulnerable SoftwareAffected Versions
Big Ip Advanced Web Application Firewall
From 16.1.0 to 16.1.6
Big Ip Application Security Manager
From 16.1.0 to 16.1.6
Big Ip Ddos Hybrid Defender
From 16.1.0 to 16.1.6

Related CWEs

CWE-770
Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (1)

Source: f5sirt@f5.com
Vendor Advisory

Timeline

No history available yet.