CVE-2026-59762

Published: Jul 15, 2026Modified: Aug 6, 2026

8.7

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: f5sirt@f5.com (Secondary)

Description

When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. This vulnerability allows a remote, unauthenticated attacker to cause a degradation of service that can lead to a denial-of-service (DoS) on the BIG-IP system. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected (8)

Products: F5: Big Ip Next Cloud Native Network Functions, Big Ip Next For Kubernetes, Big Ip Next Service Proxy For Kubernetes

3 products

Big Ip Next Cloud Native Network Functions

Big Ip Next For Kubernetes

Big Ip Next Service Proxy For Kubernetes

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
F5 Big Ip Next Cloud Native Network Functions	1.1.0 ≤ version < 1.4.3
F5 Big Ip Next Cloud Native Network Functions	2.0.0 ≤ version < 2.2.3
F5 Big Ip Next Cloud Native Network Functions	Version 2.3.0
F5 Big Ip Next For Kubernetes	2.0.0 ≤ version < 2.2.3
F5 Big Ip Next For Kubernetes	Version 2.3.0
F5 Big Ip Next Service Proxy For Kubernetes	1.7.0 ≤ version < 1.7.18
F5 Big Ip Next Service Proxy For Kubernetes	1.8.0 ≤ version ≤ 1.9.2
F5 Big Ip Next Service Proxy For Kubernetes	2.0.0 ≤ version ≤ 2.0.3

Related CWEs

CWE-770

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (1)

https://my.f5.com/manage/s/article/K000162231

Source: f5sirt@f5.com

Vendor Advisory

Timeline

No history available yet.