CVE-2026-59762

Опубликовано: 15 июл. 2026

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization.

Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. This vulnerability allows a remote, unauthenticated attacker to cause a degradation of service that can lead to a denial-of-service (DoS) on the BIG-IP system. There is no control plane exposure; this is a data plane issue only.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Ссылки

https://my.f5.com/manage/s/article/K000162231
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:f5:big-ip_next_cloud-native_network_functions:*:*:*:*:*:*:*:*

Версия от 1.1.0 (включая) до 1.4.3 (исключая)

cpe:2.3:a:f5:big-ip_next_cloud-native_network_functions:*:*:*:*:*:*:*:*

Версия от 2.0.0 (включая) до 2.2.3 (исключая)

cpe:2.3:a:f5:big-ip_next_cloud-native_network_functions:2.3.0:*:*:*:*:*:*:*

cpe:2.3:a:f5:big-ip_next_for_kubernetes:*:*:*:*:*:*:*:*

Версия от 2.0.0 (включая) до 2.2.3 (исключая)

cpe:2.3:a:f5:big-ip_next_for_kubernetes:2.3.0:*:*:*:*:*:*:*

cpe:2.3:a:f5:big-ip_next_service_proxy_for_kubernetes:*:*:*:*:*:*:*:*

Версия от 1.7.0 (включая) до 1.7.18 (исключая)

cpe:2.3:a:f5:big-ip_next_service_proxy_for_kubernetes:*:*:*:*:*:*:*:*

Версия от 1.8.0 (включая) до 1.9.2 (включая)

cpe:2.3:a:f5:big-ip_next_service_proxy_for_kubernetes:*:*:*:*:*:*:*:*

Версия от 2.0.0 (включая) до 2.0.3 (включая)

EPSS

Процентиль: 38%

0.0046

Низкий

7.5 High

CVSS3

Дефекты

CWE-770

Связанные уязвимости

GHSA-3vvh-xmcx-wpgh

CVSS3: 7.5

github

около 1 месяца назад

When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. This vulnerability allows a remote, unauthenticated attacker to cause a degradation of service that can lead to a denial-of-service (DoS) on the BIG-IP system. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

EPSS

Процентиль: 38%

0.0046

Низкий

7.5 High

CVSS3

Дефекты

CWE-770