The vulnerability causes a virtual server with SSL/TLS profiles to become unresponsive, halting new client connections when it encounters undisclosed traffic. This results in a denial of service that could affect all clients attempting to reach the affected service. The identified weakness is CWE-770, indicating an out‑of‑bounds condition that breaks service availability.

Affected are F5 BIG‑IP, BIG‑IP Next CNF, BIG‑IP Next SPK, and BIG‑IP Next for Kubernetes. All software supporting configurable SSL profiles on a virtual server is at risk. Versions reaching End of Technical Support are not evaluated.

The CVSS score of 8.7 classifies this as a high‑severity issue. No EPSS score is available and the vulnerability is not listed in CISA KEV, indicating the exploitation likelihood is currently unknown. However, the nature of the attack—a return of an error caused by undisclosed traffic—suggests an adversary could craft specific SSL traffic to trigger the service halt. In the absence of publicly disclosed exploits, the risk remains theoretical, but the high score warrants prompt mitigation.