An undisclosed pattern of traffic on a configured HTTP/2 virtual server can inflate memory usage, causing the Traffic Management Microkernel process to terminate. This leads to service interruption for the affected BIG‑IP device. The flaw is a memory management error identified as CWE-770, where unchecked allocation growth can exhaust available resources.

F5 BIG‑IP devices running an HTTP/2 virtual server with Layer 7 DoS Protection enabled are affected. The specific versions are not listed, but any supported release that has not reached End of Technical Support is at risk.

The vulnerability earned a CVSS score of 8.7, indicating high severity. No EPSS score is available, so the current exploitation probability is uncertain, though the lack of an EPSS value does not preclude exploitation. The issue is not listed in CISA KEV, suggesting no confirmed public exploits yet. Based on the description, the attack likely originates from remote network traffic directed at the affected virtual server.