CVE-2026-41227

BIG-IP HTTP/2 Layer 7 Dos Protection vulnerability

Published May 13, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

On an HTTP/2 virtual server with Layer 7 DoS Protection configured, undisclosed traffic can result in an increase in memory consumption causing the Traffic Management Microkernel (TMM) process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Analysis

Technical impact

An undisclosed pattern of traffic on a configured HTTP/2 virtual server can inflate memory usage, causing the Traffic Management Microkernel process to terminate. This leads to service interruption for the affected BIG‑IP device. The flaw is a memory management error identified as CWE-770, where unchecked allocation growth can exhaust available resources.

Affected Systems

F5 BIG‑IP devices running an HTTP/2 virtual server with Layer 7 DoS Protection enabled are affected. The specific versions are not listed, but any supported release that has not reached End of Technical Support is at risk.

Risk and Exploitability

The vulnerability earned a CVSS score of 8.7, indicating high severity. No EPSS score is available, so the current exploitation probability is uncertain, though the lack of an EPSS value does not preclude exploitation. The issue is not listed in CISA KEV, suggesting no confirmed public exploits yet. Based on the description, the attack likely originates from remote network traffic directed at the affected virtual server.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

BIG-IP

unaffected

Version	Status	Constraints
`21.0.0`	unaffected	< *
`17.5.0`	affected	< 17.5.1.4
`17.1.0`	affected	< 17.1.3.1
`16.1.0`	affected	< *

Configuration 1 [-]

OR	cpe:2.3:a:f5:big-ip_advanced_web_application_firewall::::::::
	cpe:2.3:a:f5:big-ip_advanced_web_application_firewall::::::::
	cpe:2.3:a:f5:big-ip_application_security_manager::::::::
	cpe:2.3:a:f5:big-ip_application_security_manager::::::::
	cpe:2.3:a:f5:big-ip_ddos_hybrid_defender::::::::
	cpe:2.3:a:f5:big-ip_ddos_hybrid_defender::::::::

Configuration 2 [-]

OR	cpe:2.3:a:f5:big-ip_advanced_web_application_firewall::::::::
	cpe:2.3:a:f5:big-ip_application_security_manager::::::::
	cpe:2.3:a:f5:big-ip_ddos_hybrid_defender::::::::

No data.

Vendor Product Versions

Big-ip

Version	Status	Scheme	Platform
`[21.0.0,*]`	unaffected	semver	—
`[17.5.0,17.5.1.4)`	affected	generic	—
`[17.1.0,17.1.3.1)`	affected	generic	—
`[16.1.0,*]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest F5 BIG‑IP firmware or patch that resolves the memory overflow issue.
If a patch is not yet available, temporarily disable HTTP/2 on the affected virtual servers.
Consider removing or disabling Layer 7 DoS Protection on the virtual servers until the vulnerability is formally fixed.

Generated by OpenCVE AI on May 13, 2026 at 17:15 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.263% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://my.f5.com/manage/s/article/K000158979

History

May 13, 2026 5:15 PM First appearance in the feed. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		F5 F5 big-ip
Vendors & Products		F5 F5 big-ip
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 13, 2026 3:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		On an HTTP/2 virtual server with Layer 7 DoS Protection configured, undisclosed traffic can result in an increase in memory consumption causing the Traffic Management Microkernel (TMM) process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Title		BIG-IP HTTP/2 Layer 7 Dos Protection vulnerability
Weaknesses		CWE-770
References		https://my.f5.com/manage/s/article/K000158979
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`