When an HTTP/2 profile and an iRule that uses the HTTP::redirect or HTTP::respond command are configured together on a virtual server, a specially crafted request can cause the Traffic Management Microkernel (TMM) process to crash, resulting in a denial of service. The weakness is an instance of a null pointer dereference (CWE‑476). The vulnerability may only be triggered with undisclosed requests; the official description does not detail the request format or required authentication level.

The vulnerable products are F5 BIG‑IP, F5 BIG‑IP Next CNF, F5 BIG‑IP Next SPK, and F5 BIG‑IP Next for Kubernetes, all versions that are still under support. No specific affected version numbers are disclosed; software that has reached End of Technical Support was not evaluated.

The CVSS score of 8.7 indicates a high severity risk. EPSS data is unavailable so the probability of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog, implying that no widespread exploitation is currently known. The likely attack vector is a network attempt against a virtual server configured with HTTP/2 and the mentioned iRules, requiring no special privileges, and could be carried out by any party that can send HTTP/2 traffic to the target.