Technical impact
The vulnerability arises when a Client SSL profile on a UDP virtual server has Allow Dynamic Record Sizing enabled. Undisclosed traffic that triggers this configuration can cause the Traffic Management Microkernel to terminate, resulting in a denial of service to the affected system. The weakness is classified as CWE-835, indicating an infinite loop or unbounded processing condition.
Affected Systems
The affected vendor is F5 and the product is BIG‑IP. No specific software version range is provided in the advisory, so all currently supported BIG‑IP releases that use UDP virtual servers with the Allow Dynamic Record Sizing setting are potentially impacted.
Risk and Exploitability
The vulnerability has a CVSS score of 8.7, placing it in the High severity range. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network-based: an attacker can send crafted traffic to the vulnerable UDP virtual server to trigger the crash. Once the TMM terminates, the BIG‑IP appliance may become unavailable until a manual restart or patch is applied. The high CVSS score coupled with a plausible exploitation scenario indicates substantial risk for organizations that have exposed such virtual servers to the Internet or untrusted networks.
