F5 BIG-IP Next HTTP/2 Ingress Traffic Management Microkernel Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in F5 BIG-IP Next products (CNF, SPK, and Kubernetes) when HTTP/2 Ingress is configured. Undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate, disrupting service as the TMM process restarts. This issue allows a remote, unauthenticated attacker to cause a DoS on the BIG-IP system, affecting only the data plane.

Impact

Exploitation of this vulnerability disrupts traffic by causing the TMM process to terminate and restart, leading to a temporary denial-of-service condition on the BIG-IP system.

Remediation

F5 has released an engineering hotfix for this vulnerability, available through the MyF5 Downloads page. For more information about the hotfix policy, refer to the F5 critical issue hotfix policy article.