BIG-IP FastL4 virtual server vulnerability (F5 BIG-IP)
En bref
- Source
- NVD
- EPSS
- EPSS 0.18 % · centile 7 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- f5
- Statut NVD
- Analyzed
Rechercher sur…
Description
When embedded Packet Velocity Acceleration (ePVA) acceleration is configured, undisclosed local ethernet traffic can cause an increase in ePVA and Traffic Management Microkernel (TMM) resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Faiblesses (CWE)
- CWE-835 — Boucle dont la condition de sortie est inatteignable (boucle infinie)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | f5 |
| CVSS 4.0 | HIGH 7.1 | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | f5 |
| CVSS 4.0 | HIGH 7.1 | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · f5sirt@f5.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · f5sirt@f5.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-30002
- GCVE · GCVE-0-2026-42781
Avis du CERT-FR
- CERTFR-2026-AVI-0591 — Multiples vulnérabilités dans les produits F5 · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:f5:big-ip_access_policy_manager:21.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_advanced_firewall_manager:21.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:21.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_analytics:21.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_application_acceleration_manager:21.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_application_security_manager:21.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:21.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_automation_toolchain:21.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_carrier-grade_nat:21.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_container_ingress_services:21.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:21.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_domain_name_system:21.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_edge_gateway:21.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_fraud_protection_service:21.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_global_traffic_manager:21.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_link_controller:21.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_local_traffic_manager:21.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_policy_enforcement_manager:21.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_ssl_orchestrator:21.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_webaccelerator:21.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_websafe:21.0.0:*:*:*:*:*:*:*cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:*≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_automation_toolchain:*:*:*:*:*:*:*:*≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*≥ 17.1.0 ≤ 17.1.3cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*≥ 17.5.0 ≤ 17.5.1cpe:2.3:a:f5:big-ip_container_ingress_services:*:*:*:*:*:*:*:*≥ 17.1.0 ≤ 17.1.3- +23 autres
Produits affectés
| Produit | Versions |
|---|---|
| F5 · BIG-IP | unaffected 21.1.0 < * ; affected 21.0.0 < 21.0.0.1 ; affected 17.5.0 < 17.5.1.4 ; affected 17.1.0 < 17.1.3.1 ; unaffected 16.1.0 < * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |