Description (CNA)
When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. This vulnerability allows a remote, unauthenticated attacker to cause a degradation of service that can lead to a denial-of-service (DoS) on the BIG-IP system. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| F5 / BIG-IP | affected 21.1.0 before 21.1.0.1; affected 21.0.0 before 21.0.0.3; affected 17.5.0 before 17.5.1.8; affected 17.1.0 before 17.1.3.4 |
| F5 / BIG-IP Next for Kubernetes | affected 2.3.0 before 2.3.2; affected 2.0.0 before 2.2.3 |
| F5 / BIG-IP Next SPK | affected 1.9.0 before *; affected 1.7.0 before 1.7.18 |
| F5 / BIG-IP Next CNF | affected 2.3.0 before 2.3.2; affected 2.0.0 before 2.2.3; affected 1.1.0 before 1.4.3 |
CWE
CWE-770
References
ADP enrichment
No English description supplied.
No references supplied.