Introduction
A single crafted traffic pattern can disrupt all encrypted traffic inspection in a major enterprise and cause outages across critical applications. In F5 BIG-IP SSL Orchestrator, CVE-2025-41430 lets remote attackers force the Traffic Management Microkernel (TMM) to terminate, which denies service until the process restarts.
F5 Networks is a leading global vendor of application delivery and security products, and its BIG-IP platform is deployed in thousands of enterprise and service provider networks. Many of those organizations use the SSL Orchestrator module for SSL/TLS decryption and traffic inspection, so this vulnerability matters most to anyone who relies on deep packet inspection and secure application delivery.
Technical Information
CVE-2025-41430 is a data plane denial of service vulnerability in F5 BIG-IP SSL Orchestrator. When SSL Orchestrator is enabled, remote unauthenticated attackers can send undisclosed traffic that causes the Traffic Management Microkernel (TMM) to terminate. All traffic processing on the affected BIG-IP instance stops until TMM restarts. The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), which points to a resource exhaustion or resource management flaw. The attack needs no authentication and does not affect the control plane or management interfaces. No public exploit details or code snippets are available. F5 tracks the issue internally as ID 1785245.
Affected Systems and Versions
- Product: F5 BIG-IP SSL Orchestrator
- Vulnerable only when SSL Orchestrator is enabled
- Affected versions:
- 15.1.0 through 15.1.9
- 16.1.0 through 16.1.3 (fixed in 16.1.4 and later)
- 17.0.0 through 17.1.2.1 (fixed in 17.1.2.2 and later)
- Only the data plane is affected. The control plane is not.
- Every deployment model (hardware, virtual, cloud) is affected if it runs a vulnerable version with SSL Orchestrator enabled.
Vendor Security History
F5 has previously fixed several high-profile vulnerabilities in the BIG-IP product line, including TMM-related denial of service and remote code execution issues. Examples include CVE-2021-22986 (iControl REST authentication bypass) and other TMM resource management flaws. F5 usually publishes advisories and patches promptly, along with structured guidance for affected customers, and its vulnerability response process is mature.
