Introduction
A single malformed request can disrupt remote access for thousands of users relying on F5 BIG-IP APM. CVE-2025-53521 lets an unauthenticated remote attacker trigger a denial of service by crashing the core traffic engine on affected systems. Organizations that use F5 BIG-IP Access Policy Manager for secure access and authentication should review their deployments immediately.
About F5 Networks: F5 is a global leader in application delivery and security, and its BIG-IP products are deployed in enterprise, government, and cloud environments worldwide. Organizations depend on them for load balancing, access management, and application security, so a vulnerability in BIG-IP has consequences across many industries.
Technical Information
CVE-2025-53521 is a resource allocation vulnerability classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The flaw is present when a BIG-IP Access Policy Manager (APM) access policy is configured on a virtual server. If an attacker sends specially crafted traffic to that virtual server, the Traffic Management Microkernel (TMM) process terminates and restarts. F5 has not disclosed what the traffic looks like.
- The vulnerability is remotely exploitable without authentication.
- The root cause is insufficient resource management in APM policy processing, which lets certain traffic patterns exhaust or mismanage system resources.
- While TMM is down, all traffic handled by the BIG-IP device is disrupted until the process restarts.
Because F5 has not described the triggering traffic, defenders cannot easily write specific detection signatures for it. The termination itself is protective: TMM shuts down when resource thresholds are exceeded or mismanaged during policy evaluation, which sets it apart from a traditional crash.
Affected Systems and Versions
CVE-2025-53521 affects the following F5 BIG-IP APM versions when an access policy is configured on a virtual server:
- BIG-IP APM 17.5.0 through 17.5.1
- BIG-IP APM 17.1.0 through 17.1.2
- BIG-IP APM 16.1.0 through 16.1.5 (or 16.1.6 per some advisories)
- BIG-IP APM 15.1.0 through 15.1.10
Fixed versions are:
- 17.5.1.3 or later
- 17.1.3 or later
- 16.1.6.1 or later
- 15.1.10.8 or later
Only systems with an APM access policy configured on a virtual server are vulnerable.
Vendor Security History
F5 has previously fixed critical vulnerabilities in BIG-IP components, including:
- CVE-2020-5902: Remote code execution in TMUI, exploited in the wild within days of disclosure
- CVE-2023-46747: Authentication bypass and remote code execution in TMUI
- Multiple denial-of-service flaws in TMM and APM modules
F5 has improved its patch response with quarterly advisories and fixes backported to supported versions. The recurring issues in TMM and APM, though, indicate that securing complex traffic management code is still a challenge for the company.
