Introduction
Unexpected traffic can bring down critical F5 BIG-IP infrastructure when ePVA hardware acceleration is enabled. Organizations that rely on these devices for application delivery and security may see service outages if the Traffic Management Microkernel (TMM) terminates under attack.
F5 Networks is a leading vendor of application delivery and security products, and BIG-IP is deployed in enterprises, telecoms, and government worldwide. Organizations use it for high-performance load balancing, SSL offload, and application security in demanding environments.
Technical Information
CVE-2025-53856 is a denial-of-service vulnerability in F5 BIG-IP systems equipped with embedded Packet Velocity Acceleration (ePVA) hardware. When ePVA is enabled on virtual servers, network address translation (NAT) objects, or secure network address translation (SNAT) objects, undisclosed traffic patterns can cause the Traffic Management Microkernel (TMM) process to terminate. All traffic processing then stops until TMM restarts.
The vulnerability is classified under CWE-705 (Incorrect Control Flow Scoping), which suggests a logic flaw in how TMM handles certain traffic when it is offloaded to ePVA hardware. F5 has not disclosed the root cause, the exploit vector, or the traffic that triggers the flaw. Neither F5 nor any public advisory has published code snippets or technical diagrams.
Only BIG-IP hardware platforms with ePVA chips are affected. F5 directs customers to K12837 for the list of affected models. Software-only platforms and hardware without ePVA are not affected.
Affected Systems and Versions
- F5 BIG-IP platforms with embedded Packet Velocity Acceleration (ePVA) hardware
- Vulnerable when ePVA is enabled on virtual servers, NAT objects, or SNAT objects
- Only hardware models listed in K12837 are affected
- Software versions that have reached End of Technical Support (EoTS) are not evaluated
Vendor Security History
F5 has previously disclosed vulnerabilities in TMM and in its hardware acceleration features. The company publishes quarterly security advisories and has a history of patching supported products promptly. In October 2025, F5 disclosed a separate nation-state compromise of its internal development systems, in which attackers stole source code and vulnerability data. No evidence links this incident to CVE-2025-53856.
