Introduction
On October 15, 2025, F5 Networks disclosed a high-severity vulnerability in BIG-IP Advanced WAF and Application Security Manager (ASM). When these products process certain malformed JSON schemas in security policies, the core bd process can terminate. The result is an unexpected service interruption and a loss of web application security enforcement.
About F5 and BIG-IP: F5 Networks is a leading vendor in the application delivery and security market. Its BIG-IP product line is widely deployed in enterprise and critical infrastructure environments for load balancing, web application firewalling, and advanced security controls. The Advanced WAF and ASM modules protect web applications and APIs for thousands of organizations globally.
Technical Information
CVE-2025-54858 arises when a BIG-IP Advanced WAF or ASM security policy is configured with a JSON content profile that includes a malformed JSON schema. If this policy is applied to a virtual server, certain undisclosed HTTP request patterns can trigger uncontrolled recursion in the bd daemon's JSON schema validation logic. The recursion consumes excessive stack or memory and eventually crashes the bd process.
The root cause is improper handling of recursive structures or circular references in JSON schemas. When bd parses and validates these schemas, it does not adequately bound or check recursion depth. A triggering request sends the process into a recursive loop that exhausts system resources. The vulnerability is classified as CWE-674 (Uncontrolled Recursion).
The bd daemon enforces security policies on HTTP requests. When it terminates, security enforcement stops until the process restarts, and during that window protected applications may be exposed to attacks or unfiltered traffic.
The vulnerability appears only when malformed JSON schemas are present in active security policies. Well-formed schemas and policies without JSON content profiles are not affected.
Affected Systems and Versions
- Products: F5 BIG-IP Advanced WAF and Application Security Manager (ASM)
- Affected versions: 17.5.0 through 17.5.1
- Vulnerable only when a security policy is configured with a JSON content profile containing a malformed JSON schema and applied to a virtual server
- Fixed in: 17.5.1.3 and 17.1.3
Vendor Security History
F5 has previously fixed vulnerabilities in the ASM and Advanced WAF components related to JSON processing and the bd daemon. Notable examples include:
- CVE-2020-27718 (JSON parameter parsing)
- CVE-2022-41836 and CVE-2022-26890 (bd daemon issues)
In October 2024, F5 suffered a major security incident in which nation-state actors stole source code and vulnerability data. The incident has increased scrutiny of F5's security practices and response times. F5 has kept a regular schedule of security notifications and timely patch releases, but recurring issues in core components remain a concern.
