Introduction
A single malformed request can disrupt traffic inspection for thousands of users relying on F5 BIG-IP SSL Orchestrator. CVE-2025-55036 shows how one specific configuration of a widely deployed security appliance can expose enterprise networks to denial of service.
F5 Networks is a major vendor of application delivery and security products. Its BIG-IP line is deployed in many Fortune 500 companies, government agencies, and critical infrastructure. BIG-IP SSL Orchestrator is a specialized module that decrypts SSL/TLS traffic and orchestrates its inspection across security devices. That role puts it at the center of modern enterprise security architectures.
Technical Information
CVE-2025-55036 is an out-of-bounds write vulnerability (CWE-787) in the data plane of F5 BIG-IP SSL Orchestrator. It appears when the explicit forward proxy is configured on a virtual server and the proxy connect feature is enabled. In that configuration, specially crafted traffic (its specifics are undisclosed) can corrupt memory in the Traffic Management Microkernel (TMM). The process then terminates, and service degrades or stops entirely. Unauthenticated remote attackers can exploit the flaw without any user interaction. Only the data plane is affected. The control plane is not. As of the advisory date, there is no public exploit code or detection method.
Affected Systems and Versions
- Product: F5 BIG-IP SSL Orchestrator
- Affected versions:
- 17.1.0 through 17.1.2 (inclusive)
- 16.1.0 through 16.1.5 (inclusive)
- Vulnerable only when:
- Explicit forward proxy is configured on a virtual server
- Proxy connect feature is enabled
- Versions outside these ranges, including 17.1.3 and 16.1.6, are not affected.
Vendor Security History
F5 Networks has previously fixed vulnerabilities in BIG-IP products, including remote code execution, authentication bypass, and denial-of-service issues. The company publishes security notifications on a quarterly schedule, with detailed advisories that list affected versions and give patch guidance. F5 generally responds to vulnerabilities promptly, and it offers long-term support (LTS) releases for stability and security.
