Introduction
Unexpected outages on F5 BIG-IP can disrupt critical business applications and services, especially when crafted HTTP/2 traffic triggers them. On October 15, 2025, F5 disclosed CVE-2025-55669, a high-severity vulnerability in the BIG-IP Advanced Web Application Firewall (WAF) and Application Security Manager (ASM) modules when they are combined with server-side HTTP/2 profiles. A remote, unauthenticated attacker can use the flaw to make the Traffic Management Microkernel (TMM) terminate, which denies service to all traffic the affected virtual server handles.
About F5 Networks and BIG-IP: F5 Networks is a major vendor in the application delivery and security market. Its BIG-IP platform is widely deployed in enterprise, government, and service provider environments, where it provides traffic management, load balancing, and security features. Many organizations consider it a critical infrastructure component.
Technical information
CVE-2025-55669 requires a BIG-IP virtual server configured with both an Advanced WAF or ASM security policy and a server-side HTTP/2 profile. With both in place, certain undisclosed HTTP/2 traffic patterns can make the TMM process terminate unexpectedly. The vulnerability is classified as CWE-672 (Operation on a Resource after Expiration or Release), a weakness class that typically covers use-after-free and similar resource management errors.
The root cause is likely a complex interaction between HTTP/2 stream lifecycle management and the enforcement of WAF or ASM security policies. When HTTP/2 streams are rapidly created, reset, or closed while security inspection runs on them, the TMM may reference memory or resources that have already been released. That crashes the TMM process and denies service on the affected virtual server. F5 has not disclosed any public code snippets or detailed exploit traffic, and it keeps the exact triggering sequence undisclosed to limit exploitation risk.
Affected systems and versions
- Products: F5 BIG-IP Advanced WAF and Application Security Manager (ASM)
- Affected only when a security policy (WAF or ASM) and a server-side HTTP/2 profile are both configured on the same virtual server
- Version ranges:
- BIG-IP 17.1.0 through 17.1.2
- BIG-IP 16.1.0 through 16.1.5
- Fixed in: BIG-IP 17.1.2.2
Vendor security history
F5 has previously fixed several critical vulnerabilities in BIG-IP, including:
- CVE-2020-5902: Remote code execution in the management interface
- CVE-2021-23009: TMM crash on malformed HTTP/2 traffic
- CVE-2025-54500: HTTP/2 DoS via CPU exhaustion
F5 usually publishes advisories and patch releases promptly, along with detailed quarterly security notifications and upgrade guidance. Its vulnerability disclosure process is mature, and the company updates its security best practices regularly.
