Introduction
One non-default configuration change on an F5 BIG-IP system can cause a complete service interruption for critical applications. CVE-2025-58096 is a high-severity denial of service vulnerability in the Traffic Management Microkernel (TMM). It is exposed only when a specific non-default setting is enabled, and in that configuration a remote attacker can cause a service outage.
About F5 Networks and BIG-IP: F5 Networks is a major vendor in the application delivery and security market. BIG-IP is its core platform for load balancing, SSL offloading, and web application security. BIG-IP devices run in enterprise, government, and service provider networks worldwide, so a vulnerability in the platform reaches across many industries.
Technical information
CVE-2025-58096 is in TMM, the BIG-IP component that processes all data plane traffic. The vulnerability is exposed only when the database variable tm.tcpudptxchecksum is set to Software-only instead of the default hardware offload mode. In this configuration, TMM calculates TCP and UDP checksums in software rather than using hardware acceleration.
In Software-only mode, certain undisclosed traffic patterns can trigger an out-of-bounds write (CWE-787) in TMM. The TMM process terminates immediately, and all traffic is dropped until it restarts. A remote, unauthenticated attacker who can send crafted packets to any BIG-IP virtual server can exploit the flaw. The issue is confined to the data plane. The control plane and management interfaces are not affected.
F5 has not published the packet structures or traffic characteristics that trigger the vulnerability, which limits the ability to write network-based detection or mitigation rules. The risk exists only while the non-default configuration is active, so a configuration audit is necessary to determine exposure.
Affected systems and versions
The following BIG-IP versions are affected when tm.tcpudptxchecksum is set to Software-only:
- BIG-IP 15.1.0 through 15.1.10
- BIG-IP 16.1.0 through 16.1.6
- BIG-IP 17.1.0 through 17.1.2
- BIG-IP 17.5.0 through 17.5.1
Fixed versions:
- 15.1.10.8 or later
- 16.1.6.1 or later
- 17.1.3 or later
- 17.5.1.3 or later
Only systems with the non-default Software-only checksum configuration are vulnerable. Systems using the default hardware offload setting are not affected.
Vendor security history
F5 Networks has a history of critical vulnerabilities in BIG-IP, particularly in TMM and the management interfaces. Notable examples include:
- CVE-2020-5902: Remote code execution in TMUI, widely exploited
- CVE-2023-46747: Authentication bypass in configuration utility
- CVE-2025-53474: Buffer overflow in TMM with iRule configurations
F5 issues quarterly security notifications, provides engineering hotfixes, and backports patches to supported versions. It generally responds to vulnerabilities promptly. Even so, BIG-IP's complexity and its central place in network infrastructure give these issues high impact.
