Introduction
A single HTTP2 request can disrupt application traffic for thousands of users if it crashes the core data plane of a load balancer. CVE-2025-58120 makes that possible for organizations running F5 BIG-IP Next platforms. A NULL pointer dereference in the Traffic Management Microkernel (TMM) exposes this critical infrastructure to denial of service.
About F5: F5 sells application delivery and security products worldwide, and they are deployed at the core of enterprise, telecom, and cloud-native environments. Its BIG-IP and BIG-IP Next lines handle traffic management for Fortune 50 companies, service providers, and cloud-native Kubernetes deployments. A vulnerability in these products can have cascading effects on digital services worldwide.
Technical information
CVE-2025-58120 is a NULL pointer dereference vulnerability (CWE-476) in the Traffic Management Microkernel (TMM) of F5 BIG-IP Next platforms. The flaw is triggered only when HTTP2 Ingress is configured. Certain undisclosed HTTP2 traffic patterns can cause TMM to dereference a NULL pointer, which terminates the process and denies service to all traffic the affected instance handles.
- Vulnerability trigger: HTTP2 Ingress must be enabled on an affected F5 BIG-IP Next product.
- Root cause: The HTTP2 processing logic in TMM does not sufficiently validate pointer values. When TMM receives crafted HTTP2 traffic, the code tries to access memory through a NULL pointer and crashes.
- Impact: When TMM terminates, all active connections and traffic processing stop. TMM may restart automatically, but service is interrupted until it does.
- Exploit details: F5 has not disclosed the exact traffic pattern that triggers the flaw. That limits public exploitability, but it also makes defensive detection harder.
No public code snippets or detailed proof-of-concept information is available for this vulnerability.
Affected systems and versions
The following F5 BIG-IP Next product versions are affected when HTTP2 Ingress is enabled:
- BIG-IP Next SPK (Service Proxy for Kubernetes):
- 2.x branch: versions 2.0.0 through 2.0.2
- 1.x branch: versions 1.7.0 through 1.9.2
- BIG-IP Next CNF (Cloud-Native Network Functions):
- 2.x branch: all versions up to those specified in the October 2025 security notification
- BIG-IP Next for Kubernetes:
- All versions with HTTP2 Ingress enabled, as referenced in F5's advisories
The vulnerability is present only when HTTP2 Ingress is configured. Systems without this feature enabled are not affected.
Vendor security history
F5 has a history of high-impact vulnerabilities in its BIG-IP product line, including:
- Remote code execution (CVE-2021-22986)
- HTTP2 Rapid Reset denial of service (CVE-2023-44487)
F5 usually issues coordinated quarterly security notifications and provides hotfixes and patches in line with industry standards. Recently, though, a nation-state actor breached F5's development environment and stole source code and information about undisclosed vulnerabilities. The theft raises concerns about the exposure of sensitive security information and the potential for targeted attacks.
