Introduction
A single malformed request can take down critical application delivery infrastructure, along with the services that rely on F5 BIG-IP Advanced Firewall Manager (AFM) for denial-of-service protection. CVE-2025-59478 is a flaw in the DoS protection profile mechanism. A remote attacker can use it to terminate the Traffic Management Microkernel (TMM) process on an affected system, which causes a denial of service.
About F5 Networks and BIG-IP: F5 Networks is a leading vendor of application delivery and security products. Its BIG-IP product line is deployed in large enterprises, service providers, and critical infrastructure environments worldwide. BIG-IP AFM is the module that provides advanced firewall and DoS protection, so a vulnerability in it has a wide reach across the industry.
Technical Information
CVE-2025-59478 comes from how BIG-IP AFM handles DoS protection profiles configured on virtual servers. When a specially crafted, undisclosed network request reaches a virtual server that has a DoS protection profile, the Traffic Management Microkernel (TMM) process can access an uninitialized pointer (CWE-824). The process then crashes, which immediately denies service to all traffic managed by that TMM instance.
- The vulnerability is limited to the data plane and does not affect the control plane or management interfaces.
- Exploitation requires no authentication and can be performed remotely.
- Attack complexity is low once the request format is known, but F5 has not disclosed the exact triggering sequence.
- The issue arises only if AFM is licensed and a DoS protection profile is actively configured on a virtual server.
No public code snippets or detailed exploit payloads have been released.
Affected Systems and Versions
The following BIG-IP AFM versions are affected:
- 17.5.0
- 17.1.0 through 17.1.2
- 15.1.0 through 15.1.10
Only systems with AFM licensed and a DoS protection profile configured on at least one virtual server are vulnerable. F5 does not evaluate versions that have reached End of Technical Support (EoTS), so those versions may or may not be affected.
Vendor Security History
F5 Networks publishes security notifications every quarter and has a track record of fixing vulnerabilities in its BIG-IP product line. Previous issues have included authentication bypass, remote code execution, and denial-of-service vulnerabilities. F5 typically provides timely advisories, detailed technical documentation, and patch guidance. The company recommends high-availability deployment as a standard resilience measure, and it provides engineering hotfixes for supported versions when possible.
