Introduction
In F5 VELOS environments, an unexpected loss of management access and cascading service failures can disrupt both operational visibility and application delivery. CVE-2025-59778 is a critical resource allocation flaw in the F5OS-C partition control plane that applies when the Allowed IP Addresses feature is enabled. Certain network traffic can cause multiple containers to terminate. The result is a denial of service for partition management, and tenant workloads may also be affected.
About F5 VELOS and F5OS-C: F5 Networks sells application delivery and network infrastructure products to enterprises, service providers, and government customers worldwide. VELOS is F5's modular, chassis-based platform, designed for high-performance, multi-tenant environments. F5OS-C is the containerized operating system that runs VELOS partitions and provides their management and automation features.
Technical Information
CVE-2025-59778 comes from improper resource allocation in the F5OS-C partition control plane when the Allowed IP Addresses feature is configured. The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). When the partition control plane processes specific, undisclosed network traffic, the validation logic for Allowed IP Addresses does not properly throttle or limit resource usage. System resources are consumed until multiple containers in the partition terminate. That takes down the management interfaces (CLI, GUI, API) and can disrupt tenant applications that rely on partition-level services. Public advisories do not describe the triggering traffic, likely to prevent immediate exploitation.
Affected Systems and Versions
- Product: F5 VELOS F5OS-C
- Affected versions:
- 1.6.0 through all 1.6.x releases
- 1.8.0 through 1.8.1
- Only systems where the Allowed IP Addresses feature is configured on the partition control plane are vulnerable
- Systems running versions that have reached End of Technical Support (EoTS) are not evaluated
Vendor Security History
F5 Networks has a record of responsible vulnerability disclosure and timely patches, and it publishes quarterly security notifications and detailed advisories. Past vulnerabilities in F5OS and BIG-IP products include resource exhaustion, authentication bypass, and remote code execution issues. As recent advisories show, the move to a containerized architecture in F5OS-C has introduced new security problems.
