Introduction
An unexpected service interruption on an F5 BIG-IP system can disrupt critical application delivery for enterprises and service providers. CVE-2025-61951 describes a case where a specific DTLS 1.2 configuration causes the Traffic Management Microkernel (TMM) to terminate, denying service to the affected virtual servers.
About F5 Networks and BIG-IP: F5 Networks is a leading vendor of application delivery and security products, and its BIG-IP platform is deployed in thousands of enterprises and service providers worldwide. BIG-IP handles load balancing, SSL offloading, and secure traffic management for high-value applications. Because the platform plays a critical role in modern infrastructure, network and security teams watch F5's security advisories and quarterly notifications closely.
Technical Information
CVE-2025-61951 is an out-of-bounds read vulnerability (CWE-125) in the BIG-IP Traffic Management Microkernel (TMM) process. It occurs while TMM handles DTLS 1.2 handshakes, under these conditions:
- A BIG-IP DTLS 1.2 virtual server is enabled.
- The Server SSL profile attached to the virtual server is configured with a certificate, key, and the SSL Sign Hash parameter set to ANY.
- The backend server is also configured for DTLS 1.2 and requires client authentication.
The root cause is insufficient bounds checking during DTLS handshake processing, particularly when the 'ANY' setting for the SSL Sign Hash parameter allows negotiation of multiple signature algorithms. Combined with the client authentication requirement, this can cause TMM to read beyond allocated buffer boundaries. TMM then terminates, which disrupts all traffic handled by that TMM instance.
The issue is not present in default configurations and arises only when all of the above conditions are met. It does not lead to information disclosure. The impact is a denial of service caused by the TMM process crashing.
Affected Systems and Versions
- Products: F5 BIG-IP
- Vulnerable versions:
- All BIG-IP versions prior to 17.5.1.3 and 17.1.3
- Fixed versions:
- 17.5.1.3
- 17.1.3
- Vulnerable configurations:
- DTLS 1.2 virtual server enabled
- Server SSL profile with certificate, key, and SSL Sign Hash set to ANY
- Backend server with DTLS 1.2 and client authentication enabled
- Note: Versions that have reached End of Technical Support (EoTS) are not evaluated and may remain vulnerable.
Vendor Security History
F5 Networks has fixed multiple vulnerabilities in the BIG-IP TMM component in recent years, including buffer overflows and denial-of-service issues (for example, CVE-2025-53474 and CVE-2025-58424). F5 typically issues quarterly security notifications and publishes detailed advisories and fixed versions for supported products. Its response time and transparency are generally regarded as mature, with structured advisories and clear upgrade guidance.
