High · published October 15, 2025
⚡ A crafty iRule can trigger a spike in memory consumption without breaking a sweat! This sneaky behavior can lead to your system running out of resources faster than you can say 'memory leak!' 🤯 Think of it like a restaurant where a hidden entrance allows an unexpected flood of diners to pour in, overwhelming the kitchen and staff. Without proper management, soon everyone is waiting for their meals, and the quality suffers. The result? Your virtual server faces potential slowdowns or even crashes as it struggles to handle the additional memory load. This could lead to service interruptions for users and a frustrating experience overall, which is absolutely devastating for any service provider!
Think of it like a restaurant where a hidden entrance allows an unexpected flood of diners to pour in, overwhelming the kitchen and staff. Without proper management, soon everyone is waiting for their meals, and the quality suffers. CVE-2025-46706 occurs when an iRule with the HTTP::respond command is configured on a virtual server, allowing undisclosed requests to ramp up memory utilization dangerously high.
The result? Your virtual server faces potential slowdowns or even crashes as it struggles to handle the additional memory load. This could lead to service interruptions for users and a frustrating experience overall, which is absolutely devastating for any service provider! To mitigate this vulnerability, review and update your configurations to eliminate problematic iRules. Monitor memory usage closely and consider applying patches or updates available from your vendor to address the issue. You've got this! With a little vigilance and some proactive steps, you'll keep your servers running smoothly! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| f5/big-ip_next_cloud-native_network_functions | ≥ 1.1.0, ≤ 1.4.1 | — |
| f5/big-ip_next_service_proxy_for_kubernetes | ≥ 1.7.0, ≤ 1.9.2 | — |
| f5/big-ip_access_policy_manager | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_advanced_firewall_manager | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_advanced_web_application_firewall | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_analytics | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_application_acceleration_manager | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_application_security_manager | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_application_visibility_and_reporting | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_automation_toolchain | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_carrier-grade_nat | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_container_ingress_services | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_ddos_hybrid_defender | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_domain_name_system | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_edge_gateway | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_fraud_protection_service | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_global_traffic_manager | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_link_controller | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_local_traffic_manager | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_policy_enforcement_manager | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_ssl_orchestrator | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_webaccelerator | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_websafe | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_access_policy_manager | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_advanced_firewall_manager | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_advanced_web_application_firewall | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_analytics | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_application_acceleration_manager | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_application_security_manager | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_application_visibility_and_reporting | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_automation_toolchain | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_carrier-grade_nat | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_container_ingress_services | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_ddos_hybrid_defender | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_domain_name_system | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_edge_gateway | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_fraud_protection_service | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_global_traffic_manager | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_link_controller | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_local_traffic_manager | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_policy_enforcement_manager | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_ssl_orchestrator | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_webaccelerator | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |
| f5/big-ip_websafe | ≥ 17.1.0, < 17.1.2.2 | 17.1.2.2 |