CVE-2025-47148CWE-404

CVE-2025-47148

Medium · published October 15, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
32.1
In the wild
Unconfirmed
What it is

When the BIG-IP system is configured as both a Security Assertion Markup Language (SAML) service provider (SP) and Identity Provider (IdP), with single logout (SLO) enabled on an access policy, undisclosed requests can cause an increase in memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00392 · 32.1th percentile
Weakness
CWE-404 · Improper Resource Shutdown or Release
Published
2025-10-15T18:15Z
Affected products (8)
ProductVersionsFixed in
f5/big-ip_access_policy_manager≥ 15.1.0, < 15.1.10.815.1.10.8
f5/big-ip_access_policy_manager≥ 16.1.0, < 16.1.6.116.1.6.1
f5/big-ip_access_policy_manager≥ 17.1.0, < 17.1.317.1.3
f5/big-ip_access_policy_managerall versions—
f5/big-ip_ssl_orchestrator≥ 15.1.0, < 15.1.10.815.1.10.8
f5/big-ip_ssl_orchestrator≥ 16.1.0, < 16.1.6.116.1.6.1
f5/big-ip_ssl_orchestrator≥ 17.1.0, < 17.1.317.1.3
f5/big-ip_ssl_orchestratorall versions—
References (1)
https://my.f5.com/manage/s/article/K000148816 · [email protected]
EPSS history
Timeline
  • 15 OCT 13:55Z
    BIG-IP APM and SSL Orchestrator vulnerability
    cvelistv5