High · published October 15, 2025
⚠️ An uninvited traffic surge can make the Traffic Management Microkernel (TMM) throw in the towel! With Multipath TCP (MPTCP) enabled, this vulnerability could lead to unexpected server terminations. 🔥 Think of it like a restaurant that runs out of food because too many unexpected guests showed up unannounced — the kitchen just can't keep up! When MPTCP is active, unforeseen traffic conditions can overwhelm the server, causing it to crash like a dinner rush that leaves everyone hangry. This could absolutely devastate your network performance, leading to unexpected downtimes. If the TMM quits on you, it might disrupt services for your users, causing both frustration and financial repercussions. Keeping your systems running smoothly is crucial!
Think of it like a restaurant that runs out of food because too many unexpected guests showed up unannounced — the kitchen just can't keep up! When MPTCP is active, unforeseen traffic conditions can overwhelm the server, causing it to crash like a dinner rush that leaves everyone hangry. CVE-2025-48008 impacts virtual servers with a TCP profile configured for MPTCP. When certain undisclosed traffic conditions occur, it can cause the TMM to terminate unexpectedly, leading to service disruptions.
This could absolutely devastate your network performance, leading to unexpected downtimes. If the TMM quits on you, it might disrupt services for your users, causing both frustration and financial repercussions. Keeping your systems running smoothly is crucial! To protect your systems, consider disabling MPTCP on vulnerable configurations. Additionally, monitor your server traffic to identify and mitigate any unusual patterns that could lead to this issue. Regular updates and support checks are vital to keeping your systems secure! You've got this! Follow these steps, and you'll be well on your way to fortifying your defenses. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| f5/big-ip_next_cloud-native_network_functions | ≥ 1.1.0, ≤ 1.4.1 | — |
| f5/big-ip_next_service_proxy_for_kubernetes | ≥ 1.7.0, ≤ 1.9.2 | — |
| f5/big-ip_access_policy_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_advanced_firewall_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_advanced_web_application_firewall | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_analytics | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_application_acceleration_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_application_security_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_application_visibility_and_reporting | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_automation_toolchain | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_carrier-grade_nat | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_container_ingress_services | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_ddos_hybrid_defender | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_domain_name_system | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_edge_gateway | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_fraud_protection_service | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_global_traffic_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_link_controller | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_local_traffic_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_policy_enforcement_manager | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_ssl_orchestrator | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_webaccelerator | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_websafe | ≥ 15.1.0, < 15.1.10.8 | 15.1.10.8 |
| f5/big-ip_access_policy_manager | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_advanced_firewall_manager | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_advanced_web_application_firewall | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_analytics | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_application_acceleration_manager | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_application_security_manager | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_application_visibility_and_reporting | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_automation_toolchain | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_carrier-grade_nat | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_container_ingress_services | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_ddos_hybrid_defender | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_domain_name_system | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_edge_gateway | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_fraud_protection_service | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_global_traffic_manager | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_link_controller | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_local_traffic_manager | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_policy_enforcement_manager | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_ssl_orchestrator | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_webaccelerator | ≥ 16.1.0, < 16.1.6 | 16.1.6 |
| f5/big-ip_websafe | ≥ 16.1.0, < 16.1.6 | 16.1.6 |