Traffic Management Microkernel Termination in BIG-IP PEM by F5 Networks
CVE-2025-35995

8.7HIGH

Key Information:

Vendor

F5
Status
Big-ip
Vendor
CVE Published:
7 May 2025

What is CVE-2025-35995?

A vulnerability exists in F5 Networks' BIG-IP PEM system when URL categorization is enabled. If the URL categorization policy or an iRule utilizing the urlcat command is active on a virtual server, certain undisclosed requests may trigger an unexpected termination of the Traffic Management Microkernel (TMM). Users are advised to review the impacted software versions, particularly those that are no longer supported.

Affected Version(s)

BIG-IP 17.1.0 < 17.1.2.2

BIG-IP 16.1.0 < 16.1.6

BIG-IP 15.1.0

References

https://my.f5.com/manage/s/article/K000149952
vendor-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

F5
.
CVE-2025-35995 : Traffic Management Microkernel Termination in BIG-IP PEM by F5 Networks