Memory Resource Utilization Vulnerability in BIG-IP HTTP/2 Configuration by F5 Networks
CVE-2025-36504

8.7HIGH

Key Information:

Vendor

F5
Status
Big-ip
Big-ip Next
Big-ip Next Spk
Big-ip Next Cnf
Vendor
CVE Published:
7 May 2025

What is CVE-2025-36504?

A configuration vulnerability exists in the BIG-IP HTTP/2 httprouter profile that can lead to increased memory resource utilization when handling undisclosed responses. This issue may arise in specific virtual server configurations, impacting performance and stability. It is crucial for users to review their configurations and ensure they are using supported versions, as those with End of Technical Support will not be evaluated for this vulnerability.

Affected Version(s)

BIG-IP 17.1.0 < 17.1.2

BIG-IP 16.1.0 < 16.1.6

BIG-IP Next 20.2.0 < 20.3.0

References

https://my.f5.com/manage/s/article/K000140919
vendor-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

F5
JSON
.
CVE-2025-36504 : Memory Resource Utilization Vulnerability in BIG-IP HTTP/2 Configuration by F5 Networks