BIG-IP Advanced WAF and ASM vulnerability

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• f5 big-ip advanced web application firewall13.1.0 and later · up to 13.1.5 inclusive
• f5 big-ip advanced web application firewall14.1.0 and later · before 14.1.5.3
• f5 big-ip advanced web application firewall15.1.0 and later · before 15.1.8
• f5 big-ip advanced web application firewall16.1.0 and later · before 16.1.3.3
• f5 big-ip advanced web application firewall17.0.0 and later · before 17.0.0.2
• f5 big-ip application security manager13.1.0 and later · up to 13.1.5 inclusive
• f5 big-ip application security manager14.1.0 and later · before 14.1.5.3
• f5 big-ip application security manager15.1.0 and later · before 15.1.8
• f5 big-ip application security manager16.1.0 and later · before 16.1.3.3
• f5 big-ip application security manager17.0.0 and later · before 17.0.0.2

Versions reported by the vendor

Affected version ranges reported by the assigning authority (f5). Independent of NVD's CPE analysis and usually ahead of it.

• F5 BIG-IP

  • 17.0.0 and later · before 17.0.0.2affected · semver
  • 16.1.0 and later · before 16.1.3.3affected · semver
  • 15.1.0 and later · before 15.1.8affected · semver
  • 14.1.0 and later · before 14.1.5.3affected · semver
  • 13.1.0 and lateraffected · semver

Other highest-scoring records for the same primary product.

• CVE-2021-23031On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and 11.6.x befo
  40Plan
• CVE-2021-23029On version 16.0.x before 16.0.1.2, insufficient permission checks may allow authenticated users with guest privileges to perform Server-Side
  35Monitor
• CVE-2021-23014On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, and 14.1.x before 14.1.4, BIG-IP Advanced WAF and ASM are missing authorization ch
  35Monitor
• CVE-2021-22993On BIG-IP Advanced WAF and BIG-IP ASM versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6,
  35Monitor
• CVE-2026-41227BIG-IP HTTP/2 Layer 7 Dos Protection vulnerability
  34Monitor
• CVE-2025-61935BIG-IP Advanced WAF and ASM vulnerability
  34Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

Code that parses nested structures sets no depth or size limit. A small input can turn into a disproportionate processing load.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1function expand(node) {2  return node.children.map(expand);3}

1const MAX_DEPTH = 32;2function expand(node, depth = 0) {3  if (depth > MAX_DEPTH) throw new Error("too deep");4  return node.children.map((c) => expand(c, depth + 1));5}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.