The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not pub

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• balasys dheaterall versions
• f5 big-ip access policy manager13.1.0 and later · before 16.1.4
• f5 big-ip access policy manager17.0.0 and later · before 17.1.0
• f5 big-ip advanced firewall manager13.1.0 and later · up to 17.1.2 inclusive
• f5 big-ip advanced firewall manager17.5.0
• f5 big-ip advanced web application firewall13.1.0 and later · up to 17.1.2 inclusive
• f5 big-ip advanced web application firewall17.5.0
• f5 big-ip analytics13.1.0 and later · up to 17.1.2 inclusive
• f5 big-ip analytics17.5.0
• f5 big-ip application acceleration manager13.1.0 and later · up to 17.1.2 inclusive
• f5 big-ip application acceleration manager17.5.0
• f5 big-ip application security manager13.1.0 and later · up to 17.1.2 inclusive
• f5 big-ip application security manager17.5.0
• f5 big-ip application visibility and reporting13.1.0 and later · up to 17.1.2 inclusive
• f5 big-ip application visibility and reporting17.5.0
• f5 big-ip carrier-grade nat13.1.0 and later · up to 17.1.2 inclusive
• f5 big-ip carrier-grade nat17.5.0
• f5 big-ip ddos hybrid defender13.1.0 and later · up to 17.1.2 inclusive
• f5 big-ip ddos hybrid defender17.5.0
• f5 big-ip domain name system13.1.0 and later · up to 17.1.2 inclusive

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

Code that parses nested structures sets no depth or size limit. A small input can turn into a disproportionate processing load.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1function expand(node) {2  return node.children.map(expand);3}

1const MAX_DEPTH = 32;2function expand(node, depth = 0) {3  if (depth > MAX_DEPTH) throw new Error("too deep");4  return node.children.map((c) => expand(c, depth + 1));5}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.