← Back to CVE List
Vulnerability Intelligence Report
F5 BIG-IP Traffic Management Microkernel Buffer Overflow

CVE-2021-22991

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE). Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

CISA KEV SSVC: Active Exploitation Automatable
CVSS Base Score
9.8
CRITICAL
Exploitability:3.9
Impact Score:5.9
EPSS Probability:61.06%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
Authentication
Weaponization
SSVC Action

Weaknesses (CWE)

CWE-119 ↗CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

Affected Products & Versions

Vendor Product Affected Versions
f5 big-ip_access_policy_manager all
f5 big-ip_advanced_firewall_manager all
f5 big-ip_advanced_web_application_firewall all
f5 big-ip_analytics all
f5 big-ip_application_acceleration_manager all
f5 big-ip_application_security_manager all
f5 big-ip_ddos_hybrid_defender all
f5 big-ip_domain_name_system all
f5 big-ip_fraud_protection_service all
f5 big-ip_global_traffic_manager all
f5 big-ip_link_controller all
f5 big-ip_local_traffic_manager all
f5 big-ip_policy_enforcement_manager all
f5 ssl_orchestrator all

References & Technical Advisories

No reference links found.

Threat Intelligence Signals

CISA KEV
ACTIVE IN CATALOG
EPSS Score
61.064%

Identity & Timeline

StatusPUBLISHED
Assigning AuthorityF5, Inc. · Vendor · USA
Reserved2021-01-06T00:00:00
Published2021-03-31T17:23:14
Last Updated2025-10-21T23:25:50

LINK COPIED TO CLIPBOARD