CVE-2025-35995: F5 BIG-IP Policy Enforcement Manager DoS

CVE-2025-35995 Overview

CVE-2025-35995 is a high-severity Denial of Service vulnerability affecting F5 BIG-IP Policy Enforcement Manager (PEM) systems. When a BIG-IP PEM system is licensed with URL categorization, and the URL categorization policy or an iRule with the urlcat command is enabled on a virtual server, specially crafted undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate unexpectedly.

The TMM is a critical component responsible for processing all application traffic through the BIG-IP system. Its termination results in traffic disruption and potential service outages for downstream applications relying on the BIG-IP infrastructure.

Critical Impact

Remote attackers can crash the TMM process via network-based requests, causing service disruption to all traffic processed by the affected BIG-IP PEM system without authentication.

Affected Products

• F5 BIG-IP Policy Enforcement Manager (PEM) with URL categorization license
• BIG-IP PEM systems with URL categorization policy enabled on virtual servers
• BIG-IP PEM systems using iRules with the urlcat command

Discovery Timeline

• 2025-05-07 - CVE-2025-35995 published to NVD
• 2025-09-29 - Last updated in NVD database

Technical Details for CVE-2025-35995

Vulnerability Analysis

This vulnerability is classified under CWE-125 (Out-of-Bounds Read), indicating that the TMM process reads data beyond the intended buffer boundaries when processing certain network requests. The out-of-bounds read condition in the URL categorization functionality can trigger memory access violations that cause the TMM to crash.

The vulnerability can be exploited remotely over the network without any authentication or user interaction required. When exploited, the impact is primarily to availability, causing the TMM process to terminate and disrupting traffic processing capabilities. The attack does not require specialized conditions and can be performed with low complexity.

Root Cause

The root cause is an out-of-bounds read vulnerability (CWE-125) in the URL categorization processing logic within the TMM component. When handling specific malformed or crafted requests, the TMM fails to properly validate buffer boundaries before reading memory, leading to an out-of-bounds memory access that triggers process termination.

The vulnerability specifically manifests when URL categorization features are active, either through a URL categorization policy configuration or through iRules utilizing the urlcat command on a virtual server.

Attack Vector

The attack vector is network-based, allowing remote attackers to exploit this vulnerability by sending specially crafted requests to a vulnerable BIG-IP PEM virtual server. The attack characteristics include:

• Remote Exploitation: Attackers can trigger the vulnerability from anywhere on the network that can reach the affected virtual server
• No Authentication Required: The vulnerability can be exploited without valid credentials
• No User Interaction: Exploitation occurs automatically upon processing the malicious request
• Service Disruption: Successful exploitation terminates the TMM process, interrupting all traffic processing

The vulnerability occurs in the URL categorization path, meaning attackers must target virtual servers where URL categorization policies or iRules with urlcat commands are enabled.

Detection Methods for CVE-2025-35995

Indicators of Compromise

• Unexpected TMM process restarts or crashes in BIG-IP system logs
• Multiple entries in /var/log/ltm indicating TMM termination events
• Service disruptions correlating with unusual request patterns to PEM virtual servers
• Core dump files generated by TMM crashes in /var/core/

Detection Strategies

• Monitor BIG-IP system logs for TMM crash events and restart notifications
• Configure SNMP traps or syslog forwarding for TMM process state changes
• Implement network monitoring for anomalous traffic patterns targeting BIG-IP virtual servers with URL categorization enabled
• Review high availability (HA) failover events that may indicate TMM crashes on one unit

Monitoring Recommendations

• Enable comprehensive logging on virtual servers using URL categorization features
• Configure alerting thresholds for TMM restart frequency to detect potential exploitation attempts
• Monitor network traffic for unusual request patterns or repeated connection attempts to affected virtual servers
• Review F5 iHealth diagnostics for TMM stability indicators and crash analysis

How to Mitigate CVE-2025-35995

Immediate Actions Required

• Review the official F5 Security Advisory K000149952 for complete remediation guidance
• Identify all BIG-IP PEM systems with URL categorization licenses and enabled policies
• Audit virtual server configurations for URL categorization policies or iRules using the urlcat command
• Plan maintenance windows for applying vendor-provided security patches
• Consider temporarily disabling URL categorization features on critical systems if immediate patching is not possible

Patch Information

F5 has released security patches to address this vulnerability. Administrators should consult the F5 Knowledge Article K000149952 for specific version information and download links for the applicable security updates.

Note that software versions which have reached End of Technical Support (EoTS) are not evaluated and may remain vulnerable. Organizations running EoTS versions should prioritize upgrading to supported releases.

Workarounds

• If URL categorization is not required for business operations, consider disabling the URL categorization policy on affected virtual servers
• Remove iRules containing the urlcat command from virtual servers where the functionality is not essential
• Implement network-level access controls to restrict traffic sources that can reach affected virtual servers
• Consider deploying a web application firewall or additional filtering in front of affected systems to block potentially malicious requests

# Check for virtual servers using URL categorization iRules
# Run from BIG-IP command line
tmsh list ltm virtual | grep -A 10 "virtual-server-name"

# List all iRules that may use urlcat command
grep -r "urlcat" /config/partitions/*/bigip.conf