CVE-2025-36504 Overview
CVE-2025-36504 is a memory resource exhaustion vulnerability affecting F5 BIG-IP systems when an HTTP/2 httprouter profile is configured on a virtual server. The vulnerability allows remote attackers to trigger an increase in memory resource utilization through specially crafted undisclosed responses, potentially leading to denial of service conditions. This vulnerability impacts a wide range of F5 BIG-IP products across multiple deployment scenarios.
Critical Impact
Remote attackers can exhaust memory resources on affected BIG-IP systems without authentication, potentially causing service disruption for critical network infrastructure and applications protected by F5 devices.
Affected Products
- F5 BIG-IP Local Traffic Manager
- F5 BIG-IP Access Policy Manager
- F5 BIG-IP Advanced Firewall Manager
- F5 BIG-IP Advanced Web Application Firewall
- F5 BIG-IP Application Security Manager
- F5 BIG-IP Analytics
- F5 BIG-IP Application Acceleration Manager
- F5 BIG-IP Application Visibility and Reporting
- F5 BIG-IP Automation Toolchain
- F5 BIG-IP Carrier-Grade NAT
- F5 BIG-IP Container Ingress Services
- F5 BIG-IP DDoS Hybrid Defender
- F5 BIG-IP Domain Name System
- F5 BIG-IP Edge Gateway
- F5 BIG-IP Fraud Protection Service
- F5 BIG-IP Global Traffic Manager
- F5 BIG-IP Link Controller
- F5 BIG-IP Policy Enforcement Manager
- F5 BIG-IP SSL Orchestrator
- F5 BIG-IP WebAccelerator
- F5 BIG-IP WebSafe
- F5 BIG-IP Next Central Manager (versions 20.2.0 and 20.2.1)
- F5 BIG-IP Next Cloud-Native Network Functions
- F5 BIG-IP Next Service Proxy for Kubernetes
Discovery Timeline
- May 7, 2025 - CVE-2025-36504 published to NVD
- October 21, 2025 - Last updated in NVD database
Technical Details for CVE-2025-36504
Vulnerability Analysis
This vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The flaw exists in the HTTP/2 httprouter profile implementation within F5 BIG-IP systems. When processing certain types of HTTP/2 responses, the system fails to properly manage memory allocation, allowing accumulated memory consumption that is not released appropriately.
The network-accessible nature of this vulnerability means attackers can target affected BIG-IP systems remotely without requiring any prior authentication or user interaction. The primary impact is availability, as successful exploitation leads to memory exhaustion that can degrade performance or cause complete service unavailability.
Root Cause
The root cause lies in improper resource allocation handling within the HTTP/2 httprouter profile processing logic. When the httprouter profile is enabled on a virtual server, the system processes HTTP/2 traffic and manages associated memory buffers. However, certain response patterns trigger memory allocation that is not properly bounded or released, leading to progressive memory exhaustion.
The vulnerability specifically relates to CWE-770, indicating that the affected code path allocates memory resources without implementing adequate limits or throttling mechanisms to prevent resource exhaustion attacks.
Attack Vector
The attack can be executed remotely over the network by sending specially crafted HTTP/2 responses to a BIG-IP virtual server configured with an httprouter profile. The exploitation process involves:
- An attacker identifies a BIG-IP system with HTTP/2 httprouter profile configured on a virtual server
- The attacker sends or triggers undisclosed HTTP/2 response patterns to the target system
- Each malicious response causes incremental memory allocation without proper release
- Sustained attack traffic leads to progressive memory exhaustion
- Eventually, the system experiences performance degradation or denial of service
The attack requires no authentication and can be executed without user interaction, making it particularly dangerous for internet-facing BIG-IP deployments.
Detection Methods for CVE-2025-36504
Indicators of Compromise
- Abnormal memory utilization trends on BIG-IP systems with HTTP/2 httprouter profiles enabled
- Unusual HTTP/2 traffic patterns or response volumes targeting virtual servers
- System log entries indicating memory pressure or allocation failures in TMM (Traffic Management Microkernel)
- Performance degradation on virtual servers with httprouter profiles despite normal traffic loads
Detection Strategies
- Monitor BIG-IP system memory utilization metrics and establish baseline thresholds for alerting
- Implement network traffic analysis to identify anomalous HTTP/2 response patterns
- Review BIG-IP logs for TMM memory-related warnings or errors
- Use SNMP or iControl REST API monitoring to track memory consumption trends over time
Monitoring Recommendations
- Configure alerting for memory utilization exceeding normal operational thresholds on affected BIG-IP systems
- Implement continuous monitoring of virtual servers with HTTP/2 httprouter profiles
- Deploy network-level monitoring to detect unusual HTTP/2 traffic volumes or patterns
- Establish baseline metrics for normal memory consumption to identify anomalies quickly
How to Mitigate CVE-2025-36504
Immediate Actions Required
- Review all BIG-IP systems to identify virtual servers configured with HTTP/2 httprouter profiles
- Apply F5 security patches as described in the vendor advisory
- Consider temporarily disabling HTTP/2 httprouter profiles on critical systems until patches are applied
- Implement rate limiting on HTTP/2 connections where feasible to reduce exposure
Patch Information
F5 has released security patches to address this vulnerability. Administrators should consult the F5 Security Advisory K000140919 for detailed patch information, including specific version numbers and hotfix availability for each affected product. Note that software versions which have reached End of Technical Support (EoTS) are not evaluated for this vulnerability.
Workarounds
- If patching is not immediately possible, consider disabling HTTP/2 httprouter profiles on affected virtual servers and using alternative traffic management configurations
- Implement network-level controls to restrict access to BIG-IP management interfaces and limit exposure of affected virtual servers
- Deploy additional monitoring to detect early signs of memory exhaustion attacks
- Consider implementing connection limits and rate controls on affected virtual servers to reduce the potential impact of exploitation attempts
# Example: Check for virtual servers with HTTP/2 httprouter profiles
tmsh list ltm virtual all http2-profile
# Monitor TMM memory utilization
tmsh show sys tmm-info | grep -i memory
# Review system memory status
tmsh show sys memory
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
