CVE-2025-36557 Overview
CVE-2025-36557 is a buffer overflow vulnerability affecting F5 BIG-IP products when an HTTP profile with the Enforce RFC Compliance option is configured on a virtual server. Specially crafted, undisclosed HTTP requests can trigger a buffer overflow condition (CWE-120) that causes the Traffic Management Microkernel (TMM) to terminate unexpectedly, resulting in a denial of service condition.
The TMM is a critical component responsible for processing all application traffic through the BIG-IP system. When TMM terminates, it disrupts traffic processing capabilities, potentially causing service outages for applications relying on the BIG-IP infrastructure for load balancing, security, and traffic management.
Critical Impact
Remote attackers can cause denial of service by crashing the TMM process through malformed HTTP requests, disrupting critical network infrastructure and application availability.
Affected Products
- F5 BIG-IP Access Policy Manager
- F5 BIG-IP Advanced Firewall Manager
- F5 BIG-IP Analytics
- F5 BIG-IP Application Acceleration Manager
- F5 BIG-IP Application Security Manager
- F5 BIG-IP Domain Name System
- F5 BIG-IP Fraud Protection Service
- F5 BIG-IP Global Traffic Manager
- F5 BIG-IP Link Controller
- F5 BIG-IP Local Traffic Manager
- F5 BIG-IP Policy Enforcement Manager
- F5 BIG-IP Next Cloud-Native Network Functions
- F5 BIG-IP Next Service Proxy for Kubernetes
Discovery Timeline
- May 7, 2025 - CVE-2025-36557 published to NVD
- August 6, 2025 - Last updated in NVD database
Technical Details for CVE-2025-36557
Vulnerability Analysis
This vulnerability is classified as CWE-120 (Buffer Copy without Checking Size of Input), commonly known as a classic buffer overflow. The flaw exists in the HTTP request parsing logic within the Traffic Management Microkernel when RFC compliance enforcement is enabled.
When the "Enforce RFC Compliance" option is configured on an HTTP profile attached to a virtual server, the TMM performs strict validation of incoming HTTP requests against RFC specifications. The vulnerability occurs during this validation process when processing certain malformed or crafted HTTP requests that exceed expected buffer boundaries.
The attack can be executed remotely over the network without requiring authentication or user interaction. An attacker can send specially crafted HTTP requests to a vulnerable virtual server, triggering the buffer overflow condition that causes TMM to crash. This results in service disruption for all traffic processed by the affected BIG-IP device.
Root Cause
The root cause is a buffer overflow vulnerability (CWE-120) in the TMM's HTTP parsing functionality. When processing HTTP requests with RFC compliance checking enabled, the code fails to properly validate the size of input data before copying it into a fixed-size buffer. This allows an attacker to overflow the buffer with malicious input, corrupting adjacent memory and causing the TMM process to terminate.
The specific trigger requires the HTTP profile to have the "Enforce RFC Compliance" option enabled, which activates additional parsing logic that contains the vulnerable code path.
Attack Vector
The attack vector is network-based, allowing remote exploitation without authentication. An attacker can exploit this vulnerability by:
- Identifying a BIG-IP virtual server with an HTTP profile configured with "Enforce RFC Compliance" enabled
- Crafting malicious HTTP requests designed to trigger the buffer overflow during RFC validation
- Sending these requests to the target virtual server
- The TMM processes the request, triggering the buffer overflow and terminating
The vulnerability can be repeatedly exploited to maintain a denial of service condition, as each time TMM restarts, the attacker can send additional malicious requests to crash it again.
Detection Methods for CVE-2025-36557
Indicators of Compromise
- Unexpected TMM process crashes or restarts in BIG-IP system logs
- Sudden traffic disruptions on virtual servers with RFC compliance enforcement enabled
- Multiple TMM core dumps appearing in /var/core/ directory
- Spike in connection resets or timeouts for applications behind the BIG-IP
Detection Strategies
- Monitor BIG-IP system logs for TMM restart events using tmsh show sys log ltm
- Implement alerting on /var/log/ltm entries indicating TMM failures
- Review HTTP request logs for unusual or malformed request patterns targeting virtual servers with RFC compliance enabled
- Deploy network intrusion detection signatures for anomalous HTTP request patterns
Monitoring Recommendations
- Configure SNMP traps or syslog forwarding for TMM failure events to centralized SIEM systems
- Establish baseline TMM restart frequency to identify anomalous crash patterns
- Monitor CPU and memory utilization on BIG-IP devices for signs of exploitation attempts
- Enable HTTP request logging on virtual servers to capture potential attack traffic for forensic analysis
How to Mitigate CVE-2025-36557
Immediate Actions Required
- Review all HTTP profiles to identify those with "Enforce RFC Compliance" enabled using tmsh list ltm profile http
- Consider temporarily disabling RFC compliance enforcement on affected profiles if patching is not immediately possible
- Implement rate limiting and connection throttling to reduce attack surface
- Apply vendor-provided patches as soon as available
Patch Information
F5 has released security updates to address this vulnerability. Administrators should consult the F5 Support Article K000139571 for detailed patching instructions and affected version information. Note that software versions which have reached End of Technical Support (EoTS) are not evaluated for this vulnerability.
Organizations should prioritize applying patches to BIG-IP devices that are internet-facing or handle critical application traffic. Verify the patch installation by checking the BIG-IP software version after upgrade.
Workarounds
- Disable the "Enforce RFC Compliance" option on HTTP profiles where strict RFC validation is not required
- Implement external web application firewalls to filter malicious HTTP requests before they reach the BIG-IP
- Use iRules to perform preliminary request validation and drop suspicious traffic
- Segment network architecture to limit direct exposure of BIG-IP management and data plane interfaces
# Check HTTP profiles for RFC compliance setting
tmsh list ltm profile http | grep -A 5 "enforce-rfc-compliance"
# Disable RFC compliance on a specific profile (workaround only)
tmsh modify ltm profile http /Common/http_profile enforce-rfc-compliance disabled
tmsh save sys config
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
