CVE-2025-47148: F5 BIG-IP APM SAML DoS Vulnerability

CVE-2025-47148 Overview

CVE-2025-47148 is a memory resource exhaustion vulnerability in F5 BIG-IP Access Policy Manager (APM) and BIG-IP SSL Orchestrator. The flaw exists when the BIG-IP system is configured as both a Security Assertion Markup Language (SAML) Service Provider (SP) and Identity Provider (IdP), with Single Logout (SLO) enabled on an access policy. Undisclosed requests can cause an increase in memory resource utilization, leading to a denial-of-service condition. The vulnerability is classified as [CWE-404] Improper Resource Shutdown or Release. F5 does not evaluate software versions that have reached End of Technical Support (EoTS).

Critical Impact
Authenticated attackers can trigger memory exhaustion on BIG-IP devices acting as combined SAML SP and IdP with SLO enabled, degrading availability of access-managed services.

Affected Products

F5 BIG-IP Access Policy Manager (APM), including version 17.5.0
F5 BIG-IP SSL Orchestrator, including version 17.5.0
BIG-IP systems configured as SAML SP and IdP with Single Logout enabled

Discovery Timeline

2025-10-15 - CVE-2025-47148 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47148

Vulnerability Analysis

The vulnerability affects BIG-IP APM and SSL Orchestrator when configured in a dual-role SAML deployment. The BIG-IP acts simultaneously as a SAML Service Provider and Identity Provider, with Single Logout enabled on an attached access policy. In this configuration, specific undisclosed requests reach the SLO processing path and cause memory allocated per request to grow without proper release.

Sustained request activity accumulates memory consumption on the device. As free memory decreases, access policy evaluation, TMM data plane processing, and control plane services can degrade. The result is reduced availability for users authenticating through the affected virtual servers. The issue maps to [CWE-404] Improper Resource Shutdown or Release, indicating that resources tied to SLO request handling are not freed on all code paths.

Root Cause

The root cause is improper release of memory resources during SAML Single Logout processing when the device is both SP and IdP. F5 has not publicly disclosed the specific request patterns or code paths involved. Because both roles share SLO state, requests exercising the combined workflow trigger allocations that are not cleaned up.

Attack Vector

Exploitation requires network access to an affected virtual server and low-privilege authentication context sufficient to interact with SAML endpoints. No user interaction is needed. Repeated undisclosed requests to the SLO endpoint drive memory consumption higher until services degrade. F5 has not published proof-of-concept code, and CISA has not added this CVE to the Known Exploited Vulnerabilities catalog. Refer to the F5 Support Article K000148816 for vendor guidance.

Detection Methods for CVE-2025-47148

Indicators of Compromise

Sustained growth in TMM or APM process memory consumption without a corresponding increase in active user sessions
Elevated volume of SAML SLO requests targeting virtual servers configured as both SP and IdP
Access policy evaluation failures or timeouts correlating with memory pressure alarms
Log entries in /var/log/apm referencing repeated logout initiation from the same source

Detection Strategies

Baseline normal memory utilization for tmm and APM processes, then alert on deviations tied to SLO request activity
Correlate SAML SLO request rates with per-process memory metrics using iHealth or external monitoring
Inspect access policy logs for anomalous logout request patterns from authenticated sessions

Monitoring Recommendations

Enable SNMP or telemetry export of sysHostMemory and TMM memory counters into your SIEM
Track SAML SLO request rates per virtual server and alert on statistically significant spikes
Configure high-memory alarms on BIG-IP devices to fire before services become unresponsive

How to Mitigate CVE-2025-47148

Immediate Actions Required

Review F5 Support Article K000148816 and identify BIG-IP APM and SSL Orchestrator devices running vulnerable versions
Inventory access policies where the BIG-IP is configured as both SAML SP and IdP with SLO enabled
Apply the fixed software versions listed in the F5 advisory as soon as change windows permit
Restrict network exposure of affected virtual servers to trusted client populations while patching is pending

Patch Information

F5 provides fixed software versions in F5 Support Article K000148816. Versions that have reached End of Technical Support are not evaluated and should be upgraded to a supported release train. Confirm the target version addresses CVE-2025-47148 before scheduling the upgrade.

Workarounds

Disable Single Logout on affected access policies if the SLO workflow is not required
Separate SAML Service Provider and Identity Provider roles onto distinct BIG-IP instances or access policies where feasible
Implement rate limiting on SAML SLO endpoints using iRules or upstream controls to constrain request volume
Monitor device memory continuously and schedule failover or restart procedures if utilization approaches critical thresholds

bash

# Configuration example: inspect APM access policies for SAML SLO configuration
tmsh list apm profile access one-line | grep -i saml
tmsh list apm sso saml-sp
tmsh list apm sso saml-idp

# Monitor TMM and host memory utilization on BIG-IP
tmsh show sys memory
tmsh show sys tmm-info | grep -i memory