CVE-2025-55670 Overview
CVE-2025-55670 is a denial of service vulnerability affecting F5 BIG-IP Next Cloud-Native Network Functions (CNF), BIG-IP Next Service Proxy for Kubernetes (SPK), and BIG-IP Next for Kubernetes. Repeated undisclosed API calls can cause the Traffic Management Microkernel (TMM) to terminate, disrupting traffic processing. The flaw is categorized under [CWE-770] (Allocation of Resources Without Limits or Throttling). F5 has not disclosed the specific API endpoint involved. Only versions still within Technical Support are evaluated.
Critical Impact
An authenticated network attacker with low privileges can trigger termination of the TMM process, causing service disruption to workloads that depend on BIG-IP Next data plane processing.
Affected Products
- F5 BIG-IP Next Cloud-Native Network Functions (CNF)
- F5 BIG-IP Next Service Proxy for Kubernetes (SPK)
- F5 BIG-IP Next for Kubernetes 2.0.0
Discovery Timeline
- 2025-10-15 - CVE-2025-55670 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-55670
Vulnerability Analysis
The vulnerability resides in the Traffic Management Microkernel (TMM), the core data plane component of BIG-IP Next products. TMM handles all traffic proxying, load balancing, and policy enforcement for the affected Kubernetes-integrated deployments. Repeated invocation of an undisclosed API causes TMM to terminate, halting data plane operations until the process restarts. F5 has withheld specific API details to limit exposure prior to broad patch adoption.
Root Cause
The issue maps to [CWE-770], indicating the affected API path fails to enforce resource limits or throttling. Repeated calls exhaust or misuse a bounded resource within TMM, driving the process to an unrecoverable state. Without rate limiting or backpressure on the affected code path, an authenticated caller can sustain the malicious call pattern.
Attack Vector
The attack requires network access to the management or API interface and low-level authenticated privileges. No user interaction is required. The impact is limited to availability of the TMM process; confidentiality and integrity remain unaffected. In Kubernetes CNF and SPK deployments, TMM termination directly interrupts north-south and east-west traffic served by the affected pods.
No public proof-of-concept has been released. The specific API endpoint remains undisclosed. See the F5 Support Article K000154614 for vendor-specific technical guidance.
Detection Methods for CVE-2025-55670
Indicators of Compromise
- Unexpected TMM process restarts or crash loops in BIG-IP Next CNF, SPK, or Kubernetes pods
- Repeated identical API calls from a single authenticated source to BIG-IP Next control plane endpoints
- Traffic processing gaps corresponding to TMM termination events in pod logs
Detection Strategies
- Monitor Kubernetes pod restart counters for TMM containers and alert on abnormal restart frequency
- Correlate authenticated API access logs with TMM termination timestamps to identify triggering callers
- Baseline normal API call rates per authenticated principal and flag high-volume anomalies
Monitoring Recommendations
- Aggregate BIG-IP Next control plane logs into a centralized SIEM for cross-pod correlation
- Alert on TMM crash events and repeated 5xx responses from BIG-IP Next API endpoints
- Track authentication events for BIG-IP Next API users and review privilege assignments regularly
How to Mitigate CVE-2025-55670
Immediate Actions Required
- Review the F5 Support Article K000154614 for fixed version information and apply the vendor-supplied update
- Restrict network access to BIG-IP Next management and API interfaces to trusted administrative networks only
- Audit accounts with API access privileges and remove unused or over-privileged credentials
Patch Information
F5 has published remediation guidance in Support Article K000154614. Upgrade affected BIG-IP Next CNF, SPK, and BIG-IP Next for Kubernetes deployments to the fixed versions listed by F5. Software versions that have reached End of Technical Support (EoTS) are not evaluated and should be replaced with supported releases.
Workarounds
- Limit API access to the minimum set of trusted administrators using Kubernetes network policies
- Enforce role-based access control (RBAC) to reduce the population of accounts that can reach the affected API surface
- Deploy upstream rate limiting on API traffic to reduce the feasibility of repeated call patterns
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.