CVE-2025-58120: F5 BIG-IP Next CNF DoS Vulnerability

CVE-2025-58120 Overview

CVE-2025-58120 is a high-severity Denial of Service vulnerability affecting F5 BIG-IP Next products when HTTP/2 Ingress is configured. The vulnerability allows remote attackers to send specially crafted, undisclosed traffic that can cause the Traffic Management Microkernel (TMM) to terminate unexpectedly. This results in service disruption and potential availability impact for applications and services relying on the affected F5 infrastructure.

The TMM is a critical component responsible for processing all application traffic in F5 BIG-IP environments. When this component terminates, it can lead to significant service outages affecting downstream applications and users.

Critical Impact

Remote unauthenticated attackers can cause complete service disruption by terminating the Traffic Management Microkernel (TMM) through malicious HTTP/2 traffic, potentially affecting all services behind the affected F5 BIG-IP Next deployment.

Affected Products

• F5 BIG-IP Next Cloud-Native Network Functions (versions up to and including 2.0.0)
• F5 BIG-IP Next for Kubernetes (version 2.0.0)
• F5 BIG-IP Next Service Proxy for Kubernetes (versions 1.7.14 and 2.0.0)

Discovery Timeline

• October 15, 2025 - CVE-2025-58120 published to NVD
• October 22, 2025 - Last updated in NVD database

Technical Details for CVE-2025-58120

Vulnerability Analysis

This vulnerability is classified as CWE-476 (NULL Pointer Dereference), indicating that the TMM component fails to properly validate certain input conditions when processing HTTP/2 traffic. When the TMM encounters malformed or unexpected HTTP/2 traffic patterns, it attempts to dereference a null pointer, causing the process to crash and terminate.

The attack can be executed remotely over the network without requiring authentication or user interaction. The vulnerability specifically impacts the availability of affected systems, as the TMM termination disrupts traffic processing capabilities.

Root Cause

The root cause of CVE-2025-58120 is a NULL Pointer Dereference (CWE-476) in the Traffic Management Microkernel's HTTP/2 ingress processing logic. When handling certain HTTP/2 traffic patterns, the TMM fails to perform adequate null checks before dereferencing pointers, leading to an unhandled exception that terminates the process.

This type of vulnerability typically occurs when code assumes a pointer will always contain a valid memory address without verifying this assumption, particularly in error handling paths or edge cases within the HTTP/2 protocol implementation.

Attack Vector

The vulnerability can be exploited remotely over the network (Network attack vector). An attacker does not require any authentication or privileges to trigger the vulnerability, and no user interaction is needed for successful exploitation.

The attack flow involves:

1. Attacker identifies a target F5 BIG-IP Next deployment with HTTP/2 Ingress configured
2. Attacker sends specially crafted HTTP/2 traffic to the target system
3. The malformed traffic triggers the null pointer dereference condition in TMM
4. TMM terminates, causing service disruption for all traffic processed by the affected instance

Since the specific traffic patterns that trigger this vulnerability are undisclosed by F5, detailed exploitation mechanics are not publicly available. Consult the F5 Support Article K000156623 for additional technical details.

Detection Methods for CVE-2025-58120

Indicators of Compromise

• Unexpected TMM process terminations or restarts in F5 BIG-IP Next logs
• Increased volume of HTTP/2 traffic from suspicious or unexpected sources
• Service availability issues coinciding with HTTP/2 traffic anomalies
• Core dumps or crash reports from the TMM component

Detection Strategies

• Monitor TMM process health and implement alerting for unexpected terminations
• Enable detailed HTTP/2 request logging to identify anomalous traffic patterns
• Deploy network intrusion detection systems (IDS) to monitor for suspicious HTTP/2 traffic
• Review F5 system logs for repeated TMM crashes or error conditions

Monitoring Recommendations

• Implement continuous monitoring of TMM process status and health metrics
• Configure alerts for rapid response when TMM terminations are detected
• Monitor network traffic patterns for unusual HTTP/2 connection behavior
• Establish baseline metrics for normal HTTP/2 traffic to identify deviations

How to Mitigate CVE-2025-58120

Immediate Actions Required

• Review your F5 BIG-IP Next deployment to determine if HTTP/2 Ingress is configured
• Consult the F5 Support Article K000156623 for specific mitigation guidance
• Plan and schedule patching to updated versions as recommended by F5
• Implement additional monitoring for TMM process health during the remediation window

Patch Information

F5 has released security updates to address this vulnerability. Organizations should consult the official F5 Support Article K000156623 for specific patch versions and upgrade guidance for each affected product:

• F5 BIG-IP Next Cloud-Native Network Functions: Upgrade to the fixed version specified in the F5 advisory
• F5 BIG-IP Next for Kubernetes: Upgrade to the fixed version specified in the F5 advisory
• F5 BIG-IP Next Service Proxy for Kubernetes: Upgrade to the fixed version specified in the F5 advisory

Note: Software versions that have reached End of Technical Support (EoTS) are not evaluated and may remain vulnerable.

Workarounds

• If HTTP/2 Ingress is not required, consider disabling it until patches can be applied
• Implement network-level access controls to restrict HTTP/2 traffic to trusted sources
• Deploy a Web Application Firewall (WAF) in front of affected systems to filter malicious traffic
• Consider rate limiting HTTP/2 connections to reduce the potential impact of exploitation attempts

# Example: Review current HTTP/2 configuration status
# Consult F5 documentation for specific commands applicable to your deployment
# Verify HTTP/2 Ingress configuration in your BIG-IP Next environment
# Review F5 Support Article K000156623 for specific workaround instructions