CVE-2025-60016: F5 BIG-IP Next CNF DoS Vulnerability

CVE-2025-60016 Overview

CVE-2025-60016 is a high-severity Denial of Service vulnerability affecting F5 BIG-IP Next products. When Diffie-Hellman (DH) group Elliptic Curve Cryptography (ECC) Brainpool curves are configured in an SSL profile's Cipher Rule or Cipher Group, and that profile is applied to a virtual server, specially crafted network traffic can cause the Traffic Management Microkernel (TMM) to terminate unexpectedly.

The TMM is a critical component responsible for processing all application traffic through BIG-IP systems. Its termination results in service disruption, potentially affecting availability for all applications relying on the affected virtual server configuration.

Critical Impact

Remote attackers can cause service disruption by crashing the TMM process on F5 BIG-IP Next systems configured with ECC Brainpool cipher curves, leading to denial of service for all traffic processed through affected virtual servers.

Affected Products

• F5 BIG-IP Next Cloud-Native Network Functions
• F5 BIG-IP Next Service Proxy for Kubernetes

Discovery Timeline

• 2025-10-15 - CVE-2025-60016 published to NVD
• 2025-10-22 - Last updated in NVD database

Technical Details for CVE-2025-60016

Vulnerability Analysis

This vulnerability stems from improper bounds checking (CWE-119) in the Traffic Management Microkernel when processing SSL/TLS handshakes using ECC Brainpool curves. The TMM component handles cryptographic operations for SSL profiles, and when Brainpool curves are enabled in cipher configurations, malformed or specially crafted traffic can trigger a memory safety violation leading to process termination.

The vulnerability is exploitable remotely without authentication, requiring only network access to the affected virtual server. The attack does not require user interaction and can be executed with low complexity, making it a practical vector for service disruption attacks against exposed F5 BIG-IP deployments.

Root Cause

The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). When the TMM processes cryptographic operations involving ECC Brainpool curves (such as brainpoolP256r1, brainpoolP384r1, or brainpoolP512r1), insufficient boundary validation during the elliptic curve computation can lead to out-of-bounds memory access. This memory safety violation causes the TMM process to crash, resulting in service unavailability.

Attack Vector

The attack is network-based and targets the SSL/TLS handshake process on virtual servers configured with ECC Brainpool cipher suites. An attacker can exploit this vulnerability by:

1. Identifying F5 BIG-IP Next deployments with SSL profiles using Brainpool curves
2. Initiating SSL/TLS connections to the affected virtual server
3. Sending crafted handshake messages that trigger the memory boundary violation during elliptic curve processing
4. Causing the TMM to terminate, disrupting all traffic processing through the affected system

The vulnerability affects the network layer and requires no prior authentication or privileges. Upon successful exploitation, the availability impact is high while confidentiality and integrity remain unaffected, indicating a pure denial of service condition.

Detection Methods for CVE-2025-60016

Indicators of Compromise

• Unexpected TMM process restarts or crashes in system logs
• SSL/TLS handshake failures coinciding with service disruptions
• Anomalous network traffic patterns targeting virtual servers with Brainpool cipher configurations
• High availability (HA) failover events without apparent cause

Detection Strategies

• Monitor TMM crash logs and core dump generation for patterns indicating exploitation attempts
• Implement network traffic analysis to detect anomalous SSL/TLS handshake patterns
• Review SSL profile configurations to identify deployments using ECC Brainpool cipher groups
• Configure alerting on BIG-IP system health metrics for unexpected process terminations

Monitoring Recommendations

• Enable detailed logging for SSL/TLS handshake events on affected virtual servers
• Implement real-time monitoring of TMM process stability and restart frequency
• Deploy network-based intrusion detection to identify potential exploitation attempts
• Configure SNMP traps or syslog alerts for TMM failures and high availability events

How to Mitigate CVE-2025-60016

Immediate Actions Required

• Review SSL profile configurations to identify use of ECC Brainpool curves in Cipher Rules or Cipher Groups
• Consider temporarily disabling Brainpool curves in favor of alternative ECC curves such as NIST P-256, P-384, or P-521
• Apply vendor-provided patches as soon as available
• Implement network segmentation to limit exposure of affected virtual servers

Patch Information

F5 has published security advisory K000139514 addressing this vulnerability. Administrators should consult the F5 Security Article K000139514 for specific patch versions and upgrade guidance for BIG-IP Next Cloud-Native Network Functions and BIG-IP Next Service Proxy for Kubernetes deployments.

Note that software versions which have reached End of Technical Support (EoTS) are not evaluated and may remain vulnerable.

Workarounds

• Modify SSL profile Cipher Rules to exclude ECC Brainpool curves (brainpoolP256r1, brainpoolP384r1, brainpoolP512r1)
• Use alternative elliptic curves such as secp256r1 (P-256), secp384r1 (P-384), or secp521r1 (P-521) for DH key exchange
• Implement rate limiting and connection throttling on affected virtual servers to reduce exploitation risk
• Deploy web application firewalls or network security controls to filter potentially malicious SSL/TLS traffic

# Review SSL profile cipher configuration (example)
# Consult F5 documentation for specific commands for BIG-IP Next
# Check for Brainpool curve usage in cipher groups:
# - brainpoolP256r1
# - brainpoolP384r1
# - brainpoolP512r1
# Replace with NIST curves as alternative