CVE-2026-34019: BFD Routing Protocol DoS Vulnerability

CVE-2026-34019 Overview

CVE-2026-34019 is a denial of service vulnerability affecting F5 systems where Bidirectional Forwarding Detection (BFD) is configured with Static and Dynamic routing protocols. Undisclosed network traffic can cause the Traffic Management Microkernel (TMM) to stop processing BFD packets. When TMM halts BFD processing, the configured routing protocol fails over, disrupting network availability.

The weakness is classified under [CWE-410] (Insufficient Resource Pool) and is exploitable over the network without authentication. F5 has not evaluated software versions that have reached End of Technical Support (EoTS).

Critical Impact
Remote attackers can trigger routing protocol failover by sending crafted traffic, disrupting availability of network services that rely on BFD-monitored routes.

Affected Products

F5 BIG-IP systems with BFD configured in Static routing protocols
F5 BIG-IP systems with BFD configured in Dynamic routing protocols
Refer to the F5 Security Advisory K000150508 for the complete list of affected versions

Discovery Timeline

2026-05-13 - CVE-2026-34019 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-34019

Vulnerability Analysis

The vulnerability resides in the Traffic Management Microkernel (TMM), the core packet processing engine in F5 BIG-IP. TMM handles BFD, a protocol that rapidly detects faults between forwarding engines. When BFD is bound to Static or Dynamic routing protocols, TMM must continuously process BFD control packets to keep sessions alive.

Undisclosed traffic conditions cause TMM to stop processing inbound BFD packets. Once BFD packets stop being processed within the configured detection multiplier interval, peer routers declare the session down. The associated routing protocol then withdraws routes and triggers failover.

The impact is limited to availability. Confidentiality and integrity are not affected, per the CVSSv4 vector. The flaw does not require authentication or user interaction.

Root Cause

The issue is categorized as [CWE-410] Insufficient Resource Pool. F5 has not publicly disclosed the specific traffic pattern that induces the condition. The behavior indicates that TMM resources required for BFD processing become unavailable under specific traffic conditions, starving the BFD state machine of CPU cycles or queue capacity.

Attack Vector

An unauthenticated remote attacker sends crafted network traffic to an affected F5 device. The traffic does not need to target BFD directly. Instead, it consumes TMM processing capacity in a way that interrupts BFD packet handling.

As BFD timers expire, peer routers mark the BFD session as down. This triggers the routing protocol to recalculate paths and fail over, potentially blackholing traffic or rerouting through suboptimal paths. The vulnerability does not provide code execution or data exposure.

The specific exploitation traffic pattern has not been published. Consult the F5 Security Advisory K000150508 for vendor-supplied technical details and mitigations.

Detection Methods for CVE-2026-34019

Indicators of Compromise

Unexpected BFD session state transitions to Down on F5 BIG-IP devices and their routing peers
Routing protocol failover events (OSPF, BGP, IS-IS) correlated with BFD timeout messages in TMM logs
TMM CPU spikes or packet processing latency preceding BFD session loss
Repeated route flapping on networks where BFD timers are aggressive

Detection Strategies

Monitor /var/log/ltm and TMM logs for BFD neighbor state changes and bfd_session_down events
Correlate BFD session loss with concurrent inbound traffic anomalies on data plane interfaces
Alert on routing protocol adjacency resets that coincide with BFD timeouts rather than link-layer failures
Baseline TMM CPU utilization and trigger investigations on sudden sustained increases

Monitoring Recommendations

Enable SNMP traps for BFD session state changes and forward them to a centralized SIEM
Capture NetFlow or packet samples on ingress interfaces to identify traffic patterns coinciding with BFD failures
Track routing protocol convergence metrics from peer routers to detect failover events originating at F5 devices
Review F5 iHealth diagnostic snapshots regularly for TMM resource warnings

How to Mitigate CVE-2026-34019

Immediate Actions Required

Review the F5 Security Advisory K000150508 and identify whether deployed BIG-IP versions are listed as affected
Apply the fixed software versions provided by F5 for affected branches
Verify that systems running EoTS software are upgraded to a supported release, as F5 does not evaluate EoTS versions
Audit BFD configurations and confirm whether BFD is bound to Static or Dynamic routing protocols

Patch Information

F5 has published remediation details in F5 Security Advisory K000150508. Administrators should apply the engineering hotfix or upgrade to a fixed version listed in the advisory. Software versions that have reached End of Technical Support are not evaluated and should be upgraded to a supported branch.

Workarounds

Restrict inbound traffic to BIG-IP management and data plane interfaces using ACLs that permit only required protocols and source addresses
Tune BFD detection multiplier and interval values to provide additional tolerance, accepting slower failure detection as a tradeoff
Where BFD is not strictly required, consider disabling BFD on Static or Dynamic routing protocols until patches are applied
Deploy upstream rate limiting and traffic filtering to reduce the volume of unsolicited traffic reaching TMM

bash

# Example: restrict BFD source addresses on BIG-IP using a packet filter rule
tmsh create security firewall rule-list bfd_protect rules add { allow_bfd { \
    action accept \
    ip-protocol udp \
    destination { ports add { 3784 3785 4784 } } \
    source { addresses add { <trusted_peer_ip>/32 } } } }
tmsh modify net self <self_ip> fw-rules bfd_protect