CVE-2026-42409: HTTP/2 Profile DOS Vulnerability

CVE-2026-42409 Overview

CVE-2026-42409 is a denial-of-service vulnerability affecting F5 BIG-IP systems. When a virtual server is configured with both an HTTP/2 profile and an iRule using the HTTP::redirect or HTTP::respond command, undisclosed requests can terminate the Traffic Management Microkernel (TMM) process. The flaw is categorized under [CWE-476] Null Pointer Dereference and is exploitable remotely without authentication or user interaction.

Critical Impact
A network-based attacker can crash the TMM process on affected F5 BIG-IP virtual servers, disrupting all data plane traffic processed by the device until TMM restarts.

Affected Products

F5 BIG-IP virtual servers with an HTTP/2 profile attached
F5 BIG-IP iRules using HTTP::redirect or HTTP::respond commands
Software versions that have not reached End of Technical Support (EoTS)

Discovery Timeline

2026-05-13 - CVE-2026-42409 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-42409

Vulnerability Analysis

The vulnerability resides in the Traffic Management Microkernel (TMM), the core data-plane process on F5 BIG-IP appliances. TMM handles all proxied client traffic, including HTTP/2 stream processing and iRule execution. When a virtual server combines an HTTP/2 profile with an iRule invoking HTTP::redirect or HTTP::respond, specific request patterns trigger a null pointer dereference inside TMM.

Because TMM processes data plane traffic for the entire device, its termination drops in-flight connections and interrupts service. The process restarts automatically, but repeated triggering produces a sustained denial-of-service condition. The vulnerability impacts availability only, with no confidentiality or integrity exposure indicated by the CVSS vector.

Root Cause

The defect is a [CWE-476] Null Pointer Dereference. The HTTP/2 request handling path interacts with iRule response-generation commands (HTTP::redirect, HTTP::respond) in a way that leaves a required pointer uninitialized or freed before access. Dereferencing that pointer crashes TMM.

Attack Vector

An unauthenticated remote attacker sends crafted HTTP/2 requests to a vulnerable virtual server. No user interaction or privileges are required. F5 has not disclosed the exact request structure that triggers the condition. Exploitation requires that the targeted virtual server already has the vulnerable HTTP/2 profile and iRule configuration in place.

See the F5 Support Article K000159034 for vendor-specific technical detail.

Detection Methods for CVE-2026-42409

Indicators of Compromise

Unexpected TMM process restarts logged in /var/log/ltm with core dumps generated in /var/savecore
Sudden loss of data-plane traffic across all virtual servers on the device coinciding with TMM termination
HTTP/2 client connections terminating abnormally against virtual servers using HTTP::redirect or HTTP::respond iRules

Detection Strategies

Inventory virtual servers that combine an HTTP/2 profile with iRules containing HTTP::redirect or HTTP::respond commands
Monitor BIG-IP system logs for TMM panic, restart, or core dump events correlated with inbound HTTP/2 traffic
Forward BIG-IP syslog and SNMP traps to a centralized SIEM and alert on TMM restart frequency exceeding baseline

Monitoring Recommendations

Track availability of virtual servers through external synthetic checks to detect short data-plane outages
Capture and review tmm core files generated during outages for signatures matching the vulnerable code path
Correlate HTTP/2 traffic spikes from single source IPs with TMM restart events to identify exploitation attempts

How to Mitigate CVE-2026-42409

Immediate Actions Required

Identify all BIG-IP virtual servers that simultaneously use an HTTP/2 profile and an iRule invoking HTTP::redirect or HTTP::respond
Apply the F5-supplied fix as documented in F5 Support Article K000159034 once available for your branch
Verify that BIG-IP software is on a version still within F5 Technical Support; EoTS versions are not evaluated for this CVE

Patch Information

F5 has published advisory K000159034 covering this issue. Review the article for the list of fixed software versions and apply the upgrade path that matches your deployment. Confirm post-upgrade that TMM no longer terminates when the affected configuration handles HTTP/2 traffic.

Workarounds

Replace iRule HTTP::redirect and HTTP::respond logic with an HTTP profile redirect or a policy rule that does not trigger the defect
Remove the HTTP/2 profile from virtual servers that must retain the affected iRule logic, falling back to HTTP/1.1
Restrict client access to affected virtual servers using source IP allow-lists until the patch is deployed

bash

# Identify virtual servers combining HTTP/2 with HTTP::redirect or HTTP::respond iRules
tmsh list ltm virtual one-line | grep -i http2
tmsh list ltm rule | grep -E "HTTP::redirect|HTTP::respond"