CVE-2026-59762: BIG-IP HTTP/2 Memory Exhaustion DoS Flaw

CVE-2026-59762 Overview

CVE-2026-59762 is a resource exhaustion vulnerability [CWE-770] affecting F5 BIG-IP systems configured with an HTTP/2 profile on a virtual server. Undisclosed requests can trigger excessive memory consumption within the Traffic Management Microkernel (TMM) process. A remote, unauthenticated attacker can exploit this flaw to degrade system performance until TMM restarts, resulting in a denial-of-service condition on the data plane. The vulnerability does not expose the control plane. F5 published advisory K000162231 describing the issue. Software versions that have reached End of Technical Support (EoTS) were not evaluated as part of this advisory.

Critical Impact
Remote, unauthenticated attackers can exhaust BIG-IP memory resources, forcing TMM restarts and causing denial-of-service on virtual servers with HTTP/2 profiles.

Affected Products

F5 BIG-IP systems with an HTTP/2 profile configured on a virtual server
BIG-IP Traffic Management Microkernel (TMM) data plane
Refer to F5 advisory K000162231 for the complete list of affected supported versions

Discovery Timeline

2026-07-15 - CVE-2026-59762 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-59762

Vulnerability Analysis

The vulnerability arises when a BIG-IP virtual server has an HTTP/2 profile attached. Specific undisclosed HTTP/2 request patterns cause the TMM process to allocate memory without appropriate release or bounding. Over time, or under sustained request volume, memory utilization increases until TMM must be restarted either automatically or manually.

The issue is scoped exclusively to the data plane. Management interfaces, configuration APIs, and other control plane services remain unaffected. However, because TMM handles all application traffic processing on BIG-IP, a TMM restart interrupts every virtual server on the affected instance, not only those using HTTP/2.

The root weakness maps to CWE-770 (Allocation of Resources Without Limits or Throttling), a common pattern in HTTP/2 implementations where per-stream state, frame buffers, or dynamic tables grow beyond safe bounds.

Root Cause

The TMM HTTP/2 handling logic does not enforce sufficient limits on memory allocated during request processing. Attacker-crafted requests trigger repeated or oversized allocations that persist longer than expected, causing memory pressure until process termination.

Attack Vector

The attack requires network access to a virtual server with an HTTP/2 profile. No authentication, user interaction, or elevated privileges are needed. An attacker sends specifically crafted HTTP/2 traffic to the target virtual server and observes progressive memory growth in the TMM process. Sustained exploitation forces TMM to restart, dropping connections and producing a denial-of-service condition across the appliance.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is 0.328%.

Refer to the F5 Security Article K000162231 for vendor-provided technical details.

Detection Methods for CVE-2026-59762

Indicators of Compromise

Progressive increase in TMM memory utilization on BIG-IP appliances processing HTTP/2 traffic
Unexpected TMM process restarts recorded in /var/log/ltm or system logs
Elevated HTTP/2 stream or frame counts from a limited set of client IPs targeting a virtual server
Connection drops or service interruptions on virtual servers unrelated to configured maintenance windows

Detection Strategies

Baseline normal TMM memory consumption per virtual server and alert on sustained deviation
Correlate spikes in HTTP/2 request rates with memory growth in TMM to identify exploitation attempts
Inspect BIG-IP high-availability failover events and TMM core dumps for signatures matching this advisory

Monitoring Recommendations

Enable SNMP or telemetry export of TMM memory metrics to a centralized monitoring system
Forward BIG-IP system logs to a SIEM and alert on tmm restart or sod failover events
Track per-client HTTP/2 request patterns at upstream network devices to identify anomalous senders

How to Mitigate CVE-2026-59762

Immediate Actions Required

Review all virtual servers to identify those with an HTTP/2 profile attached
Apply the fixed software version identified in F5 advisory K000162231 as soon as it is available for your branch
Restrict HTTP/2 exposure on virtual servers that do not require it until patching is complete
Monitor TMM memory utilization continuously on affected systems

Patch Information

F5 publishes fixed software versions and mitigation guidance in the F5 Security Article K000162231. Consult that article for the specific fixed builds mapped to each supported BIG-IP branch. Versions at End of Technical Support are not evaluated and should be upgraded to a supported release.

Workarounds

Remove the HTTP/2 profile from virtual servers where HTTP/2 is not required, forcing clients to HTTP/1.1
Place an upstream device or rate-limiting control in front of BIG-IP to constrain HTTP/2 request rates from individual sources
Restrict access to affected virtual servers using source address filtering where feasible

bash

# Example: list virtual servers with an HTTP/2 profile attached
tmsh list ltm virtual one-line | grep -i http2

# Example: remove an HTTP/2 profile from a virtual server as a temporary workaround
tmsh modify ltm virtual <VS_NAME> profiles delete { http2 }
tmsh save sys config