CVE-2025-41399
📋 TL;DR
This vulnerability allows attackers to cause memory exhaustion on F5 BIG-IP systems by sending specially crafted SCTP requests to virtual servers with SCTP profiles configured. This affects F5 BIG-IP systems running vulnerable versions with SCTP-enabled virtual servers. Systems that have reached End of Technical Support are not evaluated but may still be vulnerable.
💻 Affected Systems
- F5 BIG-IP
📦 What is this software?
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Advanced Web Application Firewall by F5
View all CVEs affecting Big Ip Advanced Web Application Firewall →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Acceleration Manager by F5
View all CVEs affecting Big Ip Application Acceleration Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Security Manager by F5
View all CVEs affecting Big Ip Application Security Manager →
Big Ip Application Visibility And Reporting by F5
View all CVEs affecting Big Ip Application Visibility And Reporting →
Big Ip Application Visibility And Reporting by F5
View all CVEs affecting Big Ip Application Visibility And Reporting →
Big Ip Application Visibility And Reporting by F5
View all CVEs affecting Big Ip Application Visibility And Reporting →
Big Ip Next Cloud Native Network Functions by F5
View all CVEs affecting Big Ip Next Cloud Native Network Functions →
Big Ip Next Service Proxy For Kubernetes by F5
View all CVEs affecting Big Ip Next Service Proxy For Kubernetes →
⚠️ Risk & Real-World Impact
Worst Case
Complete system outage due to memory exhaustion, leading to denial of service for all services on the affected BIG-IP device.
Likely Case
Degraded performance and potential service disruption for applications using SCTP virtual servers, requiring system reboot to restore functionality.
If Mitigated
Minimal impact if SCTP is not used or if proper rate limiting and monitoring are in place.
🎯 Exploit Status
Attack requires network access to SCTP-enabled virtual servers. No authentication required to trigger the memory exhaustion.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to F5 advisory K000137709 for specific fixed versions
Vendor Advisory: https://my.f5.com/manage/s/article/K000137709
Restart Required: Yes
Instructions:
1. Review F5 advisory K000137709 for affected versions. 2. Download and apply the appropriate patch from F5 Downloads. 3. Schedule maintenance window for restart. 4. Verify patch application and monitor system stability.
🔧 Temporary Workarounds
Disable SCTP virtual servers
allRemove SCTP profiles from virtual servers if SCTP functionality is not required
tmsh modify ltm virtual <virtual_server_name> profiles delete { sctp }
Implement rate limiting
allConfigure connection rate limiting on SCTP virtual servers
tmsh modify ltm virtual <virtual_server_name> rate-limit <limit_value>
🧯 If You Can't Patch
- Implement network segmentation to restrict access to SCTP virtual servers
- Deploy additional monitoring for memory utilization on BIG-IP systems
🔍 How to Verify
Check if Vulnerable:
Check if any virtual servers have SCTP profiles configured: tmsh list ltm virtual one-line | grep sctpCheck Version:
tmsh show sys versionVerify Fix Applied:
Verify patch version matches fixed versions in advisory: tmsh show sys version📡 Detection & Monitoring
Log Indicators:
- Rapid increase in memory utilization
- SCTP connection spikes
- System performance degradation alerts
Network Indicators:
- Unusual SCTP traffic patterns to virtual servers
- High volume of SCTP connections
SIEM Query:
source="bigip_logs" AND ("memory high" OR "sctp" AND "connection spike")