What’s Vulnerable › Vulnerabilities

CVE-2019-6638

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-07-03 · updated 2026-06-17
• Weakness: CWE-835

Description

On BIG-IP 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, Malformed http requests made to an undisclosed iControl REST endpoint can lead to infinite loop of the restjavad process.

Affected products

• F5 BIG-IP APM: from 14.0.0 before 14.0.0.5; from 14.1.0 before 14.1.0.6 — fixed in 14.0.0.5, 14.1.0.6
• BIG-IP: from 14.0.0 before 14.0.0.5; from 14.1.0 before 14.1.0.6 — fixed in 14.0.0.5, 14.1.0.6
• F5 Big-Ip Analytics: from 14.0.0 before 14.0.0.5; from 14.1.0 before 14.1.0.6 — fixed in 14.0.0.5, 14.1.0.6
• F5 Networks, Inc. BIG-IP (AAM): from 14.0.0 before 14.0.0.5; from 14.1.0 before 14.1.0.6 — fixed in 14.0.0.5, 14.1.0.6
• BIG-IP ASM: from 14.0.0 before 14.0.0.5; from 14.1.0 before 14.1.0.6 — fixed in 14.0.0.5, 14.1.0.6
• F5 BIG-IP DNS: from 14.0.0 before 14.0.0.5; from 14.1.0 before 14.1.0.6 — fixed in 14.0.0.5, 14.1.0.6
• F5 Big-Ip Edge Gateway: from 14.0.0 before 14.0.0.5; from 14.1.0 before 14.1.0.6 — fixed in 14.0.0.5, 14.1.0.6
• F5 Big-Ip Fraud Protection Service: from 14.0.0 before 14.0.0.5; from 14.1.0 before 14.1.0.6 — fixed in 14.0.0.5, 14.1.0.6
• F5 Big-Ip Global Traffic Manager: from 14.0.0 before 14.0.0.5; from 14.1.0 before 14.1.0.6 — fixed in 14.0.0.5, 14.1.0.6
• F5 Big-Ip Link Controller: from 14.0.0 before 14.0.0.5; from 14.1.0 before 14.1.0.6 — fixed in 14.0.0.5, 14.1.0.6
• F5 BIG-IP (LTM): from 14.0.0 before 14.0.0.5; from 14.1.0 before 14.1.0.6 — fixed in 14.0.0.5, 14.1.0.6
• F5 Networks, Inc. BIG-IP (PEM): from 14.0.0 before 14.0.0.5; from 14.1.0 before 14.1.0.6 — fixed in 14.0.0.5, 14.1.0.6
• F5 Big-Ip Webaccelerator: from 14.0.0 before 14.0.0.5; from 14.1.0 before 14.1.0.6 — fixed in 14.0.0.5, 14.1.0.6

How to fix

Upgrade to a fixed version: F5 BIG-IP APM 14.0.0.5, 14.1.0.6; BIG-IP 14.0.0.5, 14.1.0.6; F5 Big-Ip Analytics 14.0.0.5, 14.1.0.6; F5 Networks, Inc. BIG-IP (AAM) 14.0.0.5, 14.1.0.6; BIG-IP ASM 14.0.0.5, 14.1.0.6; F5 BIG-IP DNS 14.0.0.5, 14.1.0.6; F5 Big-Ip Edge Gateway 14.0.0.5, 14.1.0.6; F5 Big-Ip Fraud Protection Service 14.0.0.5, 14.1.0.6; F5 Big-Ip Global Traffic Manager 14.0.0.5, 14.1.0.6; F5 Big-Ip Link Controller 14.0.0.5, 14.1.0.6; F5 BIG-IP (LTM) 14.0.0.5, 14.1.0.6; F5 Networks, Inc. BIG-IP (PEM) 14.0.0.5, 14.1.0.6. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/109106
• https://support.f5.com/csp/article/K67825238
• https://support.f5.com/csp/article/K67825238?utm_source=f5support&amp%3Butm_medium=RSS
• http://www.securityfocus.com/bid/109106
• https://support.f5.com/csp/article/K67825238
• https://support.f5.com/csp/article/K67825238?utm_source=f5support&amp%3Butm_medium=RSS

Get alerted when CVE-2019-6638 or the next vulnerability affects your stack