What’s Vulnerable › Vulnerabilities

CVE-2019-6682

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-12-23 · updated 2026-06-17
• Weakness: CWE-400

Description

On versions 15.0.0-15.0.1.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, the BIG-IP ASM system may consume excessive resources when processing certain types of HTTP responses from the origin web server. This vulnerability is only known to affect resource-constrained systems in which the security policy is configured with response-side features, such as Data Guard or response-side learning.

Affected products

• BIG-IP ASM: from 11.5.2 through 11.6.5; from 12.1.0 through 12.1.5; from 13.1.0 before 13.1.3.2; from 14.1.0 before 14.1.2.3; from 15.0.0 before 15.1.0 — fixed in 13.1.3.2, 14.1.2.3, 15.1.0

How to fix

Upgrade to a fixed version: BIG-IP ASM 13.1.3.2, 14.1.2.3, 15.1.0. Check the vendor advisory for mitigations.

References

• https://support.f5.com/csp/article/K40452417
• https://support.f5.com/csp/article/K40452417

Get alerted when CVE-2019-6682 or the next vulnerability affects your stack