What’s Vulnerable › Vulnerabilities

CVE-2022-29491

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-05-05 · updated 2026-06-17
• Weakness: CWE-476

Description

On F5 BIG-IP LTM, Advanced WAF, ASM, or APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and all versions of 13.1.x, 12.1.x, and 11.6.x, when a virtual server is configured with HTTP, TCP on one side (client/server), and DTLS on the other (server/client), undisclosed requests can cause the TMM process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Affected products

• F5 BIG-IP APM: 11.6.1, 11.6.2, 11.6.3, 11.6.4, 11.6.5, 12.1.0 (+25)
• F5 Big-Ip Advanced Web Application Firewall: 11.6.1, 11.6.2, 11.6.3, 11.6.4, 11.6.5, 12.1.0 (+25)
• BIG-IP ASM: 11.6.1, 11.6.2, 11.6.3, 11.6.4, 11.6.5, 12.1.0 (+25)
• F5 BIG-IP (LTM): 11.6.1, 11.6.2, 11.6.3, 11.6.4, 11.6.5, 12.1.0 (+25)

References

• https://support.f5.com/csp/article/K14229426
• https://support.f5.com/csp/article/K14229426

Get alerted when CVE-2022-29491 or the next vulnerability affects your stack