CVE-2023-22839: BIG-IP DNS profile vulnerability

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-02-01 · updated 2026-10-28
Weakness: CWE-476

Description

On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all version of 13.1.x, when a DNS profile with the Rapid Response Mode setting enabled is configured on a virtual server with hardware SYN cookies enabled, undisclosed requests cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

F5 Big-Ip 10000S Firmware: all versions
F5 Big-Ip 10200V-Ssl Firmware: all versions
F5 Big-Ip 10200V Firmware: all versions
F5 Big-Ip 12000 Firmware: all versions
F5 Big-Ip 5000S Firmware: all versions
F5 Big-Ip 5200V-Ssl Firmware: all versions
F5 Big-Ip 5200V Firmware: all versions
F5 Big-Ip 7000S Firmware: all versions
F5 Big-Ip 7200V-Ssl Firmware: all versions
F5 Big-Ip 7200V Firmware: all versions
F5 BIG-IP DNS: from 13.1.0 through 13.1.5; from 14.1.0 before 14.1.5.3; from 15.1.0 before 15.1.7; from 16.1.0 before 16.1.3.3; from 17.0.0 before 17.0.0.2 — fixed in 14.1.5.3, 15.1.7, 16.1.3.3, 17.0.0.2
F5 Big-Ip I10600 Firmware: all versions
F5 Big-Ip I10800 Firmware: all versions
F5 Big-Ip I11600 Firmware: all versions
F5 Big-Ip I11800 Firmware: all versions
F5 Big-Ip I15600 Firmware: all versions
F5 Big-Ip I15800 Firmware: all versions
F5 Big-Ip I5600 Firmware: all versions
F5 Big-Ip I5800 Firmware: all versions
F5 Big-Ip I7600 Firmware: all versions
F5 Big-Ip I7800 Firmware: all versions
F5 BIG-IP (LTM): from 13.1.0 through 13.1.5; from 14.1.0 before 14.1.5.3; from 15.1.0 before 15.1.7; from 16.1.0 before 16.1.3.3; from 17.0.0 before 17.0.0.2 — fixed in 14.1.5.3, 15.1.7, 16.1.3.3, 17.0.0.2
F5 R10600 Firmware: all versions
F5 R10800 Firmware: all versions
F5 R10900 Firmware: all versions
F5 R5600 Firmware: all versions
F5 R5800 Firmware: all versions
F5 R5900 Firmware: all versions
F5 Velos Bx110 Firmware: all versions
F5 Viprion B2100 Firmware: all versions

How to fix

Upgrade to a fixed version: F5 BIG-IP DNS 14.1.5.3, 15.1.7, 16.1.3.3, 17.0.0.2; F5 BIG-IP (LTM) 14.1.5.3, 15.1.7, 16.1.3.3, 17.0.0.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-22839 or the next vulnerability affects your stack