What’s Vulnerable › Vulnerabilities
CVE-2026-59762: BIG-IP HTTP/2 vulnerability
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-15 · updated 2026-08-06
- Weakness: CWE-770
Description
When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. This vulnerability allows a remote, unauthenticated attacker to cause a degradation of service that can lead to a denial-of-service (DoS) on the BIG-IP system. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected products
- F5 BIG-IP Next CNF: from 1.1.0 before 1.4.3; from 2.0.0 before 2.2.3; 2.3.0 — fixed in 1.4.3, 2.2.3
- F5 BIG-IP Next for Kubernetes: from 2.0.0 before 2.2.3; 2.3.0 — fixed in 2.2.3
- F5 BIG-IP Next SPK: from 1.7.0 before 1.7.18; from 1.8.0 through 1.9.2; from 2.0.0 through 2.0.3 — fixed in 1.7.18
How to fix
Upgrade to a fixed version: F5 BIG-IP Next CNF 1.4.3, 2.2.3; F5 BIG-IP Next for Kubernetes 2.2.3; F5 BIG-IP Next SPK 1.7.18. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-59762 or the next vulnerability affects your stack