CVE-2025-47148

When the BIG-IP system is configured as both a Security Assertion Markup Language (SAML) service provider (SP) and Identity Provider (IdP), with single logout (SLO) enabled on an access policy, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://my.f5.com/manage/s/article/K000148816	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:f5:big-ip_access_policy_manager::::::::
	cpe:2.3:a:f5:big-ip_access_policy_manager::::::::
	cpe:2.3:a:f5:big-ip_access_policy_manager::::::::
	cpe:2.3:a:f5:big-ip_access_policy_manager:17.5.0:::::::*
	cpe:2.3:a:f5:big-ip_ssl_orchestrator::::::::
	cpe:2.3:a:f5:big-ip_ssl_orchestrator::::::::
	cpe:2.3:a:f5:big-ip_ssl_orchestrator::::::::
	cpe:2.3:a:f5:big-ip_ssl_orchestrator:17.5.0:::::::*

History

08 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Cuando el sistema BIG-IP está configurado tanto como un proveedor de servicios (SP) como un proveedor de identidad (IdP) de Security Assertion Markup Language (SAML), con el cierre de sesión único (SLO) habilitado en una política de acceso, las solicitudes no reveladas pueden causar un aumento en la utilización de recursos de memoria. Nota: Las versiones de software que han alcanzado el fin del soporte técnico (EoTS) no se evalúan.

Information

Published : 2025-10-15 14:15

Updated : 2026-10-08 12:10

NVD link : CVE-2025-47148

Mitre link : CVE-2025-47148

CVE.ORG link : CVE-2025-47148

JSON object : View

Products Affected

f5

big-ip_ssl_orchestrator
big-ip_access_policy_manager

CWE

CWE-404

Improper Resource Shutdown or Release

{"id": "CVE-2025-47148", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-47148", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-16T03:56:50.832478Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "f5sirt@f5.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "f5sirt@f5.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f5sirt@f5.com", "affectedData": [{"vendor": "F5", "modules": ["APM", "SWG", "SSLO"], "product": "BIG-IP", "versions": [{"status": "affected", "version": "17.5.0", "lessThan": "17.5.1", "versionType": "custom"}, {"status": "affected", "version": "17.1.0", "lessThan": "17.1.3", "versionType": "custom"}, {"status": "affected", "version": "16.1.0", "lessThan": "16.1.6.1", "versionType": "custom"}, {"status": "affected", "version": "15.1.0", "lessThan": "15.1.10.8", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2025-10-15T14:15:47.637", "references": [{"url": "https://my.f5.com/manage/s/article/K000148816", "tags": ["Vendor Advisory"], "source": "f5sirt@f5.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "f5sirt@f5.com", "description": [{"lang": "en", "value": "CWE-404"}]}], "descriptions": [{"lang": "en", "value": "When the BIG-IP system is configured as both a Security Assertion Markup Language (SAML) service provider (SP) and Identity Provider (IdP), with single logout (SLO) enabled on an access policy, undisclosed requests can cause an increase in memory resource utilization.\u00a0\u00a0Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}, {"lang": "es", "value": "Cuando el sistema BIG-IP est\u00e1 configurado tanto como un proveedor de servicios (SP) como un proveedor de identidad (IdP) de Security Assertion Markup Language (SAML), con el cierre de sesi\u00f3n \u00fanico (SLO) habilitado en una pol\u00edtica de acceso, las solicitudes no reveladas pueden causar un aumento en la utilizaci\u00f3n de recursos de memoria. Nota: Las versiones de software que han alcanzado el fin del soporte t\u00e9cnico (EoTS) no se eval\u00faan."}], "lastModified": "2026-10-08T12:10:00.217", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A7A0C1CA-EDEF-463F-B7C8-8B9E67239FC1", "versionEndExcluding": "15.1.10.8", "versionStartIncluding": "15.1.0"}, {"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6494E2A7-1473-46C0-97F8-90827D9466AA", "versionEndExcluding": "16.1.6.1", "versionStartIncluding": "16.1.0"}, {"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96D35435-27A7-4A88-9432-1F5AB0112B8C", "versionEndExcluding": "17.1.3", "versionStartIncluding": "17.1.0"}, {"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:17.5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "369D38E2-62B5-47C4-B606-7A2DD866133C"}, {"criteria": "cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40B87228-F144-41C7-ACD8-1168CC5C57F3", "versionEndExcluding": "15.1.10.8", "versionStartIncluding": "15.1.0"}, {"criteria": "cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7829108D-71A4-4F91-81F6-804E9EB1AE9D", "versionEndExcluding": "16.1.6.1", "versionStartIncluding": "16.1.0"}, {"criteria": "cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "581B1484-C457-4C11-B43A-DCF49EBC07DA", "versionEndExcluding": "17.1.3", "versionStartIncluding": "17.1.0"}, {"criteria": "cpe:2.3:a:f5:big-ip_ssl_orchestrator:17.5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "29BF7E7D-7E43-4937-9F68-3F9448590D72"}], "operator": "OR"}]}], "sourceIdentifier": "f5sirt@f5.com"}