CVE-2025-54805

When an iRule is configured on a virtual server via the declarative API, upon re-instantiation, the cleanup process can cause an increase in the Traffic Management Microkernel (TMM) memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://my.f5.com/manage/s/article/K000151596	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:f5:big-ip_next_cloud-native_network_functions::::::::
	cpe:2.3:a:f5:big-ip_next_for_kubernetes:2.0.0:::::::*
	cpe:2.3:a:f5:big-ip_next_service_proxy_for_kubernetes::::::::

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Cuando se configura un iRule en un servidor virtual a través de la API declarativa, tras la reinstanciación, el proceso de limpieza puede causar un aumento en la utilización de los recursos de memoria del Microkernel de Gestión de Tráfico (TMM). Nota: Las versiones de software que han alcanzado el Fin de Soporte Técnico (EoTS) no se evalúan.

Information

Published : 2025-10-15 14:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-54805

Mitre link : CVE-2025-54805

CVE.ORG link : CVE-2025-54805

JSON object : View

Products Affected

f5

big-ip_next_service_proxy_for_kubernetes
big-ip_next_for_kubernetes
big-ip_next_cloud-native_network_functions

CWE

CWE-401

Missing Release of Memory after Effective Lifetime

{"id": "CVE-2025-54805", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-54805", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-16T03:56:47.985251Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "f5sirt@f5.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "f5sirt@f5.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f5sirt@f5.com", "affectedData": [{"vendor": "F5", "product": "BIG-IP Next SPK", "versions": [{"status": "unaffected", "version": "2.0.0", "lessThan": "*", "versionType": "custom"}, {"status": "affected", "version": "1.7.0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "F5", "product": "BIG-IP Next CNF", "versions": [{"status": "unaffected", "version": "2.0.0", "lessThan": "*", "versionType": "custom"}, {"status": "affected", "version": "1.1.0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "F5", "product": "BIG-IP Next for Kubernetes", "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "2.1.0", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2025-10-15T14:15:49.810", "references": [{"url": "https://my.f5.com/manage/s/article/K000151596", "tags": ["Vendor Advisory"], "source": "f5sirt@f5.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "f5sirt@f5.com", "description": [{"lang": "en", "value": "CWE-401"}]}], "descriptions": [{"lang": "en", "value": "When an iRule is configured on a virtual server via the declarative API, upon re-instantiation, the cleanup process can cause an increase in the Traffic Management Microkernel (TMM) memory resource utilization.\u00a0 Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}, {"lang": "es", "value": "Cuando se configura un iRule en un servidor virtual a trav\u00e9s de la API declarativa, tras la reinstanciaci\u00f3n, el proceso de limpieza puede causar un aumento en la utilizaci\u00f3n de los recursos de memoria del Microkernel de Gesti\u00f3n de Tr\u00e1fico (TMM). Nota: Las versiones de software que han alcanzado el Fin de Soporte T\u00e9cnico (EoTS) no se eval\u00faan."}], "lastModified": "2026-10-18T21:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:f5:big-ip_next_cloud-native_network_functions:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3222CE1A-3C23-40FC-9331-370F6BA1CDCC", "versionEndIncluding": "1.4.1", "versionStartIncluding": "1.1.0"}, {"criteria": "cpe:2.3:a:f5:big-ip_next_for_kubernetes:2.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AB9960E8-26E9-48E2-A398-7076A8B994DA"}, {"criteria": "cpe:2.3:a:f5:big-ip_next_service_proxy_for_kubernetes:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4C7328B4-B7E0-460E-8270-116FE813FB23", "versionEndIncluding": "1.9.2", "versionStartIncluding": "1.7.0"}], "operator": "OR"}]}], "sourceIdentifier": "f5sirt@f5.com"}