F5 BIG-IP prior 17.1.3.1/17.5.1.4/21.0.0.1 Traffic Management Microkernel infinite loop

Summaryinfo

A vulnerability has been found in F5 BIG-IP and classified as problematic. This affects an unknown function of the component Traffic Management Microkernel. The manipulation leads to infinite loop. This vulnerability is traded as CVE-2026-42920. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in F5 BIG-IP and classified as problematic. This issue affects an unknown part of the component Traffic Management Microkernel. The manipulation with an unknown input leads to a infinite loop vulnerability. Using CWE to declare the problem leads to CWE-835. The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. Impacted is availability. The summary by CVE is:

When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

The advisory is shared at my.f5.com. The identification of this vulnerability is CVE-2026-42920 since 05/01/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/24/2026). MITRE ATT&CK project uses the attack technique T1499 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 316096 (F5 Networks BIG-IP : BIG-IP DTLS vulnerability (K000160901)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 17.1.3.1, 17.5.1.4 or 21.0.0.1 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (316096) and CERT Bund (WID-SEC-2026-1532). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• F5 BIG-IP

Productinfo

Type

• Firewall Software

Vendor

• F5

Name

• BIG-IP

License

• commercial

Website

• Vendor: https://f5.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion