CVE-2025-54500
Unknown
Unknown - Not Provided
BaseFortify
Publication date: 2025-08-13
Last updated on: 2026-02-04
Assigner: F5 Networks
Description
Description
An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit (HTTP/2 MadeYouReset Attack).
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| f5 | big-ip_access_policy_manager | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_advanced_web_application_firewall | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_analytics | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_application_acceleration_manager | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_application_security_manager | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_application_visibility_and_reporting | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_automation_toolchain | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_carrier-grade_nat | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_container_ingress_services | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_ddos_hybrid_defender | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_domain_name_system | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_edge_gateway | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_fraud_protection_service | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_global_traffic_manager | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_link_controller | From 15.1.0 (inc) to 15.1.1.0.8 (exc) |
| f5 | big-ip_local_traffic_manager | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_policy_enforcement_manager | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_ssl_orchestrator | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_webaccelerator | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_websafe | From 15.1.0 (inc) to 15.1.10.8 (exc) |
| f5 | big-ip_access_policy_manager | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_advanced_web_application_firewall | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_analytics | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_application_acceleration_manager | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_application_security_manager | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_application_visibility_and_reporting | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_automation_toolchain | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_carrier-grade_nat | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_container_ingress_services | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_ddos_hybrid_defender | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_domain_name_system | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_edge_gateway | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_fraud_protection_service | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_global_traffic_manager | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_link_controller | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_local_traffic_manager | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_policy_enforcement_manager | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_ssl_orchestrator | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_webaccelerator | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_websafe | From 16.1.0 (inc) to 16.1.6.1 (exc) |
| f5 | big-ip_access_policy_manager | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_access_policy_manager | From 17.5.0 (inc) to 17.5.1.2 (exc) |
| f5 | big-ip_advanced_web_application_firewall | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_advanced_web_application_firewall | From 17.5.0 (inc) to 17.5.1.2 (exc) |
| f5 | big-ip_analytics | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_analytics | From 17.5.0 (inc) to 17.5.1.2 (exc) |
| f5 | big-ip_application_acceleration_manager | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_application_acceleration_manager | From 17.5.0 (inc) to 17.5.1.2 (exc) |
| f5 | big-ip_application_security_manager | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_application_security_manager | From 17.5.0 (inc) to 17.5.1.2 (exc) |
| f5 | big-ip_application_visibility_and_reporting | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_application_visibility_and_reporting | From 17.5.0 (inc) to 17.5.1.2 (exc) |
| f5 | big-ip_automation_toolchain | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_automation_toolchain | From 17.5.0 (inc) to 17.5.1.2 (exc) |
| f5 | big-ip_carrier-grade_nat | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_carrier-grade_nat | From 17.5.0 (inc) to 17.5.1.2 (exc) |
| f5 | big-ip_container_ingress_services | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_container_ingress_services | From 17.5.0 (inc) to 17.5.1.2 (exc) |
| f5 | big-ip_ddos_hybrid_defender | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_ddos_hybrid_defender | From 17.5.0 (inc) to 17.5.1.2 (exc) |
| f5 | big-ip_domain_name_system | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_domain_name_system | From 17.5.0 (inc) to 17.5.1.2 (exc) |
| f5 | big-ip_edge_gateway | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_edge_gateway | From 17.5.0 (inc) to 17.5.1.2 (exc) |
| f5 | big-ip_fraud_protection_service | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_fraud_protection_service | From 17.5.0 (inc) to 17.5.1.2 (exc) |
| f5 | big-ip_global_traffic_manager | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_link_controller | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_link_controller | From 17.5.0 (inc) to 17.5.1.2 (exc) |
| f5 | big-ip_local_traffic_manager | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_local_traffic_manager | From 17.5.0 (inc) to 17.5.1.2 (exc) |
| f5 | big-ip_policy_enforcement_manager | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_policy_enforcement_manager | From 17.5.0 (inc) to 17.5.1.2 (exc) |
| f5 | big-ip_ssl_orchestrator | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_ssl_orchestrator | From 17.5.0 (inc) to 17.5.1.2 (exc) |
| f5 | big-ip_webaccelerator | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_webaccelerator | From 17.5.0 (inc) to 17.5.1.2 (exc) |
| f5 | big-ip_websafe | From 17.1.0 (inc) to 17.1.3 (exc) |
| f5 | big-ip_websafe | From 17.5.0 (inc) to 17.5.1.2 (exc) |
| f5 | big-ip_next_central_manager | 20.3.0 |
| f5 | big-ip_next_cloud-native_network_functions | From 1.1.0 (inc) to 1.4.1 (inc) |
| f5 | big-ip_next_cloud-native_network_functions | From 2.0.0 (inc) to 2.0.2 (inc) |
| f5 | big-ip_next_for_kubernetes | 2.0.0 |
| f5 | big-ip_next_service_proxy_for_kubernetes | From 1.7.0 (inc) to 1.9.2 (inc) |
| f5 | big-ip_next_service_proxy_for_kubernetes | From 2.0.0 (inc) to 2.0.2 (inc) |
| f5 | silverline | * |
| f5 | big-ip_advanced_firewall_manager | From 16.1.0 (inc) to 16.1.5.2.0.7.5 (inc) |
| f5 | big-ip_advanced_firewall_manager | From 16.1.0 (inc) to 16.1.5.2.0.7.5 (inc) |
| f5 | big-ip_advanced_firewall_manager | From 16.1.0 (inc) to 16.1.5.2.0.7.5 (inc) |
| f5 | big-ip_advanced_firewall_manager | From 16.1.0 (inc) to 16.1.5.2.0.7.5 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a flaw in the HTTP/2 implementation that allows an attacker to cause a denial-of-service (DoS) by sending malformed HTTP/2 control frames. These malformed frames break the maximum concurrent streams limit, leading to service disruption. This attack is known as the HTTP/2 MadeYouReset Attack.
How can this vulnerability impact me? :
The vulnerability can impact you by causing a denial-of-service condition on your HTTP/2-enabled services. Attackers can exploit the flaw to disrupt normal service availability by overwhelming the system with malformed control frames, potentially leading to service resets or unavailability.
Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70