CVE-2026-59762

Analyzed Analyzed - Analysis Complete

Memory Exhaustion in F5 BIG-IP via HTTP/2

Publication date: 2026-07-15

Last updated on: 2026-08-06

Assigner: F5 Networks

Description

When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. This vulnerability allows a remote, unauthenticated attacker to cause a degradation of service that can lead to a denial-of-service (DoS) on the BIG-IP system. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-08-06

Generated

2026-08-25

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-23

NVD

CVE-2026-59762

EUVD

EUVD-2026-44679

Affected Vendors & Products

Vendor	Product	Version / Range
f5	big-ip_next_service_proxy_for_kubernetes	From 1.8.0 (inc) to 1.9.2 (inc)
f5	big-ip_next_service_proxy_for_kubernetes	From 2.0.0 (inc) to 2.0.3 (inc)
f5	big-ip_next_cloud-native_network_functions	From 1.1.0 (inc) to 1.4.3 (exc)
f5	big-ip_next_cloud-native_network_functions	From 2.0.0 (inc) to 2.2.3 (exc)
f5	big-ip_next_cloud-native_network_functions	2.3.0
f5	big-ip_next_for_kubernetes	From 2.0.0 (inc) to 2.2.3 (exc)
f5	big-ip_next_for_kubernetes	2.3.0
f5	big-ip_next_service_proxy_for_kubernetes	From 1.7.0 (inc) to 1.7.18 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability occurs when an HTTP/2 profile is configured on a virtual server. Undisclosed requests can cause excessive memory usage, leading to system performance degradation. Eventually, the TMM process may need to restart or be manually restarted, causing a denial-of-service (DoS) on the BIG-IP system.

Detection Guidance

This vulnerability can be detected by monitoring memory usage and TMM process health on BIG-IP systems with HTTP/2 profiles configured. Check for unusual memory spikes or process restarts in system logs. Use commands like 'tmsh show sys performance' to monitor memory and CPU usage, and 'tmsh show sys tmm-info' to check TMM process status.

Impact Analysis

A remote, unauthenticated attacker can exploit this flaw to degrade system performance, forcing a DoS condition. This results in service disruption until the TMM process is restarted, affecting availability for legitimate users.

Compliance Impact

This DoS vulnerability may lead to service unavailability, potentially violating availability requirements in GDPR (Article 32) and HIPAA (Security Rule). Downtime could impact data access and processing, risking compliance with these regulations.

Mitigation Strategies

Disable the HTTP/2 profile on affected virtual servers if not required. Monitor TMM process memory usage and restart it if degradation is observed. Apply patches or updates from F5 if available.

Hi! I’m here to help you understand CVE-2026-59762. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70