CVE-2026-41227: DoS in F5 BIG-IP
Platform
linux
Component
bigip
Fixed in
17.5.1.4
CVE-2026-41227 describes a Denial of Service (DoS) vulnerability affecting F5 BIG-IP systems. Exploitation involves sending specially crafted HTTP/2 traffic to an HTTP/2 virtual server with Layer 7 DoS Protection enabled, leading to increased memory consumption and potential termination of the Traffic Management Microkernel (TMM) process. This can result in service outages. The vulnerability impacts versions 16.1.0 through 17.5.1.4, and a fix is available in version 17.5.1.4.
Impact and Attack Scenarios
Successful exploitation of CVE-2026-41227 can lead to a complete denial of service for applications and services relying on the affected F5 BIG-IP instance. The TMM process termination effectively halts traffic processing, rendering the virtual server unavailable. The impact can range from temporary service interruptions to prolonged outages, depending on the criticality of the affected applications. While the vulnerability requires specific HTTP/2 traffic manipulation, the relative ease of crafting such payloads, combined with the potential for widespread disruption, makes it a significant concern. Organizations heavily reliant on F5 BIG-IP for load balancing and application delivery are particularly vulnerable.
Exploitation Context
CVE-2026-41227 was published on May 13, 2026. The vulnerability's severity is rated HIGH (CVSS 7.5). Currently, there are no publicly available exploits or active campaigns targeting this vulnerability. It is not listed on KEV (Known Exploited Vulnerabilities) as of the publication date. The EPSS (Exploit Prediction Score System) score is pending evaluation, but the potential for DoS impact suggests a medium to high probability of exploitation if a suitable exploit is developed and released.
Threat Intelligence
Exploit Status
CISA SSVC
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- None — unauthenticated. No login or credentials needed to exploit.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- None — no confidentiality impact. Attacker cannot read protected data.
- Integrity
- None — no integrity impact. Attacker cannot modify data.
- Availability
- High — complete crash or resource exhaustion. Full denial of service.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
Mitigation and Workarounds
The primary mitigation for CVE-2026-41227 is to upgrade F5 BIG-IP to version 17.5.1.4 or later, which contains the fix. If immediate upgrade is not feasible, implement temporary workarounds. Configure a Web Application Firewall (WAF) or proxy to filter out potentially malicious HTTP/2 requests. Specifically, look for unusual header patterns or request sizes that deviate from expected traffic. Consider implementing rate limiting on HTTP/2 connections to reduce the impact of a potential attack. Monitor TMM process resource utilization closely; spikes in memory consumption could indicate exploitation attempts. After upgrading, confirm the fix by sending test HTTP/2 requests and verifying that TMM resource usage remains stable.
How to fix
Aplique las actualizaciones de seguridad proporcionadas por F5 para BIG-IP. Consulte la nota de seguridad K000158979 en el sitio web de F5 para obtener más detalles sobre las versiones afectadas y las actualizaciones disponibles.
Frequently asked questions
What is CVE-2026-41227 — DoS in F5 BIG-IP?
CVE-2026-41227 is a high-severity Denial of Service vulnerability in F5 BIG-IP affecting versions 16.1.0–17.5.1.4. Malformed HTTP/2 traffic can cause service disruption by terminating the TMM process.
Am I affected by CVE-2026-41227 in F5 BIG-IP?
You are affected if you are running F5 BIG-IP versions 16.1.0 through 17.5.1.4 and have HTTP/2 virtual servers with Layer 7 DoS Protection enabled. Check your version immediately.
How do I fix CVE-2026-41227 in F5 BIG-IP?
Upgrade to F5 BIG-IP version 17.5.1.4 or later. As a temporary workaround, configure WAF rules to filter malicious HTTP/2 requests.
Is CVE-2026-41227 being actively exploited?
As of the publication date, there are no publicly known exploits or active campaigns targeting CVE-2026-41227, but the potential for exploitation exists.
Where can I find the official F5 advisory for CVE-2026-41227?
Refer to the official F5 Security Advisory for CVE-2026-41227 on the F5 website (link will be available upon publication).
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...