CVE-2026-39458: DoS in F5 BIG-IP DNS Cache
Platform
linux
Component
bigip
Fixed in
21.0.0.1
CVE-2026-39458 describes a denial-of-service (DoS) vulnerability within F5 BIG-IP's DNS cache functionality. When a BIG-IP DNS profile with DNS cache enabled is configured on a virtual server, specially crafted traffic can trigger a crash in the Traffic Management Microkernel (TMM), resulting in service unavailability. This vulnerability impacts versions 16.1.0 through 21.0.0.1, and a fix is available in version 21.0.0.1.
Impact and Attack Scenarios
The primary impact of CVE-2026-39458 is a denial-of-service condition. An attacker can exploit this vulnerability by sending malicious DNS requests to the affected BIG-IP system. Successful exploitation leads to TMM termination, which disrupts all traffic managed by that virtual server. This can result in significant downtime and impact critical applications and services relying on the BIG-IP infrastructure. The blast radius extends to any service or application dependent on the affected virtual server, potentially impacting a wide range of users and systems. While the vulnerability doesn't directly lead to data exfiltration or code execution, the service disruption can be a significant operational and business impact.
Exploitation Context
CVE-2026-39458 is currently not listed on KEV (Known Exploited Vulnerabilities). The EPSS (Exploit Prediction Scoring System) score is pending evaluation. No public proof-of-concept (POC) code has been publicly released as of the publication date. CISA and F5 have published advisories regarding this vulnerability. Active exploitation campaigns are not currently confirmed, but the ease of sending DNS requests suggests a potential for opportunistic attacks.
Threat Intelligence
Exploit Status
CISA SSVC
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- None — unauthenticated. No login or credentials needed to exploit.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- None — no confidentiality impact. Attacker cannot read protected data.
- Integrity
- None — no integrity impact. Attacker cannot modify data.
- Availability
- High — complete crash or resource exhaustion. Full denial of service.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
Mitigation and Workarounds
The recommended mitigation for CVE-2026-39458 is to upgrade to BIG-IP version 21.0.0.1 or later, which contains the fix. If immediate upgrade is not feasible, consider implementing temporary workarounds. One potential workaround involves rate-limiting DNS requests at the virtual server level to reduce the impact of malicious traffic. Additionally, deploying a Web Application Firewall (WAF) or reverse proxy in front of the BIG-IP can help filter out malicious DNS requests. Monitor BIG-IP system logs for unusual DNS activity and consider implementing intrusion detection signatures to identify potential exploitation attempts. After upgrading, confirm the fix by sending a series of crafted DNS requests to the system and verifying that TMM remains stable.
How to fix
Actualice su sistema BIG-IP a una versión corregida. Consulte la nota de seguridad de F5 (https://my.f5.com/manage/s/article/K000160945) para obtener información detallada sobre las versiones corregidas y los pasos de mitigación.
Frequently asked questions
What is CVE-2026-39458 — DoS in F5 BIG-IP DNS Cache?
CVE-2026-39458 is a denial-of-service vulnerability in F5 BIG-IP's DNS cache. Malformed DNS traffic can crash the Traffic Management Microkernel (TMM), causing service disruption. It affects versions 16.1.0–21.0.0.1.
Am I affected by CVE-2026-39458 in F5 BIG-IP?
You are affected if you are running F5 BIG-IP versions 16.1.0 through 21.0.0.1 with a DNS profile enabled and DNS cache configured on a virtual server.
How do I fix CVE-2026-39458 in F5 BIG-IP?
Upgrade to F5 BIG-IP version 21.0.0.1 or later to resolve the vulnerability. If immediate upgrade isn't possible, consider rate-limiting DNS requests or deploying a WAF.
Is CVE-2026-39458 being actively exploited?
Active exploitation campaigns are not currently confirmed, but the vulnerability's nature suggests a potential for opportunistic attacks. Monitor your systems closely.
Where can I find the official F5 advisory for CVE-2026-39458?
Refer to the official F5 Security Advisory: [https://www.f5.com/service/security-advisories/advisory/f5-security-advisory-39458](https://www.f5.com/service/security-advisories/advisory/f5-security-advisory-39458)
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...