HIGHCVE-2026-39458CVSS 7.5

CVE-2026-39458: DoS in F5 BIG-IP DNS Cache

Platform

linux

Component

bigip

Fixed in

21.0.0.1

CVE-2026-39458 describes a denial-of-service (DoS) vulnerability within F5 BIG-IP's DNS cache functionality. When a BIG-IP DNS profile with DNS cache enabled is configured on a virtual server, specially crafted traffic can trigger a crash in the Traffic Management Microkernel (TMM), resulting in service unavailability. This vulnerability impacts versions 16.1.0 through 21.0.0.1, and a fix is available in version 21.0.0.1.

Impact and Attack Scenarios

The primary impact of CVE-2026-39458 is a denial-of-service condition. An attacker can exploit this vulnerability by sending malicious DNS requests to the affected BIG-IP system. Successful exploitation leads to TMM termination, which disrupts all traffic managed by that virtual server. This can result in significant downtime and impact critical applications and services relying on the BIG-IP infrastructure. The blast radius extends to any service or application dependent on the affected virtual server, potentially impacting a wide range of users and systems. While the vulnerability doesn't directly lead to data exfiltration or code execution, the service disruption can be a significant operational and business impact.

Exploitation Context

CVE-2026-39458 is currently not listed on KEV (Known Exploited Vulnerabilities). The EPSS (Exploit Prediction Scoring System) score is pending evaluation. No public proof-of-concept (POC) code has been publicly released as of the publication date. CISA and F5 have published advisories regarding this vulnerability. Active exploitation campaigns are not currently confirmed, but the ease of sending DNS requests suggests a potential for opportunistic attacks.

Threat Intelligence

Exploit Status

Proof of ConceptUnknown
CISA KEVNO
Internet ExposureHigh

CISA SSVC

Exploitationnone
Automatableyes
Technical Impactpartial

CVSS Vector

THREAT INTELLIGENCE· CVSS 3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H7.5HIGHAttack VectorNetworkHow the attacker reaches the targetAttack ComplexityLowConditions required to exploitPrivileges RequiredNoneAuthentication level needed to attackUser InteractionNoneWhether a victim must take actionScopeUnchangedImpact beyond the vulnerable componentConfidentialityNoneRisk of sensitive data exposureIntegrityNoneRisk of unauthorized data modificationAvailabilityHighRisk of service disruptionnextguardhq.com · CVSS v3.1 Base Score
What do these metrics mean?
Attack Vector
Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
Attack Complexity
Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
Privileges Required
None — unauthenticated. No login or credentials needed to exploit.
User Interaction
None — attack is automatic and silent. Victim does nothing: no click, no file open.
Scope
Unchanged — impact is limited to the vulnerable component itself.
Confidentiality
None — no confidentiality impact. Attacker cannot read protected data.
Integrity
None — no integrity impact. Attacker cannot modify data.
Availability
High — complete crash or resource exhaustion. Full denial of service.

Affected Software

Componentbigip
VendorF5
Minimum version16.1.0
Maximum version21.0.0.1
Fixed in21.0.0.1

Weakness Classification (CWE)

Timeline

  1. Reserved
  2. Published

Mitigation and Workarounds

The recommended mitigation for CVE-2026-39458 is to upgrade to BIG-IP version 21.0.0.1 or later, which contains the fix. If immediate upgrade is not feasible, consider implementing temporary workarounds. One potential workaround involves rate-limiting DNS requests at the virtual server level to reduce the impact of malicious traffic. Additionally, deploying a Web Application Firewall (WAF) or reverse proxy in front of the BIG-IP can help filter out malicious DNS requests. Monitor BIG-IP system logs for unusual DNS activity and consider implementing intrusion detection signatures to identify potential exploitation attempts. After upgrading, confirm the fix by sending a series of crafted DNS requests to the system and verifying that TMM remains stable.

How to fix

Actualice su sistema BIG-IP a una versión corregida. Consulte la nota de seguridad de F5 (https://my.f5.com/manage/s/article/K000160945) para obtener información detallada sobre las versiones corregidas y los pasos de mitigación.

Frequently asked questions

What is CVE-2026-39458 — DoS in F5 BIG-IP DNS Cache?

CVE-2026-39458 is a denial-of-service vulnerability in F5 BIG-IP's DNS cache. Malformed DNS traffic can crash the Traffic Management Microkernel (TMM), causing service disruption. It affects versions 16.1.0–21.0.0.1.

Am I affected by CVE-2026-39458 in F5 BIG-IP?

You are affected if you are running F5 BIG-IP versions 16.1.0 through 21.0.0.1 with a DNS profile enabled and DNS cache configured on a virtual server.

How do I fix CVE-2026-39458 in F5 BIG-IP?

Upgrade to F5 BIG-IP version 21.0.0.1 or later to resolve the vulnerability. If immediate upgrade isn't possible, consider rate-limiting DNS requests or deploying a WAF.

Is CVE-2026-39458 being actively exploited?

Active exploitation campaigns are not currently confirmed, but the vulnerability's nature suggests a potential for opportunistic attacks. Monitor your systems closely.

Where can I find the official F5 advisory for CVE-2026-39458?

Refer to the official F5 Security Advisory: [https://www.f5.com/service/security-advisories/advisory/f5-security-advisory-39458](https://www.f5.com/service/security-advisories/advisory/f5-security-advisory-39458)

Is your project affected?

Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.

livefree scan

Try it now — no account

Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.

Manual scanSlack/email alertsContinuous monitoringWhite-label reports

Drag & drop your dependency file

composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...