CVE-2026-39455: File Descriptor Exhaustion in F5 BIG-IP

Successful exploitation of CVE-2026-39455 can lead to a denial-of-service (DoS) attack, rendering the affected BIG-IP system unavailable. This disruption can impact critical services relying on the BIG-IP infrastructure, such as load balancing, web application delivery, and security features. The impact extends beyond the immediate system, potentially affecting applications and users dependent on the BIG-IP's functionality. While the vulnerability doesn't directly expose sensitive data, the DoS can disrupt operations and potentially mask other malicious activity. The blast radius is limited to the services managed by the affected BIG-IP instance.

1. Réservé2026-04-30
2. Publiée2026-05-13

The primary mitigation for CVE-2026-39455 is upgrading to F5 BIG-IP version 21.0.0.2 or later, which includes the fix. If immediate upgrade is not feasible, implement temporary workarounds. Configure a Web Application Firewall (WAF) or proxy to limit or filter LDAP traffic to the BIG-IP system, specifically targeting the traffic pattern that triggers the file descriptor exhaustion. Review LDAP authentication configurations to ensure they adhere to security best practices and minimize unnecessary LDAP traffic. After upgrading, verify the fix by attempting to reproduce the vulnerability with the traffic pattern described in the advisory; the httpd process should not exhaust file descriptors.