Skip to content

F5 · weakness class

Denial of Service

78 CVEs

Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

Every one of the 78 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 13.0.0, 12.0.0 to 12.1.2 and 11.5.1 to 11.6.1, under limited circumsta…CVE-2017-0303F5 Networks, Inc. · 2.7% likely

    CWE-459

  2. On BIG-IP 13.1.0-13.1.0.7, a remote attacker using undisclosed methods against virtual servers configured with a Client SSL or Server SSL profile that has the SSL Forward Proxy fe…CVE-2018-5527F5 Networks, Inc. · 2.5% likely

    CWE-772

  3. A remote attacker via undisclosed measures, may be able to exploit an F5 BIG-IP APM 13.0.0-13.1.0.7 or 12.1.0-12.1.3.5 virtual server configured with an APM per-request policy obj…CVE-2018-5536F5 Networks, Inc. · 2.3% likely

    CWE-772

  4. On BIG-IP 14.1.0-14.1.0.5 and 14.0.0-14.0.0.4, Malformed http requests made to an undisclosed iControl REST endpoint can lead to infinite loop of the restjavad process.CVE-2019-6638F5 · 2.0% likely

    CWE-835

  5. When F5 BIG-IP ASM 13.0.0-13.1.0.1, 12.1.0-12.1.3.5, 11.6.0-11.6.3.1, or 11.5.1-11.5.6 is processing HTTP requests, an unusually large number of parameters can cause excessive CPU…CVE-2018-5541F5 Networks, Inc. · 1.8% likely

    CWE-400

  6. F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, or 11.6.0-11.6.3.1 virtual servers with HTTP/2 profiles enabled are vulnerable to "HPACK Bomb".CVE-2018-5530F5 Networks, Inc. · 1.8% likely

    CWE-400

  7. In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and WebSafe software version 13.0.0, a slow memory leak as a result of undisclosed IPv4 or IPv6 pac…CVE-2017-6135F5 Networks, Inc. · 1.6% likely

    CWE-772

  8. Features in F5 BIG-IP 13.0.0-13.1.0.3, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 system that utilizes inflate functionality directly, via an iRule, or via the inf…CVE-2017-6153F5 Networks, Inc. · 1.6% likely

    CWE-400

  9. BIG-IP Advanced WAF and ASM vulnerabilityCVE-2023-23552F5 · CVSS 7.5 · 1.6% likely

    CWE-400

  10. In some circumstances, on F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, any 11.6.x or 11.5.x release, or 11.2.1, TCP DNS profile allows excessive buffering due to lack of f…CVE-2018-5501F5 Networks, Inc. · 1.3% likely

    CWE-400

  11. On F5 BIG-IP systems running 13.0.0, 12.1.0 - 12.1.3.1, or 11.6.1 - 11.6.2, every Multipath TCP (MCTCP) connection established leaks a small amount of memory. Virtual server using…CVE-2018-5500F5 Networks, Inc. · 1.3% likely

    CWE-400

  12. TMM vulnerability CVE-2022-34862CVE-2022-34862F5 · CVSS 7.5 · 1.3% likely

    CWE-835

  13. On BIG-IP versions 15.0.0-15.0.1.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, and 12.1.0-12.1.5, a memory leak in Multicast Forwarding Cache (MFC) handling in tmrouted.CVE-2019-6681F5 · 1.1% likely

    CWE-401

  14. In BIG-IP 14.0.0-14.0.0.2 or 13.0.0-13.1.1.1, iControl and TMSH usage by authenticated users may leak a small amount of memory when executing commandsCVE-2018-15325F5 Networks, Inc. · 1.0% likely

    CWE-400

  15. On BIG-IP 11.5.1-11.6.3.2, 12.1.3.4-12.1.3.7, 13.0.0 HF1-13.1.1.1, and 14.0.0-14.0.0.2, Multi-Path TCP (MPTCP) does not protect against multiple zero length DATA_FINs in the reass…CVE-2019-6594F5 Networks, Inc. · 1.0% likely

    CWE-835

  16. On versions 15.0.0-15.0.1.1, 14.1.0-14.1.2.2, 14.0.0-14.0.1, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, BIG-IP virtual servers with Loose Initiation enabled on a FastL4…CVE-2019-6683F5 · 1.0% likely

    CWE-400

  17. On versions 15.0.0-15.0.1.1, 14.0.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, the BIG-IP ASM system may consume excessive resources when processing certain ty…CVE-2019-6682F5 · 1.0% likely

    CWE-400

  18. On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.1.0-13.1.1.5, 12.1.0-12.1.4.1, and 11.5.1-11.6.5, under certain conditions, TMM may consume excessive resources when…CVE-2019-6667F5 · 1.0% likely

    CWE-400

  19. In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, GTM, Link Controller, PEM, WebAccelerator software version 12.0.0 - 12.1.2, 11.6.0 - 11.6.1, 11.4.0 - 11.5.4, 1…CVE-2017-6161F5 Networks, Inc. · 1.0% likely

    CWE-400

  20. NGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerabilityCVE-2026-42946F5 · CVSS 6.5 · 0.9% likely

    CWE-789

  21. On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, when the stream profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilizatio…CVE-2022-28701F5 · CVSS 7.5 · 0.9% likely

    CWE-400

  22. On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when a Real Time Streaming…CVE-2022-28691F5 · CVSS 7.5 · 0.9% likely

    CWE-400

  23. On F5 BIG-IP 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when multiple route domains are configured, undisclosed requests to big3d can cause an increas…CVE-2022-29480F5 · CVSS 5.3 · 0.9% likely

    CWE-400

  24. On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1…CVE-2022-27181F5 · CVSS 5.3 · 0.9% likely

    CWE-400

  25. On F5 BIG-IP 15.1.x versions prior to 15.1.0.2, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, when a DNS listener is c…CVE-2022-26372F5 · CVSS 7.5 · 0.9% likely

    CWE-400

  26. On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, and 14.1.x versions prior to 14.1.4.6, when BIG-IP packet filters are enabled and a virtual serv…CVE-2022-27182F5 · CVSS 5.3 · 0.9% likely

    CWE-400

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

Updated AboutDevelopersSign in