CVE-2026-42409 - BIG-IP HTTP/2 vulnerability

Back Back to CVE browser

HIGH

BIG-IP HTTP/2 vulnerability

Published May 13, 2026

8.7

HIGH

CVSS 4.0

EPSS 0.46%

Description

When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

Vendor F5 Product Big-IP Default
n/a
- Version
  16.1.0
  Status
  affected
  Constraints
  <*
- Version
  17.1.0
  Status
  affected
  Constraints
  <17.1.3.1
- Version
  17.5.0
  Status
  affected
  Constraints
  <17.5.1.4
- Version
  21.0.0
  Status
  affected
  Constraints
  <21.0.0.1
- Version
  21.1.0
  Status
  unaffected
  Constraints
  <*
Vendor F5 Product BIG-IP Next CNF Default
n/a
- Version
  1.4.0
  Status
  affected
  Constraints
  <1.4.1
- Version
  2.0.0
  Status
  affected
  Constraints
  <2.0.3
Vendor F5 Product BIG-IP Next SPK Default
n/a
- Version
  1.7.0
  Status
  affected
  Constraints
  <1.7.17
- Version
  2.0.0
  Status
  affected
  Constraints
  <2.0.3
Vendor F5 Product BIG-IP Next for Kubernetes Default
n/a
- Version
  2.0.0
  Status
  affected
  Constraints
  <2.1.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Big-IP

n/a

Version	Status	Constraints
16.1.0	affected	<*
17.1.0	affected	<17.1.3.1
17.5.0	affected	<17.5.1.4
21.0.0	affected	<21.0.0.1
21.1.0	unaffected	<*

BIG-IP Next CNF

n/a

Version	Status	Constraints
1.4.0	affected	<1.4.1
2.0.0	affected	<2.0.3

BIG-IP Next SPK

n/a

Version	Status	Constraints
1.7.0	affected	<1.7.17
2.0.0	affected	<2.0.3

BIG-IP Next for Kubernetes

n/a

Version	Status	Constraints
2.0.0	affected	<2.1.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-476

NULL Pointer Dereference

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29999
Advisory
https://my.f5.com/manage/s/article/K000159034
vendor-advisorypatchMitigationVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29999		Advisory
https://my.f5.com/manage/s/article/K000159034		vendor-advisorypatchMitigationVendor Advisory