CVE-2025-35995

Description

When a BIG-IP PEM system is licensed with URL categorization, and the URL categorization policy or an iRule with the urlcat command is enabled on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Reserved 2025-04-23 | Published 2025-05-07 | Updated 2025-05-08 | Assigner f5

Problem types

CWE-125 Out-of-bounds Read

Product status

Default status
unknown

17.5.0 before *
unaffected

17.1.0 before 17.1.2.2
affected

16.1.0 before 16.1.6
affected

15.1.0 before *
affected

Credits

F5 finder

References

my.f5.com/manage/s/article/K000149952 vendor-advisory

cve.org (CVE-2025-35995)

nvd.nist.gov (CVE-2025-35995)

Download JSON