Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

BIG-IP WAF/ASM: Long URL config causes system crashes

CVE-2025-61938 · published 1 year ago
Summary

If you configure a long URL in BIG-IP WAF or ASM, the system may crash. This can happen if you manually set the URL or if the automatic Policy Builder does it for you. Check your configurations and shorten any overly long URLs to avoid system crashes.

What to do
  • Update f5 big-ip_advanced_web_application_firewall to version 17.1.3 or later.
  • Update f5 big-ip_application_security_manager to version 17.1.3 or later.
Affected software
VendorProductAffected versions
f5 big-ip_advanced_web_application_firewall >= 17.1.0, < 17.1.3
17.5.0
cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*
f5 big-ip_application_security_manager >= 17.1.0, < 17.1.3
17.5.0
cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*
Original advisory text
When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters in length for the Data Guard Protection Enforcement setting, either manually or through the a...
When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters in length for the Data Guard Protection Enforcement setting, either manually or through the automatic Policy Builder, the bd process can terminate repeatedly.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-1284Improper Validation of Specified Quantity in Input
Timeline
Published15 Oct 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-61938 · NVD
Track software like this
Free during beta