When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization under stalled flow-control conditions. Specifically, a remote, unauthenticated attacker can trigger memory exhaustion by using standard flow-control parameters such as SETTINGS_INITIAL_WINDOW_SIZE = 0 to stall outbound data for multiple simultaneous request streams. The server continues processing requests and generating complete response bodies even though it is unable to transmit them, causing response data to remain buffered in memory. Each stalled stream retains its allocated buffer until the connection closes or a timeout occurs. An attacker can exploit this by opening many simultaneous streams and requesting large resources, causing accumulation of large amounts of buffered response data. Impact: System performance can degrade until the TMM process is either forced to restart or is manually restarted. In environments with permissive resource limits, this can lead to excessive memory consumption, swap exhaustion, service instability, and system crashes. Under default or lower limits, the attack can exhaust available connections or worker resources, temporarily preventing new clients from establishing sessions. This vulnerability allows a remote, unauthenticated attacker to cause a degradation of service that can lead to a denial-of-service (DoS) on the BIG-IP system. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
| Vendor | Product | Versions |
|---|---|---|
| f5 | big-ip | 21.1.0, 21.0.0, 17.5.0, 17.1.0, 2.3.0, 2.0.0, 1.9.0, 1.7.0, 2.3.0, 2.0.0, 1.1.0 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| f5 | big-ip | cert_advisory | 90% |
Added technical details on stalled flow-control attack mechanism (SETTINGS_INITIAL_WINDOW_SIZE = 0) and added MITRE ATT&CK technique T1499.004 (Application Exhaustion)
Updated severity to CRITICAL, marked as actively exploited, and added new products and CVE ID.
Initial creation
