996129-8 : The /var partition is full as cleanup of files on secondary is not executing

Links to More Info: BT996129

Component: Device Management

Symptoms:
The system does not boot because the /var partition is full.

You see a large number of "storageXXXX.zip" files in /var/config/rest/

Conditions:
This may be observed on multi-blade vCMP guests and hosts, as well as on multi-blade tenants.

Impact:
The partition housing /var/config/ may become 100% full, impacting future disk IO operation and it may cause unexpected traffic disruption.

Workaround:
Important: This workaround is temporary, and may need to be periodically performed either manually or from a script.

Impact of Workaround: While these steps are performed, the BIG-IP REST API will be temporarily inaccessible, and higher disk IO may be seen.

Run the following commands, in sequence:

bigstart stop restjavad
rm -rf /var/config/rest/storage*.zip
rm -rf /var/config/rest/*.tmp
bigstart start restjavad

Manual application of these workaround steps clears the 100% utilized space condition and allows the partition to resume normal operation.

Fix:
N/A.

Fixed Versions:
17.5.1.6, 17.1.3.2

937665-4 : Relaystate in SLO request results in two Relaystates in SLO Response

Links to More Info: BT937665

Component: Access Policy Manager

Symptoms:
When BIG-IP APM acts as the SAML IdP and receives a redirect binding single logout (SLO) request that contains a relaystate, the BIG-IP APM generates an SLO response that contains two relaystates.

Conditions:
-- BIG-IP APM configured as IdP
-- Redirect binding SLO request contains a relaystate

Impact:
SLO processing on SP may not work.

Workaround:
None.

Fixed Versions:
17.5.1.4, 17.1.3.1

935633-4 : VCMP guests or F5OS tenants may experience constant clusterd restart after host upgrade★

Links to More Info: BT935633

Component: TMOS

Symptoms:
Sometimes, when vCMP guests or F5OS tenants are started after the host has been upgraded, the guests or tenants may enter an unhealthy state due to clusterd constantly restarting.

Conditions:
-- vCMP guest or F5OS tenant has Mirroring IP configured.
-- vCMP guest or F5OS tenant is powered on after vCMP host upgrade.
-- vCMP guest or F5OS tenant is powered on and receives a new license file from the host during startup.

Impact:
-- This issue might prevent the guest or tenant from servicing traffic if the system fails to load the config and clusterd keeps restarting.
-- During startup of the guest or tenant, the following message is logged to /var/log/ltm:

 err mcpd[6519]: 0107146f:3: Self-device state mirroring address cannot reference the non-existent Self IP ([IP address]); Create it in the /Common folder first.

-- /var/log/ltm shows clusterd constantly restarting.
-- One or more slots are in INOPERATIVE state, while the host shows slots as RUN/Healthy.

Workaround:
-- To avoid the issue before it occurs:
1. Prior to shutting down vCMP guests or F5OS tenants before host upgrade, ensure guests or tenants have free space in the /var partition.
2. Ensure any license updates (e.g., reactivation) are applied before shutting down the vCMP guest or F5OS tenant.
3. Issue 'tmsh save sys config' on the vCMP guest or F5OS tenant.
4. Issue 'ls /var/db/mcp*' and confirm the presence of mcpdb.bin and mcpdb.info in the /var/db directory.
5. Proceed with vCMP guest or F5OS tenant shutdown and host upgrade as per standard F5 recommended process.


-- To mitigate after the issue has been experienced on a vCMP guest or F5OS tenant:
1. Set the vCMP guest or F5OS tenant to the Configured state and wait for it to complete transition to Configured.
2. Set vCMP guest or F5OS tenant to Deployed state.
3. Review startup logs and confirm 'Self-device state mirroring address cannot reference the non-existent Self IP' message is no longer present.
4. Review /var/log/ltm and confirm clusterd is no longer restarting.
5. If issue persists, delete and recreate the vCMP guest or F5OS tenant.

Fixed Versions:
21.0.0.1, 17.5.1.4, 17.1.3.1

931149-5 : Some RESOLV::lookup queries, including PTR lookups for RFC1918 addresses, return empty strings

Links to More Info: BT931149

Component: Global Traffic Manager (DNS)

Symptoms:
RESOLV::lookup returns an empty string.

Conditions:
The name being looked up falls into one of these categories:

-- Forward DNS lookups in these zones:
    - localhost
    - onion
    - test
    - invalid

-- Reverse DNS lookups for:
    - 127.0.0.0/8
    - ::1
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 0.0.0.0/8
    - 169.254.0.0/16
    - 192.0.2.0/24
    - 198.51.100.0/24
    - 203.0.113.0/24
    - 255.255.255.255/32
    - 100.64.0.0/10
    - fd00::/8
    - fe80::/10
    - 2001:db8::/32
    - ::/64

Impact:
RESOLV::lookup fails.

Workaround:
Use a DNS Resolver ('net dns') and RESOLVER::name_lookup / DNSMSG:: instead of RESOLV::lookup:

1. Configure a local 'net dns' resolver, replacing '192.88.99.1' with the IP address of your DNS resolver:

    tmsh create net dns-resolver resolver-for-irules answer-default-zones no forward-zones add { . { nameservers add { 192.0.2.1:53 } } }

2. Use an iRule procedure similar to this to perform PTR lookups for IPv4 addresses:

proc resolv_ptr_v4 { addr_v4 } {
    # Convert $addr_v4 into its constituent bytes
    set ret [scan $addr_v4 {%d.%d.%d.%d} a b c d]
    if { $ret != 4 } {
        return
    }

    # Perform a PTR lookup on the IP address $addr_v4, and return the first answer
    set ret [RESOLVER::name_lookup "/Common/resolver-for-irules" "$d.$c.$b.$a.in-addr.arpa" PTR]
    set ret [lindex [DNSMSG::section $ret answer] 0]
    if { $ret eq "" } {
        # log local0.warn "DNS PTR lookup for $addr_v4 failed."
        return
    }

    # Last element in '1.1.1.10.in-addr.arpa. 600 IN PTR otters.example.com'
    return [lindex $ret end]
}

-- In an iRule, instead of:
    RESOLV::lookup @192.0.2.1 $ipv4_addr
Use:
    call resolv_ptr_v4 $ipv4_addr

Fixed Versions:
21.0.0.1

929709-9 : jQuery vulnerability CVE-2020-11023

Links to More Info: K66544153, BT929709

919917-9 : File permission errors during bot-signature installation

Links to More Info: BT919917

Component: Application Security Manager

Symptoms:
When you install Bot-Sig IM file through LU, /var/log/ltm shows file permission errors.

Cannot open lock file (/var/run/config_lock), permission denied.

Cannot open command history file (/root/.tmsh-history-root), Permission denied : framework/CmdHistoryFile.cpp, line 92.

Conditions:
Installing bot-signature.

Impact:
If the BIG-IP device is rebooted, or the mcpd process is restarted, following an automatic bot-signature installation, without the config first being saved, the bot-signature installation will be reverted.

Workaround:
Save the BIG-IP configuration manually after the automatic bot-signature update has completed.

Fixed Versions:
17.5.1.6, 17.1.3.2

912797-15 : NTP Vulnerability: CVE-2020-11868

Links to More Info: K44305703, BT912797

911661-3 : Remote event logs may truncate at 5k when maximum entry length is configured to 64k

Links to More Info: BT911661

Component: Application Security Manager

Symptoms:
Remote event logs are truncated at 5k instead of the configured 64k maximum entry length

Conditions:
Remote logging is configured with maximum entry length set to 64k

Impact:
Remote event logs are truncated at 5k, resulting in incomplete log entries

Workaround:
As a temporary workaround, change the maximum entry length to 2k or 10k, save the configuration, then change it back to 64k. Follow the same steps if the issue occurs again.

Fixed Versions:
17.5.1.6, 17.1.3.2

901989-11 : Corruption detected in /var/log/btmp

Links to More Info: BT901989

Component: TMOS

Symptoms:
The boot_marker is written to /var/log/btmp, but /var/log/btmp is a binary file.

A message similar to:

warning <process>[10901]: pam_lastlog(<process>:session): corruption detected in /var/log/btmp

... may be logged to /var/log/secure.

Conditions:
This issue is triggered following a reboot of the BIG-IP system. Subsequently, you may observe the log message appearing in relation to various administrative activities, such as logging in through the console or restarting the tomcat service.

Impact:
Since this file is unknowingly corrupt after each boot, any potential investigation needing this data may be compromised.

Workaround:
Option 1; After bootup you can truncate the file.
$ truncate --size 0 /var/log/btmp
This will remove any instances of failed logins from the file.

--or--

Option 2; this will stop boot_markers from logging to /var/log/btmp:
CAVEATS:
- If the system has FIPS enabled, do not use this workaround! Modifying this file will cause FIPS validation to fail the next time it runs, and the system will halt on next boot.
- This workaround will not persist on software upgrades.
- Familiarity with vi is required to perform this.

Backup:
cp /etc/sysconfig/sysinit/01bootlogmarker.sysinit /var/tmp/01bootlogmarker.sysinit.bak

Open in vi:
vi /etc/sysconfig/sysinit/01bootlogmarker.sysinit

Change the following line to include "btmp":
old: excludeFiles=( "lastlog" "wtmp" "tmm*tech.out" "*.json" )
new: excludeFiles=( "lastlog" "wtmp" "btmp" "tmm*tech.out" "*.json" )

Force save and quit with (required since file is RO):
:wq!

Truncate the "/var/log/btmp" file:
truncate --size 0 /var/log/btmp

Reboot

Fixed Versions:
21.0.0.1, 17.5.1.4, 17.1.3.1

901569-8 : Loopback traffic might get dropped when VLAN filter is enabled for a virtual server.

Links to More Info: BT901569

Component: Local Traffic Manager

Symptoms:
Loopback traffic (local traffic) destined to a virtual server might get dropped when the incoming packet matches a terminating connection flow.

Conditions:
-- VLAN filter is enabled on the virtual server created for loopback traffic processing.
-- An incoming packet matches a terminating connection flow (i.e., the connection flow terminates because of timeout, being dropped by iRule, etc.).

Impact:
Traffic that is matched against a terminating connection flow of a virtual is not processed by the virtual server.

Workaround:
Because this filter is ignored for loopback traffic, removing the 'Enabled On VLAN' filter at the virtual server mitigates the issue.

Fixed Versions:
21.0.0.1, 17.5.1.4, 17.1.3.1

887681-5 : Tmm SIGSEGV in rrset_array_lock,services/cache/rrset.c

Links to More Info: BT887681

Component: Global Traffic Manager (DNS)

Symptoms:
TMM Cored with SIGSEGV.

Conditions:
N/A.

Impact:
Traffic disrupted while tmm restarts.

Fixed Versions:
21.0.0.1

881041-8 : TMM not processing traffic as expected.

Component: Local Traffic Manager

Symptoms:
TMM may slow down traffic processing unexpectedly.

Conditions:
NA

Impact:
Unexpected impact

Workaround:
NA

Fix:
TMM now processing traffic as expected.

Fixed Versions:
21.0.0.3

857973-5 : GUI sets FQDN Pool Member "Auto Populate" value Enabled by default

Links to More Info: BT857973

Component: TMOS

Symptoms:
In the GUI, the "autopopulate" value is Enabled by default when creating an FQDN template Pool Member, but Disabled by default when creating an FQDN template Node.

Conditions:
This is observed when using FQDN names to configure Pool Members and/or Nodes in the GUI.

Impact:
Differing default "autopopulate" values displayed in the GUI are confusing.
The "autopopulate" value for an FQDN Pool Member cannot be set to "enabled" if the "autopopulate" value of the corresponding FQDN Node is set to the default value of "disabled".
Attempting to do so via tmsh will generate an error similar to:
01070734:3: Configuration error: Cannot enable pool member to autopopulate: node (<fqdn node name>) has autopopulate set to disabled

Workaround:
Be careful to select the appropriate option for the "Auto Populate" parameter when configuring FQDN Pool Members using the GUI.

Fixed Versions:
21.0.0.1, 17.5.1.4, 17.1.3.1

842525-3 : TMSH - Modifying sys httpd ssl-verify-client attribute to 'optional-no-ca' results in error

Links to More Info: BT842525

Component: TMOS

Symptoms:
Error is seen when configuring the ssl-verify-client to optional-no-ca via tmsh

tmsh modify sys httpd ssl-verify-client optional-no-ca
01070920:3: Application error for confpp: AH00526: Syntax error on line 166 of /etc/httpd/conf.d/ssl.conf:
SSLVerifyClient: Invalid argument 'optional-no-ca'

Conditions:
Seen when configuring ssl-verify-client to optional-no-ca in httpd profile

Impact:
Unable to configure ssl-verify-client to optional-no-ca - impacts authentication

Workaround:
None

Fix:
You can now successfully execute
tmsh modify sys httpd ssl-verify-client optional-no-ca

Fixed Versions:
17.5.1.6, 17.1.3.2

797573-6 : TMM assert crash with resulting in core generation in multi-blade chassis

Links to More Info: BT797573

Component: Local Traffic Manager

Symptoms:
TMM crashes while changing settings.

Conditions:
Seen on multi-blade chassis with either one of the options:
-- Running system with DoS and other traffic.
-- Create a new vCMP guest and deploy it.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None.

Fixed Versions:
17.5.1.6, 17.1.3.2

761853-1 : Send HOST header in OCSP responder request

Links to More Info: BT761853

Component: TMOS

Symptoms:
As per the Digicert documentation, the OCSP/CRL connections require either HTTP1.1 or HTTP1.0 with host header. (Digicert).
LTM uses HTTP1.1 without the host header in OCSP responder request

Conditions:
OCSP and CRL Authentication uses HTTP1.0 for OCSP responder requests

Impact:
OCSP in the current BIG-IP relies on OpenSSL for its operations and current version of OpenSSL that is available in BIG-IP is 1.0.2za
OpenSSL 1.0.2 is only capable of generating HTTP/1.0 requests for OCSP and CRL fetches; it does not support HTTP/1.1.
This limitation prevents clients from communicating with OCSP/CRL endpoints that require HTTP/1.1, resulting in failures for revocation checks in environments where modern protocols are mandated.

Workaround:
Add either of these iRules to the Virtual Server

Modify HTTP 1.0 to HTTP1.1

when HTTP_REQUEST {
    HTTP::version "1.1"
}

Add Host header
 
when HTTP_REQUEST {
    HTTP::host "[HTTP::host]”
}

Fix:
Support for HTTP1.1 is added. The OCSP requests for auth should now use HTTP1.1 version

Fixed Versions:
21.0.0.1, 17.5.1.4, 17.1.3.1

760451-5 : Enabling user to configure nonce disabled/enabled from Mgmt GUI login as well as CLI

Component: TMOS

Symptoms:
When Remote client cert-ldap authentication is enabled in BIG-IP and ocsp-responder is configured. By default nonce was always added in ocsp request

Conditions:
-- Remote client cert-ldap authentication is enabled in BIG-IP and ocsp-responder is configured.

Impact:
A new configurable parameter "ssl-ocsp-use-request-nonce" is introduced in httpd, to configure whether to send the nonce in ocsp request. Default value is On

Workaround:
None

Fix:
1.Configure BIG-IP for Remote-cert-ldap authentication
2.Set httpd ssl-ocsp-use-request-nonce on in httpd profile
3.Capture the ocsp packet
4.When httpd ssl-ocsp-use-request-nonce is on, ocsp request should contain OCSP nonce in the extensions

Fixed Versions:
17.5.1.6, 17.1.3.2

745334-15 : CVE-2016-7099 NodeJS Vulnerability

Links to More Info: K24444803

718796-10 : iControl REST token issue after upgrade★

Links to More Info: K22162765, BT718796

Component: Device Management

Symptoms:
When upgrading to version 13.1.0.x or later, users who previously had permissions to make calls to iControl REST lose the ability to make those calls.

Conditions:
You will notice this issue when you use iControl REST and are upgrading to version 13.1.0.x or later.

You can also detect if the user is impacted by this issue with the following steps

    1. Run below API to for impacted user account XYZ.

         # curl -ik -u username:XYZ -XPOST https://localhost/mgmt/shared/authn/login --data-binary '{"username":"XYZ", "password":"XYZpass", "loginProviderName":"tmos"}' -H "Content-Type: application/json"

    2. Find user XYZ's 'link' path under 'token' in previous output

       There are two formats possible for 'link'
       a. Path will have a UUID
          For example "token"->"link"->"https://localhost/mgmt/cm/system/authn/providers/tmos/1f44a60e-11a7-3c51-a49f-82983026b41b/users/<UUID>"

       b. Path will have a username (not UUID)
          For example "token"->"link"->"https://localhost/mgmt/shared/authz/users/<username>"

    3. Run below API to get list of user roles.

         # restcurl -u "admin:<admin-user-pass>" /shared/authz/roles | tee /var/tmp/rest_shared_authz_roles.json

    4. Check user XYZ's link path from step 2 in above output.

       Check under the "userReferences" section for group "iControl_REST_API_User" . You will see the link path in one of the two formats listed in 2a/2b. If you do not see the user link path then you are impacted by this bug

Impact:
A previously privileged user can no longer query iControl REST. In addition, some remotely authenticated users may lose access to the Network Map and Analytics view after the upgrade.

Workaround:
You can repair the current users permissions with the following process:

   1) Delete the state maintained by IControlRoleMigrationWorker and let it rerun by restarting restjavad process:
      # restcurl -X DELETE "shared/storage?key=shared/authz/icontrol-role-migrator"
     
   2) Restart services
      # bigstart restart restjavad *or* tmsh restart /sys service restjavad

   3) Now, the permissions should start in a healthy state. Re-try making an iControl REST call with an affected user.

   4) If this still does not resolve the issue you could update shared/authz/roles/iControl_REST_API_User userReference list to add all affected users' accounts using PUT. Here you may need to use the UUID path as described under 'Conditions'

      # restcurl shared/authz/roles/iControl_REST_API_User > role.json
      # vim role.json
          a. add { "link": "https://localhost/mgmt/shared/authz/users/[your-user-name]" } object to userReferences list
          OR
          b. add { "link": "https://localhost/mgmt/cm/system/authn/providers/tmos/1f44a60e-11a7-3c51-a49f-82983026b41b/users/<UUID>" } object to userReferences list
      # curl -u admin:admin -X PUT -d@role.json http://localhost/mgmt/shared/authz/roles/iControl_REST_API_User

Fix:
When upgrading to version 13.1.0.x or later, users who previously had permissions to make calls to iControl REST retain the ability to make those calls.

Fixed Versions:
17.5.1.6, 17.1.3.2

714238-12 : CVE-2018-1301: Apache Vulnerability

Links to More Info: K78131906, BT714238

701341-6 : If /config/BigDB.dat is empty or the file is corrupt, mcpd continuously restarts

Links to More Info: K52941103, BT701341

Component: TMOS

Symptoms:
If an issue causes /config/BigDB.dat to be empty or its contents become corrupted, mcpd fails to start up.

System commands report errors about being unable to read DB keys. 'bigstart' outputs errors:

--dbval: Unable to find variable: [security.commoncriteria]

Conditions:
The event causing BigDB.dat to be truncated is unknown at this time.

Impact:
The system fails to start up, and mcpd continually restarts. The BIG-IP system fails to process traffic while the mcpd process is restarting.

Workaround:
To work around this issue, you can remove the empty or corrupted BigDB.dat file. To do so, perform the following procedure:

Impact of workaround: Performing the following procedure should not have a negative impact on your system.

1. Log in to bash.
2. To remove the zero-byte or corrupted BigDB.dat file, type the following command:
rm /config/BigDB.dat

Fixed Versions:
21.0.0.3

675742-4 : Hardware-to-VE-platform-migrate of a UCS may fail with an error on db variable license.maxcores

Links to More Info: BT675742

Component: TMOS

Symptoms:
Using the platform-migrate option to load a UCS from a different platform may show this error from loaddb:

01080023:3: Error return while getting reply from mcpd: 0x107178a, 0107178a:3: Modifying license.maxcores to a value other than 8 is not allowed.

The UCS loads successfully, other than the DB variable, but this error message is printed and the DB variables are not loaded.

Conditions:
-- Migrating a UCS from physical platform hardware to a Virtual Edition (VE) configuration.

-- License has an attribute limiting the maximum number of cores, and the incoming UCS has a value of the DB variable 'license.maxcores' that contradicts this.

Impact:
The DB variable file fails to load, generating the error message, but that does not stop the loading of the regular configuration files in BIG-IP*.conf.

Workaround:
The 'license.maxcores' value is ignored on hardware devices, so set it to 8 before saving the UCS.

Fixed Versions:
21.0.0.3

671545-7 : MCPD core while booting up device with error "Unexpected exception caught"

Links to More Info: BT671545

Component: TMOS

Symptoms:
Mcpd crashes.

Conditions:
The file-store path is missing with specific configuration file which is needed by mcpd while booting.

Impact:
Traffic and control plane disrupted while mcpd restarts.

Fixed Versions:
21.0.0.3

659579 : Timestamps in icrd, restjavad, and restnoded logs are not synchronized with the system time

Links to More Info: BT659579

Component: TMOS

Symptoms:
Logs on icrd, restnoded, and restjavad are in the UTC time zone and are not aligned to the system time, which makes it difficult to determine the time during troubleshooting operations.

Conditions:
Checking the icrd, restnoded, and restjavad logs timestamps.

Impact:
Difficult to troubleshoot as the logs are not aligned with system time.

Workaround:
None

Fixed Versions:
17.5.1.4, 17.1.3.2

658943-9 : Errors when platform migration process is loading UCS using trunks on vCMP guest/F5OS Tenants

Links to More Info: BT658943

Component: TMOS

Symptoms:
During the platform migration from a physical BIG-IP system to a BIG-IP vCMP guest/F5OS Tenant, the load fails with one of the following messages:

01070687:3: Link Aggregation Control Protocol (LACP) is not supported on this platform. Unexpected Error: Loading configuration process failed.

01070338:3: Cannot create trunk [name of trunk], maximum limit reached Unexpected Error: Loading configuration process failed.

Conditions:
-- The source device is a physical BIG-IP device with one or more trunks with or without LACP in its configuration.
-- The destination device is a vCMP guest/F5OS Tenant.

Impact:
The platform migration fails and the configuration does not load.

Workaround:
You can use one of the following workarounds:

-- Remove all trunks from the source configuration prior to generation of the UCS.

-- Before loading the UCS archive onto the target BIG-IP, edit the archive and remove the trunk configuration from ./config/bigip_base.conf, and then repack the UCS.

-- After the UCS load fails, edit the configuration manually on the destination to remove trunk references, and then reload the configuration.

-- K50152613

Fixed Versions:
21.0.0.1, 14.1.4.1

551462-12 : CVE-2014-9730 - Linux Kernel UDF Filesystem Denial of Service Vulnerability

Links to More Info: K17447

531848-4 : Call to Apply Policy can be lost and never retried in an autosync device group

Links to More Info: BT531848

Component: Application Security Manager

Symptoms:
ASM Changes in an auto-sync device group are sent over a direct channel to a device's peers. In rare conditions it is possible that messages are lost over this channel.

Configuration changes have fallbacks to ensure the missing change will be noticed, but there is no such fallback currently for Apply Policy calls.

Therefore, if an Apply Policy call goes missing in an autosync group, it will never retry.

Conditions:
ASM sync is configured on an autosync device group.

Impact:
Enforcement changes will not take effect on the peer devices until the next Apply Policy action.

Workaround:
Make a spurious change to the policy and set it active again.

Fixed Versions:
21.0.0.3

423304-6 : Sync issues with certain objects' parameters.

Component: TMOS

Symptoms:
Synchronized configuration objects may contain invalid parameters after you delete an object and create a different object type with the same name.

Conditions:
This issue occurs when all of the following conditions are met: --
The BIG-IP systems are configured as part of a Device Group. -- You delete a configuration object of one type and then create a different type of object that uses the same name. -- The new object's configuration is synchronized to the other systems of the Device Group.

Impact:
An invalid configuration on the box that is synced to, and no obvious warning signs.

Workaround:
Use either of the following methods: -- Synchronize the configuration after you delete the original object and before you create the new object. -- Use a different name for the new configuration object.

Fixed Versions:
21.0.0.1

2347029-3 : Light memoy leak after signatures detected attack ended

Component: Anomaly Detection Services

Symptoms:
35K memory leak after attack ends

Conditions:
After each attack, and when Bados signature detection is enabled

Impact:
After many attacks, admd consumes too much memory and restart itself

Workaround:
None

Fix:
Memory leak resolved

Fixed Versions:
21.0.0.3

2344733-1 : Updated BIND to version 9.18.50.

Component: Global Traffic Manager (DNS)

Symptoms:
BIG-IP was previously shipped with BIND version 9.18.49, and ISC has since released the latest version, 9.18.50.

Conditions:
BIG-IP is shipped with BIND version 9.18.49.

Impact:
BIND version 9.18.50 includes:
- 1 security fix
- 1 new feature
- 2 bug fixes

See https://downloads.isc.org/isc/bind9/9.18.50/doc/arm/html/changelog.html

Workaround:
NA

Fix:
BIND version 9.18.50 includes:
- 1 security fix
- 1 new feature
- 2 bug fixes

See https://downloads.isc.org/isc/bind9/9.18.50/doc/arm/html/changelog.html

Fixed Versions:
21.0.0.3

2333065-2 : APM Logon Page Fails for Usernames Containing Single Quote (')

Component: Access Policy Manager

Symptoms:
After upgrading to BIG-IP APM version 17.1.3.2, users with a single quote (') in their surname or username (e.g., "o'brien", "labmno'test") are unable to log in via the APM logon page. The system logs show input validation failures for such usernames, with hexadecimal conversion of the input value and error messages indicating rejection

Conditions:
BIG-IP APM version 17.1.3.2
Usernames containing a single quote (') character

Impact:
Legitimate users with a single quote in their username or surname cannot log in to applications protected by BIG-IP APM. This affects user access and may disrupt business operations with such naming conventions

Workaround:
None

Fixed Versions:
21.0.0.3

2326721-2 : DNS NXDOMAIN Query DoS vector statistics not updating for NXDomain responses

Component: Advanced Firewall Manager

Symptoms:
When Device/Profile DoS protection is configured with the DNS NXDOMAIN Query vector, the DoS statistics (stats, drops, and attack count) remain at zero, even when NXDomain responses are received from the server

Conditions:
DoS protection is configured for the device/profile using the DNS NXDOMAIN query vector, along with an LTM virtual server employing the UDP protocol and a backend DNS server that returns NXDomain responses

Impact:
DNS NXDOMAIN attack detection and mitigation are ineffective. The system fails to count or drop NXDomain-based attack traffic, leaving it vulnerable to DNS NXDOMAIN flood attacks

Workaround:
Configure the DNS profile for the Virtual Server

Fix:
The issue is fixed

Fixed Versions:
21.0.0.3

2312245-1 : SOD killing MCPD while doing load sys config file

Component: TMOS

Symptoms:
MCPD restart

Conditions:
- Provision LTM and configure 4096 extraMb
- Load 16k nodes config
- Observe 16000 nodes, one pool with all nodes associated, and one VS
- And then load VS config using load sys config file, and the incoming VS should have the same pool name as the existing one

Impact:
MCPD restart

Workaround:
- While loading a new VS config with pool, make sure not to use the same pool name as the older one
- First, load the system configuration to the default settings, and then load the new VS file

Fix:
As it is taking more time, while handling large VS status updates, heartbeat is sent to SOD from MCPD to make sure, it is intact and SOD will not kill MCPD

Fixed Versions:
21.0.0.3

2304693-2 : Improvements in HTTP/2 on TMM

Links to More Info: K000162231

2302637-3 : Throughput Out statistic incorrectly shows zero on BIG-IP VE

Links to More Info: BT2302637

Component: Local Traffic Manager

Symptoms:
The tmsh show sys performance throughput Output value displays 0 on BIG-IP VE despite normal data plane traffic. The tx_hw_drop counter on the external interface increments while tx_pkts and bytes_out remain at 0. Monitoring and SNMP tools relying on throughput statistics report incorrect values

Conditions:
BIG-IP VE using the socket network driver. This applies to virtual edition deployments across all hypervisors and cloud platforms, including Azure, AWS, VMware, KVM, and Hyper-V

Impact:
Throughput monitoring and reporting show incorrect values. Actual data plane traffic is not affected

Workaround:
None

Fixed Versions:
21.0.0.3

2298245-2 : Access Profile rejects HTTP requests containing unencoded characters in the URI★

Links to More Info: BT2298245

Component: Access Policy Manager

Symptoms:
After upgrading to BIG-IP 17.5.1.6, all users experience failures with certain requests when an Access Profile is applied to the virtual server. Specifically, SharePoint edits or updates fail, and any request containing curly braces ({ or } or | or ＼ ) triggers the error: 'Access encountered an error (Operation not supported).' This issue does not occur when the Access Profile is removed or when using standard bracket characters (e.g., ( or )).

Conditions:
Requests contain curly braces ({ or } or | or ＼ ) in the URI

Impact:
This issue has a significant impact, particularly in environments using Microsoft SharePoint/IIS and browsers such as Chrome or Edge, which may send non-encoded curly braces.

Workaround:
URI encoding of curly braces ({ → %7B, } → %7D) can be handled using an iRule:

when HTTP_REQUEST priority 100 {
    set my_query [HTTP::query]
    if { ($my_query contains "{") or ($my_query contains "}") or ($my_query contains "|") or ($my_query contains "＼"") } {
        HTTP::query [string map {"{" "%7B" "}" "%7D" "|" "%7C" "＼"" "%22"} $my_query]
    }
}

This iRule checks for specific characters in the query and replaces them with their encoded equivalents

Fixed Versions:
21.0.0.3

2297737-3 : Base64 Decoding is enabled for parameters imported from OpenAPI files

Component: Application Security Manager

Symptoms:
When creating a policy from an OpenAPI file containing a parameter defined with type: string and format: binary, the resulting parameter is configured with "Base64 Decoding" enabled

Conditions:
An OpenAPI file is imported to create an ASM policy, and the file contains a parameter defined with type: string and format: binary

Impact:
Base64 Decoding enabled in GUI

Workaround:
Base64 Decoding disabled in GUI

Fix:
Changed flg_detect_base64 to 0 to be disabled

Fixed Versions:
21.0.0.3

2297717-3 : Base64 decoding is disabled for disabled on the url request body for "image/png" Header-Based Content profile

Component: Application Security Manager

Symptoms:
When creating an ASM policy from an OpenAPI file containing a requestBody with a schema defined as type: string and format: base64, a header-based content profile on the URL is configured with "base64 decoding" set to "disabled" while it must be "required"

Conditions:
An OpenAPI file is imported to create a policy, and the file contains a URL with a request body content type image/png, and the schema is defined with type: string and format: base64.

Impact:
Base64 Decoding disabled in GUI

Workaround:
Base64 Decoding enabled in GUI

Fix:
In handle_request_body, extract from the schema format or contentEncoding instead of just contentEncoding

Fixed Versions:
21.0.0.3

2296697-3 : The violation_details Field Displays 'N/A' In Remote Logging

Component: Application Security Manager

Symptoms:
When remote logging is configured with the violation_details field enabled, the violation_details value appears as 'N/A' in the remote log messages

Conditions:
A security policy is configured with remote logging.
The remote logging profile has the violation_details field enabled, and a request triggers a security violation

Impact:
Remote log consumers receive incomplete security event data when the violation_details field is missing

Workaround:
None

Fix:
Remote log contains violation_details

Fixed Versions:
21.0.0.3

2296513-2 : BIND Upgraded to Stable Version 9.18.49

Links to More Info: BT2296513

Component: Global Traffic Manager (DNS)

Symptoms:
BIND upgrade to stable version 9.18.49

Conditions:
Using local BIND

Impact:
BIND upgrade to stable version 9.18.49

Workaround:
None

Fix:
BIND upgrade to stable version 9.18.49

Fixed Versions:
21.0.0.3

2295473-2 : Chmand Leaking Memory On Running The Back To Back F5OS Configs Related To VLANs and LAGs.

Component: TMOS

Symptoms:
- Chmand is leaking memory

Conditions:
- On executing any F5OS commands related to VLANs or LAGs

Impact:
- Chmand will be leaking memory.
- Exhausted memory.

Workaround:
None

Fixed Versions:
21.0.0.3

2291609-3 : ASM crashes when dynamic parameter name configured (rare configuration)

Component: Application Security Manager

Symptoms:
BD process crash

Conditions:
ASM policy attached to a virtual server and flow level parameter configured as dynamic parameter name

Impact:
BIG-IP failover

Workaround:
N/A

Fix:
The issue has been resolved, and the crash no longer occurs after applying the fix.

Fixed Versions:
21.0.0.3

2290085-2 : Excessive OCSP requests from BIG-IP when accessing TMUI with Firefox or Safari using cert-LDAP authentication

Component: TMOS

Symptoms:
When BIG-IP TMUI is configured with cert-LDAP authentication and OCSP validation, accessing the TMUI using Mozilla Firefox or Apple Safari browsers causes BIG-IP to send excessive OCSP requests to the responder approximately every 5 seconds.

Conditions:
This occurs when all of the following conditions are met:
-- BIG-IP TMUI is configured with cert-LDAP authentication with OCSP validation enabled.
-- The TMUI is accessed using Mozilla Firefox or Apple Safari browsers.

Impact:
This can overwhelm the OCSP responder and cause intermittent authentication failures or forced re-authentication on the TMUI.

Workaround:
Use Google Chrome or Microsoft Edge to access the BIG-IP TMUI, as these browsers reuse TLS sessions and do not trigger frequent OCSP requests.

Fix:
BIG-IP TMUI no longer sends excessive OCSP requests when accessed via Mozilla Firefox or Apple Safari browsers with cert-LDAP authentication and OCSP enabled.

Fixed Versions:
21.0.0.3

2288381-3 : VIOL_REQUEST_MAX_LENGTH is not triggered when the login request size exceeds max_login_request_body_buffer_size

Component: Application Security Manager

Symptoms:
VIOL_REQUEST_MAX_LENGTH is not triggered when the size of a login request exceeds the max_login_request_body_buffer_size

Conditions:
A policy with a login page configured with authentication_type=request-body is set, and max_login_request_body_buffer_size is configured to a smaller value than the size of the incoming request.

Impact:
Violation VIOL_REQUEST_MAX_LENGTH not triggered

Workaround:
Modify the logic so that if auth_headers_count == 0 and auth_type includes authentication headers, set auth_type to FORM; otherwise, retain the original auth_type.

Fix:
Reset auth_type to FORM only for authentication types that rely on authorization headers. Otherwise, retain the original auth_type and detect it as a login request.

Fixed Versions:
21.0.0.3

2284397-2 : iRules PEM::session IPv6 Address Subscriber-ID Lookup Causes "Pending Rule Abort" Errors

Links to More Info: BT2284397

Component: Policy Enforcement Manager

Symptoms:
- PEM::Session info irule fails, saying "Pending rule abort" error in logs
- iRule Execution aborts

Conditions:
Data traffic iRule should use PEM::Session info <ipv6-address> command

Impact:
Functional issue. iRule will not provide the expected result

Workaround:
None

Fix:
Fixed the issue

Changes ensure IPv6 lookups now use matching address formats and execute synchronously

Fixed Versions:
21.0.0.3

2284341-4 : PEM Gx Session Bin Entry Stay Even After PEM Session Deletion.

Links to More Info: BT2284341

Component: Policy Enforcement Manager

Symptoms:
GGx sessions remain even after the deletion of PEM sessions.
The memory allocated to Gx sessions remains intact. As more PEM sessions are created and deleted, the memory for Gx sessions continues to grow and is not released.

Conditions:
This is a rare timing-based scenario in which the diam_app is busy sending requests to a non-responsive PCRF. As a result, the middleware (MW) message bus becomes full. When this happens, the notification from SPM to Gx to end the Gx session is dropped because the MW bus has reached its capacity.

Impact:
A slight increase in memory due to Gx sessions persisting even after PEM session deletion may lead to consequences over time, such as memory shortages.

Workaround:
None

Fix:
Measures were implemented to ensure the deletion of the Gx session if the PCRF is unresponsive and a Gx session cannot be established with it.

Fixed Versions:
21.0.0.3

2279009-1 : With large configured receive-window-size, BIG-IP advertises non-zero SYN/SYN-ACK window, but zero window in final 3WHS ACK and all subsequent packets

Links to More Info: BT2279009

Component: Local Traffic Manager

Symptoms:
BIG-IP advertises non-zero window in SYN/SYN-ACK (as expected), but zero window in the final 3WHS ACK and in all subsequent packets, stalling the tcp connection forever.

Conditions:
Virtual server configured with a tcp profile having a Receive Window value ('receive-window-size' in tmsh) between 536862721 and 1073725440

Impact:
All tcp connections get stalled, both on the client-side and on the server-side.

Workaround:
Two possible workarounds.

- Configure a Receive Window value ('receive-window-size' in tmsh) to any value lower than 536862721.

- On the tcp profile, set the Initial Receive Window Size ('init-rwnd' in tmsh) to 64

Fixed Versions:
21.0.0.3

2278945-2 : TMSH can intermittently crash due to thread cancellation

Component: TMOS

Symptoms:
In some instances, TMSH may experience a segmentation fault if a thread is not properly cancelled

Conditions:
The crash was intermittent, but in certain situations, when a thread was improperly cancelled, TMSH could crash

Impact:
TMSH would crash without any immediate indication as to why

Workaround:
None

Fix:
Fixed an intermittent crash that could happen during process shutdown

Fixed Versions:
21.0.0.3

2266037-2 : Local Database Users Not Syncing To Standby Device In HA Setup

Component: Access Policy Manager

Symptoms:
Local database users created on the Active device are not synchronized to the Standby device in a High Availability setup. Only the local database instances are synced, but the users within those instances are not visible on the Standby device

Conditions:
- High Availability (HA) setup with Active-Standby configuration
- Local database instances configured with users
- Issue occurs after failover or reboot events
- Affects both Virtual Edition (VE) and Hardware platforms

Impact:
Authentication failures may occur during failover scenarios as user credentials exist only on the Active device and are not available on the Standby device. This can result in service disruption during device transitions.

Workaround:
Restart the localdbmgr process using: bigstart restart localdbmgr

Fix:
An issue has been resolved where local database users created on the Active device were not being synchronized to the Standby device in High Availability (HA) setups. The synchronization mechanism has been improved to ensure that both local database instances and their associated users are accurately replicated to the standby devices during HA operations, including failover, reboot, and device role transitions

This fix also resolves related issues where users created via the GUI would disappear after approximately one hour, and deleted user accounts would remain in the database

Fixed Versions:
21.0.0.3

2264845-3 : TMM may crash when enabling DNS Express

Links to More Info: BT2264845

Component: Global Traffic Manager (DNS)

Symptoms:
TMM may crash when enabling DNS Express.

Conditions:
Occurs when enabling DNS express feature with traffic actively hitting the modified virtual-server.

Impact:
TMM core crashes.

Workaround:
N/A

Fix:
N/A

Fixed Versions:
21.0.0.3

2264133-3 : TMSH improvements

Links to More Info: K000160975, BT2264133

2264037-2 : TMM may generate a core file after an SSL cipher group is deleted

Links to More Info: BT2264037

Component: Local Traffic Manager

Symptoms:
TMM crashes and generates a core file

Conditions:
- An SSL cipher group previously referenced by an SSL profile is removed from the configuration.
- Connections established while the profile referenced that cipher group remain active.
- At least one of those connections initiates a TLS renegotiation.

Impact:
Traffic interruption while TMM generates a core file and restarts.

Workaround:
Do not remove a cipher group if any active connections may still reference an older SSL profile that used it.

Fix:
N/A

Fixed Versions:
21.0.0.3

2264013-2 : Unable to retrieve the tower ID using an iRule when the user-location-info size exceeds 8 bytes.

Links to More Info: BT2264013

Component: Policy Enforcement Manager

Symptoms:
When creating a subscriber/session with user-location-info greater than 8 bytes and attempting to extract it using a custom iRule filter in the PEM policy.

Conditions:
Subscriber/session creation with user-location-info greater than 8 bytes (e.g., string length 0x + (2 * 8) = 18 characters).
Example: 0x001300621A2B3C4D.

Impact:
Unable to extract user-location-info using a custom iRule filter in the PEM policy.

Fix:
With the fix, user-location-info can now be extracted in all formats, with a maximum size of 13 bytes (equivalent to 28 characters in string length).

Fixed Versions:
21.0.0.3

2262981-4 : TMM may corrupt stack during class lookup

Links to More Info: BT2262981

Component: Local Traffic Manager

Symptoms:
TMM core
Log may contain
can'tt read "domain": no such variable while executing "class match -value percentage contains ${path}/${domain}-cluster

Conditions:
The iRule uses a class match (class match -value percentage contains ${path}/${domain}-cluster) and fails if the path/domain doesn’t exist or the class name exceeds 265 characters.

Impact:
Tmm does not operate during reboot

Workaround:
Update the iRule to avoid using a class or path longer than 265 characters, or ensure the class exists.

Fix:
N/A

Fixed Versions:
21.0.0.3

2259609-2 : Wildcard deletes for tmsh ltm node fail without an error message

Component: TMOS

Symptoms:
When trying to delete LTM node objects using a wildcard in the name, the command would execute, but it would fail silently, and no nodes would be removed.

Conditions:
Try to delete LTM node objects by using a wildcard in the name

Impact:
Any nodes that match the wildcard pattern will remain on the BIG-IP after the delete command is executed.

Workaround:
None.

Fix:
A delete ltm node command can now delete ltm node objects when a wildcard is used for the name

Fixed Versions:
21.0.0.3

2259269-4 : CRLDP Agent Validates CRL Distribution Point URLs to Prevent Connections to Loopback and Link-Local Addresses

Component: Access Policy Manager

Symptoms:
The CRLDP authentication agent in APM extracts CRL Distribution Point URLs from client certificate X.509 extensions and connects to the specified host without validating the destination IP address. This could allow a crafted client certificate to cause BIG-IP to initiate outbound connections to loopback or link-local addresses

Conditions:
-- BIG-IP APM is configured with client certificate authentication and CRLDP validation enabled
-- A client presents a certificate containing a CRL Distribution Point extension with a URL pointing to a loopback (127.x.x.x) or link-local (169.254.x.x) address
-- The certificate chains to a CA trusted by BIG-IP

Impact:
An attacker presenting a valid client certificate with a crafted CRL Distribution Point URL could cause APMD to make outbound HTTP or LDAP connections to loopback or link-local addresses, potentially accessing local services or cloud metadata endpoints

Workaround:
None

Fix:
The CRLDP agent now validates CRL Distribution Point URLs before initiating connections. URLs that resolve to loopback, link-local addresses are rejected. When a URL is blocked, the CRL is treated as unavailable, and existing APM CRLDP policies for CRL unavailability apply. The localhost hostname is also explicitly rejected

Fixed Versions:
21.0.0.3

2259173-3 : Sanitize key in memcache library

Links to More Info: BT2259173

Component: Local Traffic Manager

Symptoms:
Users may be able to store invalid keys in Memcached using client request

Conditions:
Invalid key value pair is passed in client request

Impact:
Fetching values for that key may fail and my provide unexpected values

Workaround:
-NA-

Fix:
Memcached should not allow invalid keys to be set

Fixed Versions:
17.5.1.6, 17.1.3.2

2259165-3 : Input Validation on APM Logon Page

Links to More Info: BT2259165

Component: Access Policy Manager

Symptoms:
The logon page in the per-session policy currently lacks user input validation for invalid characters.

Conditions:
The logon page is configured within the APM per session policy

Impact:
The logon page does not validate user input and directly stores the provided value as a session variable.

Workaround:
None

Fix:
The logon page has been updated to include the following input validations:

-- Fields of type TEXT now restrict the use of specific characters: single-quote (ASCII value 0x27), double-quote (ASCII value 0x22), pipe (ASCII value 0x7C), greater-than (ASCII value 0x3E), and less-than (ASCII value 0x3C).

-- For TEXT fields with the parameter name "username," the input is limited to a maximum length of 256 characters.

Fixed Versions:
17.5.1.6, 17.1.3.2

2259157-3 : Parsing failure may interpret data as a Memcached command

Links to More Info: BT2259157

Component: TMOS

Symptoms:
Some data-body commands (add, set, replace, incr, decr) failed to close connections properly on error, causing request data to be misinterpreted as commands.

Conditions:
There is a parsing failure in commands that require data in the request body.

Impact:
Connection remains open even in the event of command failures, which can result in data being accepted as a command.

Workaround:
N/A

Fixed Versions:
17.5.1.6, 17.1.3.2

2259109-3 : External users can run the track command

Links to More Info: BT2259109

Component: Local Traffic Manager

Symptoms:
The memcached proxy track command has been removed from the codebase to maintain optimal performance.

Conditions:
When users use the track command to monitor session events.

Impact:
End user can run the track command.

Workaround:
N/A

Fixed Versions:
17.5.1.6, 17.1.3.2

2258929-1 : Deleting/Adding virtual server on the LTM device object can change other disabled virtual server status on the LTM device object.

Links to More Info: BT2258929

Component: Global Traffic Manager (DNS)

Symptoms:
After setting gtm virtual server that has a BIG-IP (or bigip-link) monitor associated with it to 'disabled', and then performing any action that causes the gtm monitor list to be recalculated (adding a monitor, deleting a monitoring, establishing or disonnecting an iquery connection, adding a gtm server, removing a gtm server, or any other actions that result in the association of gtm monitors to their responsible gtmd process to be rebuilt), the virtual servers that were in a disabled start are no longer monitored at all, and show a down reason of of 'no reply from big3d: timed out' and a "offline/disabled" state, even after re-enabling that virtual server

Log messages similar to these may be seen in /var/log/gtm:

bigipdns.local alert gtmd[21078]: 011ae0f2:1: Monitor instance /Common/bigip 10.1.1.192:80 UP --> DOWN from /Common/bigipdns (no reply from big3d: timed out)

bigipdns.local alert gtmd[21078]: 011a6006:1: SNMP_TRAP: virtual server vs2 (ip:port=10.1.1.192:80) (Server /Common/bigipltm) state change green --> red ( Monitor /Common/bigip : no reply from big3d: timed out: disabled directly)

Conditions:
All of the following conditions need to be met.

-- The DNS system monitors a remote LTM device (or gtm link) and its virtual servers.
-- DNS system has the BIG-IP or bigip-link monitor types assigned to those virtual servers (automatic if the gtm server type is 'bigip')
-- There is at least one disabled virtual servers in the LTM device object.
-- The "Monitor Disabled Objects" setting under "DNS >> Settings : GSLB : General" is unchecked (default).
-- A change is made the DNS configuration or state that results in the monitor list being recalculated.

The issue can be triggered by either of the following sequences:

- Disabling and then re-enabling a GTM Link, after which some or all associated virtual servers remain down until big3d is restarted.

- Re-establishing iQuery and then re-enabling the "link"; in some environments, all VSes may remain disabled after this sequence.

Impact:
Virtual servers in this stated move from "available/disabled" (black circle icon on GUI) to "offline/disabled" (black rhombus icon on GUI), and are not monitored and not available for use in DNS replies.

Once this problem has occurred, those disabled virtual servers remain unavailable, even after re-enabling then, and show a state of "offline/enabled" (red rhombus icon in the GUI)

Workaround:
To recover already-affected virtual servers, on the DNS system, temporarily assign any DNS monitor object to the affected virtual server (not to the gtm server obejct), and then remove that monitor again.

For example:

# tmsh modify gtm server bigipltm virtual-servers modify { vs1 { monitor gateway_icmp } vs2 { monitor gateway_icmp } }
# tmsh modify gtm server bigipltm virtual-servers modify { vs1 { monitor none } vs2 { monitor none } }
# tmsh save /sys config gtm-only


Alternatively, restart the gtmd process on all members of the DNS sync group (this will cause all iquery connections to have to reconnect, and may trigger some monitored targets to be briefly marked down and should therefore be performed during a short maintenance window)

# tmsh restart sys service gtmd

To avoid this issue occurring again, set the configuration setting "gtm global-settings general monitor-disabled-objects" parameter to "yes".

# tmsh modify /gtm global-settings general monitor-disabled-objects yes
# tmsh save /sys config gtm-only

2258853-2 : [APM][SAML] SP automation fails to update, when bound to an IdP with a SAML Resource

Links to More Info: BT2258853

Component: Access Policy Manager

Symptoms:
SAML SP connector automation fails whenever the metadata changes, i.e., a change in certificate.
In IDP initiated SAML, SAML service is configured in SAML resource which prevents the certificate update in the filestore.

Conditions:
SAML connector automation to create SP connectors.

Impact:
Unable to create SP connectors through connector automation.

Fixed Versions:
21.0.0.3

2258705-1 : A policy with overlapping range in different rules may never match

Links to More Info: BT2258705

Component: Local Traffic Manager

Symptoms:
An LTM policy with multiple rules may fail to match correctly if a rule matches an IP address range from the first rule but not the associated URL. Even if the same IP address fits the criteria for the second rule, it will not match the second rule.

Conditions:
An LTM policy rule with a 'tcp match address' statement that matches against an address range in the first rule will prevent any further rule to be check for if the IP address match

For example, if rule 1 contains
values { 10.16.0.0/12 } and URL foo.com
while rule 2 contains
values { 10.31.236.18 10.255.255.1 } with URL example.com
Then if the source IP address is 10.31.236.18 with example.com, it will be rejected ecause 10.31.236.18 would match the range 10.16.0.0/12 in rule 1 but not foo.com

Impact:
The policy rule fails to match even when it meets the specified criteria.

Workaround:
Avoid overlapping IP range in different rules

Fix:
This issue is fixed.

Fixed Versions:
17.5.1.6, 17.1.3.2

2258257-3 : Zombie connections after switching dos profile may cause tmm crash.

Links to More Info: BT2258257

Component: Anomaly Detection Services

Symptoms:
Tmm can crash in rare cases

Conditions:
When switching a dos profile (with bados enabled), while connections are still active for aa long time after the switch, tmm crash might occur.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

Fixed Versions:
17.5.1.6, 17.1.3.2

2257421-1 : TMSH enhancements

Links to More Info: K000161107, BT2257421

2256725-1 : Unable to trigger "Disallowed file upload content detected" violation in some cases

Component: Application Security Manager

Symptoms:
The "Disallowed file upload content detected" violation is not triggered in some cases.

Conditions:
Under a specific traffic scenario, the violation is not triggered.

Impact:
Traffic with violation passes through.

Workaround:
N/A

Fix:
The violation is now detected correctly.

Fixed Versions:
21.0.0.3

2256657-2 : Some regular expressions in JSON schema can cause traffic to be blocked

Component: Application Security Manager

Symptoms:
A legitimate request is blocked with a violation "JSON data does not comply with JSON schema"

Conditions:
- Violation "JSON data does not comply with JSON schema" is set to Block;
- JSON content profile with JSON schema file attached;
- The attached JSON schema contains a "pattern" field with a specific regex.

Impact:
Legitimate traffic may be blocked

Workaround:
N/A

Fix:
Handling of regular expressions in JSON schema was improved

Fixed Versions:
21.0.0.3

2252481-3 : Undisclosed network traffic can cause a TMM crash

Links to More Info: K000161023, BT2252481

2251813-3 : BIG-IP AFM: mcpd may crash when modifying address lists with cyclic nested references

Links to More Info: BT2251813

Component: Advanced Firewall Manager

Symptoms:
Modifying an address list (such as adding or deleting an entry) can cause mcpd to crash with a segmentation fault (SIGSEGV).

Conditions:
Address lists are configured with nested references.

Impact:
Mcpd process crashes. Traffic disrupted while mcpd restarts.

Workaround:
Review and correct address list configurations to ensure no cycles exist

Fixed Versions:
17.5.1.6, 17.1.3.2

2251649-4 : `sig_cve` and `staged_sig_cves` Fields Appear as N/A in Data Sent to Remote Syslog

Links to More Info: BT2251649

Component: Application Security Manager

Symptoms:
While transmitting data to the remote syslog in BIG-IP, the sig_cve and staged_sig_cves fields may be displayed as "N/A"

Conditions:
The issue was introduced by the changes made in fix 911661. Therefore, it may surface only if a hotfix or version is installed that includes 911661 without the resolution for this problem

Impact:
The remote event log might incorrectly display "N/A" for the sig_cve and staged_sig_cves fields.

Workaround:
None

Fix:
sig_cve and staged_sig_cves fields are properly included in the remote logs.

Fixed Versions:
17.5.1.6, 17.1.3.2

2244413-1 : Client Certificates are cached even when Retain Certificate is disabled on a Clientssl profile

Links to More Info: BT2244413

Component: Local Traffic Manager

Symptoms:
Client certificates are cached which can drive up memory usage.

Conditions:
TLS 1.2 sessions that are resumed with session tickets where the client also presents a certificate to the BIG-IP.

Impact:
Memory usage may increase due to caching certificates

Workaround:
None

Fixed Versions:
17.5.1.6, 17.1.3.2

2241493-3 : User facing login issues with newly created password-based Azure VMs

Links to More Info: BT2241493

Component: TMOS

Symptoms:
User is facing login issues with newly created password-based Azure VMs

Conditions:
Applicable to all Azure VM types

Impact:
User facing login issues with newly created password-based Azure VMs

Workaround:
User can create ssh-based Azure VMs

Fix:
Fixed the issues in the bundled WALinuxAgent.

Fixed Versions:
17.5.1.6, 17.1.3.2

2240957-3 : ASM Does Not Send a Webhook When a HTTP Proxy Server Is Used.

Links to More Info: BT2240957

Component: Application Security Manager

Symptoms:
Handshake failure logs observed in /var/log/asm:

ASM subsystem error (asmcrond,(eval)): Failed to send webhook:
ASM subsystem error (asmcrond,(eval)): 500 handshakefailed

Conditions:
Use webhook with a HTTP proxy server

Impact:
Cannot use webhook function when using a http proxy server

Workaround:
None

Fix:
Upgarde perl-LWP-Protocol-https from 6.04 to 6.10

Fixed Versions:
21.0.0.3

2238385-2 : Some Regular Expressions In JSON Schema Can Cause Traffic To Be Blocked

Links to More Info: BT2238385

Component: Application Security Manager

Symptoms:
A legitimate request is blocked with a violation "JSON data does not comply with JSON schema"

Conditions:
- Violation "JSON data does not comply with JSON schema" is set to Block
- JSON content profile with JSON schema file attached
- The attached JSON schema contains a "pattern" field with a specific regex

Impact:
Legitimate traffic may be blocked

Workaround:
N/A

Fix:
Handling of regular expressions in JSON schema was improved

Fixed Versions:
21.0.0.3

2230841-4 : Admd Crash During Restart Under Heavy Load

Links to More Info: BT2230841

Component: Anomaly Detection Services

Symptoms:
Admd crash during the restart process.

Conditions:
Under heavy system load, if the admd anomaly process hangs, the system triggers an admd restart. However, the shutdown sequence does not release objects in the correct order, potentially causing a crash. Introducing a proper shutdown sequence resolves this issue.

Impact:
Core is created, though there is no functionality problem, as the admd was on its way to restart itself

Workaround:
None

Fix:
BADOS restarts performing a silent shutdown.

Fixed Versions:
17.5.1.6, 17.1.3.2

2230749-1 : Platform Agent Core Detected; Process Shutdown

Links to More Info: BT2230749

Component: F5OS Messaging Agent

Symptoms:
The platform agent encounters a crash during the shutdown process.

Conditions:
-- Platform agent shutdown

Impact:
Platform agent crashes. No functionality impact.

Workaround:
None.

Fix:
The issue has been resolved to ensure the shutdown process completes gracefully without any crashes.

Fixed Versions:
17.5.1.6, 17.1.3.2

2230405-3 : PEM memory handling update

Component: Policy Enforcement Manager

Symptoms:
Increased memory usage over time.

Conditions:
PEM enabled.

Impact:
Could lead to unexpected behavior over time.

Workaround:
NA

Fix:
Updated handling

Fixed Versions:
21.0.0.3

2230277-2 : Help Content Missing on Live Update Page in Certain Scenarios

Links to More Info: BT2230277

Component: Application Security Manager

Symptoms:
When clicking the Live Update tab from another screen under Software Management (for example, the Update Check screen), the content in the Help tab is not displayed.
Instead, the following message appears:

"No help is available for this topic."

Conditions:
-- In the GUI, go to System ›› Software Management: Live Update.
-- Open the Help tab.

Result: Help content is available.

-- Click Update Check while the Help view remains open.
-- Click back on Live Update.
-- Open the Help tab again.

Result: The following message is displayed:
"No help is available for this topic."

Impact:
The user cannot see the help content.

Workaround:
Navigate to the Live Update page from another screen that is not under the Software Management tab.
For example:

Security ›› Application Security: Security Policies: Policies List

Fix:
The Live Update help content is displayed correctly.

Fixed Versions:
17.5.1.6, 17.1.3.2

2230009-4 : Access Policy memory is not cleared between access policy executions

Links to More Info: BT2230009

Component: Access Policy Manager

Symptoms:
APD has a Tcl interpreter that can process commands provided inside an Access policy, for variable assignment or other purposes.

The Tcl environment provided does not reliably clear Tcl variables assigned in prior executions, so care must be taken to initialize the potentially dirty variables if they are used.

Conditions:
User uses some Tcl variables that can potentially be not initialized. For example, a variable assign:
session.test = regexp {(.+)@example.com} "[mcget {session.logon.last.username}]" foo captured; return $captured

Note that here, the regex may match or not match depending on the user input. If it does not match, the variable "captured" *may* contain the results from a different user who logged in previously.

Impact:
Unexpected results from Access Policy execution.

Workaround:
To work around the problem, any variable that was used must be checked. For example, instead of the regex statement above, this could be used:

if { [regexp {(.+)example.com} "[mcget {session.logon.last.username}]" foo captured] == 1 } { return $captured; } else { return "nomatch"; }

This way, if the regex does NOT match, then the result will be "nomatch" instead of potentially containing results from a previous session.

Fix:
APMD variable assign agent regex expression execution isolated from other sessions using namespace

Fixed Versions:
17.5.1.6, 17.1.3.2

2229893-4 : Not Applicable (Internal Diagnostics Improvement)

Links to More Info: BT2229893

Component: Policy Enforcement Manager

Symptoms:
Middleware runtime statistics are unavailable in production builds because middleware tmstat instrumentation is only enabled in debug builds

Conditions:
Running a production (non-debug) TMM build and attempting to inspect middleware runtime statistics for troubleshooting or post-incident analysis is not possible

Impact:
Reduced diagnosability for engineering and support teams, as middleware runtime statistics used for debugging and troubleshooting are unavailable in production builds. There is no impact on customer traffic handling or feature functionality

Workaround:
Use a debug build with middleware tmstat instrumentation enabled

Fix:
Middleware tmstat instrumentation is now enabled in production builds, providing access to middleware runtime statistics for troubleshooting and post-incident analysis while preserving existing functionality

Fixed Versions:
21.0.0.3

2229881-3 : Multi-slot tenant may become inoperative after tenant upgrade followed by tmsh reboot slot all

Links to More Info: BT2229881

Component: Local Traffic Manager

Symptoms:
After upgrading the tenant, if the command tmsh reboot slot all is executed on a multi-slot tenant, the tenant may fail to come back to an operational state and remain stuck in an inoperative state.

Load sys configuration process fails with the error: Could not find master-key object

slot2/tenant1 err tmsh[10271]: 01420006:3: Loading configuration process failed.
slot2/tenant1 emerg load_config_files[10255]: "/usr/bin/tmsh -n -g -a load sys config partitions all base " - failed. -- 01070710:3: Could not find master-key object - sys/validation/MasterKey.cpp, line 3070

All slots will have an Availability of "offline" as reported in tmsh show sys cluster:
root@tenant1:/S2-red-P::INOPERATIVE:Standalone] config # tmsh show sys cluster

-----------------------------------------
Sys::Cluster: default
-----------------------------------------
Address 10.144.192.210/22
Alt-Address ::
Availability available
State enabled
Reason Cluster Enabled
Primary Slot ID 2
Primary Selection Time 02/26/26 15:23:52

  ---------------------------------------------------------------------------------------------------------
  | Sys::Cluster Members
  | ID Address Alt-Address Availability State Licensed HA Clusterd Reason
  ---------------------------------------------------------------------------------------------------------
  | 1 :: :: offline enabled false offline running Run, HA TABLE offline
  | 2 :: :: offline enabled true offline running Run, HA TABLE offline
  | 3 :: :: offline enabled false offline running Run, HA TABLE offline


Mcpd state will be base-config-load-failed
[root@tenant1:/S2-red-P::INOPERATIVE:Standalone] config # tmsh show sys mcp-state

-------------------------------------------------------
Sys::mcpd State:
-------------------------------------------------------
Running Phase platform
Last Configuration Load Status base-config-load-failed
End Platform ID Received true
Cluster Quorum Reached true

Conditions:
1. A tenant upgrade is performed on a multi-slot F5OS tenant.

2. All slots of the tenant are rebooted using tmsh reboot slot all or clsh reboot.

Impact:
All slots remain offline and are inoperable from a traffic processing standpoint. Additionally, loading the system configuration fails

Workaround:
To bring the system back to a working state:
reboot the current primary slot to change the primary slot, and then restart mcpd on the new primary slot using command: bigstart restart mcpd

tmsh show sys cluster will report the "Primary Slot ID"

# tmsh show sys cluster
-----------------------------------------
Sys::Cluster: default
-----------------------------------------
Address 10.144.192.210/22
Alt-Address ::
Availability available
State enabled
Reason Cluster Enabled
Primary Slot ID 2
Primary Selection Time 02/26/26 15:23:52

Fixed Versions:
17.5.1.6, 17.1.3.2

2229857-3 : Full load from text files fails with "01020036:3: The requested device (/Common/<device-name>) was not found" if deprecatedApiAllowed is false★

Links to More Info: BT2229857

Component: Local Traffic Manager

Symptoms:
- After a reboot, upgrade, or otherwise forcing MCPD to load its configuration from the text config files (refer to K13030: Forcing the mcpd process to reload the BIG-IP configuration), MCPD remains inoperative and fails to load the configuration.

- The configuration fails to load with the following error:
  01020036:3: The requested device (/Common/<device-name>) was not found.

Conditions:
- deprecatedApiAllowed is set to false in /config/api_settings/availability.conf. The default is "true".

Impact:
The system remains inoperative and the configuration will not load.

Workaround:
Do not set deprecatedApiAllowed to false.

If the configuration currently will not load, log into the system as root and do the following:

1. Edit /config/api_settings/availability.conf and set "deprecatedApiAllowed" to "true". This can be done by running:

sed -i -e 's,deprecatedApiAllowed":false,deprecatedApiAllowed":true,' /config/api_settings/availability.conf

2. Load the configuration:

tmsh load sys config

Fixed Versions:
17.5.1.6, 17.1.3.2

2229613-1 : F5OS Tenant Inoperative Due to Incorrect Permissions on /etc/nsswitch.conf File

Links to More Info: BT2229613

Component: TMOS

Symptoms:
Platform_agent cannot connect to api-svc-gateway, resulting in the tenant being inoperative.

Repeated entries are found at /var/log/ltm log file:

Feb 23 16:14:53 localhost.localdomain warning platform_agent[5887]: 01e10005:4: Unable to subscribe for stats.

Conditions:
A manually modified UCS archive that is loaded on the BIG-IP tenant has incorrect permissions/ownership of the ./etc/nsswitch.conf file.

Once UCS is loaded, the system file: /etc/nsswitch.conf does not contain the proper permissions/ownership, e.g.

[root@hostname:INOPERATIVE:] config # ls -lZ /etc/nsswitch.conf
-rw-------. tester abc system_u:object_r:etc_t:s0 /etc/nsswitch.conf

Impact:
The tenant is inoperative.

Workaround:
After loading the UCS, run the commands that update file ownership and permissions and restart platform_agent:

chown root:root /etc/nsswitch.conf
chmod 644 /etc/nsswitch.conf
bigstart restart platform_agent

Fix:
Update /etc/nsswitch.conf file permissions to 644 and ownership to root:root.

Fixed Versions:
17.5.1.6

2229569-4 : Evict FSD Received While SPVADWL Is Uninitialized

Links to More Info: BT2229569

Component: Advanced Firewall Manager

Symptoms:
The issue occurs when spvadwl, a hash data structure, is uninitialized, and an EVICT FSD request is received from the SEP driver.

Conditions:
The system expects the spvadwl hash to be initialized before handling an EVICT FSD request. If this assumption is incorrect, operations dependent on the hash fail due to its uninitialized state.

Impact:
tmm cores

Workaround:
N/A

Fix:
A NULL check has been added to the `spvadwl_search` function to confirm the spvadwl hash is properly initialized before processing. If the hash is uninitialized, the system will ignore the 'EVICT FSD' request, ensuring proper operation and preventing errors.

Fixed Versions:
17.1.3.2

2229525-3 : TMM crash due to stale shared memory mapping after wr_urldbd restart

Links to More Info: BT2229525

Component: Traffic Classification Engine

Symptoms:
When the webroot database (wr_urldbd) is restarted, tmm can crash.

Conditions:
wr_urldbd is restarted

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

Fix:
Fixed a race condition between TMM and wr_urldbd to ensure the correct shared memory is mapped while the database is actively being loaded by wr_urldbd.

Fixed Versions:
21.0.0.3, 17.5.1.6

2229021-1 : iControl REST issue

Links to More Info: K000160876, BT2229021

2228837 : System Integrity Status: Unavailable on BIG-IP versions with the fix for ID2141205

Links to More Info: BT2228837

Component: TMOS

Symptoms:
The 'tmsh run sys integrity status-check' or 'tpm-status' commands incorrectly report system integrity status as 'Unavailable' although the system software has not been modified.

Detailed output of the "tpm-status -v 3" command includes the following messages:

Cert policy: 1.3.6.1.4.1.3375.0.1.1.1
Required policy:1.3.6.1.4.1.3375.0.1.1.1
Key certificate OID: 1.3.6.1.4.1.3375.0.1.1.1
Popping a key cert into keys
Key cert verification: 0
Invalid key cert detected, removing from verification chain
Verifying SIRR database contents...

System Integrity Status: Unavailable



In addition:

Some Engineering Hotfixes containing a fix for ID2141205 do not successfully resolve the symptoms of ID2141205.

Conditions:
This may occur on affected versions on or after April 4, 2026, when running on the following F5 hardware platforms which include TPM (Trusted Platform Module) hardware:
-- iSeries appliances
-- VIPRION B44xx blades (B4450, B4460)

This may occur when running the follow BIG-IP versions which include the fix for ID 2141205 (https://cdn.f5.com/product/bugtracker/ID2141205.html):
-- Pre-release versions of BIG-IP; specifically, sustaining branches for BIG-IP v21.0.x, v17.5.x and v17.1.x.
-- Engineering Hotfixes which include the fix for ID 2141205. To date, such Engineering Hotfixes have been provided for the following BIG-IP versions:
   -- v17.5.1.3, v17.5.1.4
   -- v17.1.0.1, v17.1.2.2, v17.1.3

Impact:
You are unable to determine the integrity of the system boot components validated by the Trusted Platform Module (TPM). The system integrity status shows Unavailable, when the actual status may be either Valid or Invalid.

Workaround:
None.

Fix:
Trusted Platform Module (TPM) status shows the correct system integrity status for BIG-IP versions which include the fix for ID2141205. ID2141205 is also resolved in BIG-IP releases and Engineering Hotfixes.

Fixed Versions:
17.5.1.5, 17.1.3.2

2228753-1 : Violation_details may contain unexpected line break

Links to More Info: BT2228753

Component: Application Security Manager

Symptoms:
Violation_details field may contain an unexpected line break, such as 0x0d or 0x0a.

Conditions:
- Using remote logging
- Sending violation_details
- Using "Maximum Request Size" with a specified length, not Any

Impact:
Remote logging server may be confused by the line break.

Workaround:
Do not send violation_details or use "Maximum Request Size: Any".

Fixed Versions:
21.0.0.3

2227441-1 : Apply limitations on certain object creation

Links to More Info: K000160916, BT2227441

2225313-3 : ASM CAPTCHA refresh and audio icons are missing after policy import

Component: Application Security Manager

Symptoms:
ASM CAPTCHA refresh, and audio icons may be missing when a policy is imported and applied directly.

Conditions:
A policy is imported and applied directly.

Impact:
ASM CAPTCHA refresh and audio icons may be missing.

Workaround:
Make a spurious change to any Blocking Response Page and apply policy.

Fix:
ASM CAPTCHA refresh and audio icons are populated correctly.

Fixed Versions:
21.0.0.3

2225201-3 : iControl REST hardening

Links to More Info: K000160911, BT2225201

2225017-1 : Config Sync not working in an HA setup

Links to More Info: BT2225017

Component: TMOS

Symptoms:
Config Sync not working in an HA setup

Conditions:
User has an HA setup.

Impact:
Config Sync not working

Fix:
Resolved the connection issue required for the config sync to work.

Fixed Versions:
17.5.1.6

2224937-1 : HA Devices staying out of sync

Links to More Info: BT2224937

Component: TMOS

Symptoms:
On first attempt after creation of device group, devices are not getting into the "In Sync" state.

Conditions:
Reproducible on the instances with HA setup

Impact:
Devices stay out of sync for a longer duration blocks config sync and failover

Workaround:
Multiple attempts and after few minutes, devices get into the sync

Fix:
Added relevant TCP headers and updated the package handling.

Fixed Versions:
17.5.1.6

2222185-4 : Even if it's possible to configure multiple stanzas under the auth-info section of a security ssh profile, the SSH proxy will always choose the first one that has a private key

Links to More Info: BT2222185

Component: Advanced Firewall Manager

Symptoms:
In a security ssh profile, it's possible to configure multiple stanzas under the 'auth-info' section.

For example, using this configuration:

security ssh profile f5-test-ssh-proxy {
    ...
    auth-info {
        ed25519 {
            proxy-server-auth {
                private-key ...
                public-key ...
            }
            proxy-client-auth {
                private-key ...
                public-key ...
            }
            real-server-auth {
                public-key ...
            }
        }
        rsa {
            proxy-server-auth {
                private-key ...
                public-key ...
            }
            proxy-client-auth {
                private-key ...
                public-key ...
            }
            real-server-auth {
                public-key ...
            }
        }
    }
    description none
    lang-env-tolerance common
    timeout 0
}

Conditions:
- AFM module licensed and provisioned.

- security ssh profile configured with multiple stanzas under the auth-info section.

Impact:
On the client-side session establishment (external client to AFM), the SSH proxy will always choose the first section that has an entry with a proxy-server-auth private-key.

Workaround:
Configure only one stanza under the auth-info section of a security ssh profile.

Fix:
Updated SSH proxy host-key selection logic in security SSH profiles to process all configured auth-info stanzas, loads valid proxy-server keys for supported algorithms (RSA, DSA, ECDSA, ED25519), and enforce one key per algorithm type while skipping invalid or duplicate entries.

Fixed Versions:
17.5.1.6, 17.1.3.2

2221941-3 : IP Intelligence Incorrectly Programs FPGA/HW Shun for Legitimate Endpoints Due to Stray Post-Session ACK After Flow Teardown, Blocking New Subscriber Connections

Component: Advanced Firewall Manager

Symptoms:
When a subscriber's TCP session to a blocked website ends, the remote server may send a stray acknowledgment packet to the BIG-IP. As there is no active session for this packet, the BIG-IP views it as unsolicited traffic and blocks that IP address in hardware. This action causes all new subscriber connections to that website to be dropped until the hardware entry expires.

Conditions:
AFM is provisioned with an IP Intelligence global policy using a feed list
-- The platform supports SPVA hardware offload, and force_sw_dos is not enabled
-- A subscriber initiates a TCP session to an endpoint whose IP address is present in the feed list
-- The session is torn down (client sends RST-ACK; BIG-IP tears down the flow and forwards the RST-ACK to the endpoint)
-- The remote endpoint sends a packet back to BIG-IP after the session entry has already been removed

Impact:
The entire subscriber base at an ISP/SP deployment can lose access to websites present in the IPI feed lists, even when subscribers are the initiating party. IPI is rendered unusable in subscriber-facing service provider environments

Workaround:
Disable SPVA hardware offload for IPI by setting force_sw_dos true (trades hardware blocking for software-only enforcement, with performance impact), or remove the global IPI policy. Neither is acceptable long-term for ISP deployments

Fix:
- SP Endpoint Tracking: The SP Endpoint tracking feature for the IPI global policy allows tracking of blocked endpoint IPs in a per-TMM database with three states: NONE, NEG, and POS. When enabled via "tmsh modify sys db dos.ipint.sp_endpoint.enabled value true" (requires TMM restart), if a subscriber connects to a blocked endpoint, it is promoted to POS, allowing traffic through in software, while unsolicited inbound traffic is still dropped. This feature is disabled by default and requires opt-in

- SPVA Programming Rate Gate: A configurable per-source rate threshold for SPVA hardware shun programming is introduced, controlled by "tmsh modify sys db dos.ipint.spva.global.program_rate value <N>". When set to N (pps), hardware shun is programmed only if the source packet rate meets or exceeds N packets per second. The default value of 0 maintains existing behavior of immediate HW programming

Fixed Versions:
21.0.0.3

2221781-1 : The DOS process utilizes CPU resources during configuration updates that are unrelated to its operation.

Links to More Info: BT2221781

Component: Application Security Manager

Symptoms:
The dosl7d process consumes high CPU resources during config updates that are unrelated to its operation.

Conditions:
- ASM provisioned
- Configuration update
- Verify CPU consumption of dosl7d

Impact:
The dosl7d process unnecessarily consumes CPU resources.

Workaround:
None.

Fix:
Fixed dosl7d to avoid internal locking during unrelated config updates.

Fixed Versions:
17.5.1.6, 17.1.3.2

2221689-3 : TMSH hardening

Links to More Info: K000161022, BT2221689

2221517-1 : BIG-IP SCP hardening

Links to More Info: K000160971

2221493-1 : SCP Improvement

Links to More Info: K000160971, BT2221493

2221445-1 : Improving scripts of Failover

Links to More Info: K000160972, BT2221445

2221413-1 : SCP Improvement

Links to More Info: K000160971, BT2221413

2221177-3 : Big3d cannot validate certificates after they are renewed

Links to More Info: K000159906, BT2221177

Component: Global Traffic Manager (DNS)

Symptoms:
After renewing your big3d certificates, LTM virtual servers become unavailable in GTM, and the bigip_add command starts failing.

Logs in /varl/og/ltm

"big3d SSL cert EXPIRED at IP <IP_ADDRESS>"
"SSL error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed"
"SSL error:14094413:SSL routines:ssl3_read_bytes:sslv3 alert unsupported certificate"

Conditions:
-- BIG-IP DNS (GTM) and LC
-- A Public CA is used to sign the certificates used by big3d

Impact:
Big3d fails to verify the new certificate.

Note: This can also occur if you use a public CA to sign the device certificate used for high availability.

Workaround:
Follow the worksteps described in K000159906: BIG-IP GTM/DNS iQuery Connection Failure Due to Missing Extended Key Usage (EKU) Extensions in Device Certificates, available at https://my.f5.com/manage/s/article/K000159906

Fix:
Both `gtmd` and `big3d` traditionally use the device certificate for mutual TLS connections. This works if the certificate supports both client and server authentication or lacks extended key usage.

If the device certificate is limited to server authentication, configure a client certificate using DB variables `gtm.ssl.crt` and `gtm.ssl.key`. Once set, `gtmd` immediately uses the new certificates, and the `gtm_add` script exchanges them for TLS connections.

Updating the DB variables while in a sync group breaks existing TLS connections. Restore trust using `bigip_add`, `big3d_install`, or manually installing the client certificate as trusted on remote devices.

Fixed Versions:
17.5.1.6, 17.1.3.2

2221169-3 : iControl REST Hardening

Links to More Info: K000160903, BT2221169

2221161-3 : TMSH hardening

Links to More Info: K000161018, BT2221161

2221017-3 : The BIG-IP virtio driver may core during startup

Links to More Info: BT2221017

Component: Local Traffic Manager

Symptoms:
If a failure occurs in the BIG-IP's virtio driver during startup, it may core when attempting to modify statistics that have not yet been initialized.

Conditions:
-- Virtio driver in use.
-- BIG-IP is starting up.
-- An error occurs that is tracked by a statistic.

Impact:
TMM cores and restarts.

Fixed Versions:
21.0.0.3, 17.5.1.6

2220389-1 : Enabling tm.ipv4dagfrag results in tmm not ready for world on a cluster with more than 4 blades

Links to More Info: BT2220389

Component: TMOS

Symptoms:
If tm.ipv4dagfrag is enabled on a multi slot system, tmm on all blades may not fully start up.

Conditions:
-- F5OS tenant or chassis with more than 4 blades.
- -tm.ipv4dagfrag enabled

Impact:
-- tmsh show sys cluster will show "TMM not ready"
-- The affected blades will not pass traffic

Workaround:
Disable tm.ipv4dagfrag

Fixed Versions:
17.5.1.6, 17.1.3.2

2220369-1 : BIG-IP GUI/API Improvements

Links to More Info: K000160874, BT2220369

2219929-2 : Tmm running in Hyper-V environments might not receive multicast traffic

Links to More Info: BT2219929

Component: Local Traffic Manager

Symptoms:
Multicast is being sent towards the BIG-IP, but a capture on the BIG-IP does not show multicast packets arriving.

Conditions:
BIG-IP running on Hyper-V using the dpdk driver:

The interface is using the xnet driver:
# tmctl -d blade tmm/device_probed
pci_bdf pseudo_name type available_drivers driver_in_use
------------ ----------- --------- ----------------- -------------
0000:00:e1.0 1.1 F5DEV_PCI xnet, sock, xnet

And the xnet driver is using the dpdk driver:
# tmctl -d blade tmm/xnet/device_probed
id available_drivers driver_selected driver_in_use
------ ----------------- --------------- -------------
{UUID} sock, dpdk, dpdk Yes

Impact:
Tmm does not see multicast packets. If the BIG-IP us using IPv6, this will cause IPv6 neighbor discovery to fail for addresses on the BIG-IP.

It can also impact other multicast based traffic.

Workaround:
Switch to the sock driver: https://my.f5.com/manage/s/article/K000153024

Fixed Versions:
17.5.1.6

2219801-2 : Visual Policy Editor AD group search is limited to current page

Links to More Info: BT2219801

Component: Access Policy Manager

Symptoms:
The Search in AD Groups in the Visual Policy Editor is limited to the current page instead of a global search

Conditions:
1. Access Policy -> Edit
2. AD Groups Resource Assign -> Add new entry -> edit
3. Have multiple pages of AD groups

Impact:
Won't be able to search among AD Groups spanning multiple pages

Workaround:
None

Fixed Versions:
17.5.1.6

2219381-1 : TMSH improvement

Links to More Info: K000161040, BT2219381

2219173-1 : TMSH improvements

Links to More Info: K000160975, BT2219173

2219081-1 : Live Update configuration sync failure in HA setup

Links to More Info: BT2219081

Component: Application Security Manager

Symptoms:
The Live Update log records a YamlReader error for full_sync_asm-live-update, causing the Live Update configuration sync to fail.

Conditions:
The Live Update log shows a YamlReader error for the full_sync_asm-live-update file.

Impact:
Some servers in the HA setup may have incorrect Live Update configurations.

Workaround:
N/A

Fix:
Live Update sync process uses simplified YAML file

Fixed Versions:
17.5.1.6, 17.1.3.2

2219053-1 : CVE-2025-13878: Malformed BRID/HHIT records can cause named to terminate unexpectedly

Component: Global Traffic Manager (DNS)

Symptoms:
Malformed BRID/HHIT records can cause `named` to terminate unexpectedly. This issue affects BIND 9 versions 9.18.40 through 9.18.43, 9.20.13 through 9.20.17, 9.21.12 through 9.21.16, 9.18.40-S1 through 9.18.43-S1, and 9.20.13-S1 through 9.20.17-S1.

Conditions:
Triggered by specially crafted or malicious DNS queries.

Impact:
Potential denial of service (DoS) for DNS services.

Workaround:
None

Fix:
Upgraded BIND to a patched version that resolves CVE-2025-13878.

Fixed Versions:
17.5.1.6, 17.1.3.2

2218309-5 : CVE-2025-22026 kernel: nfsd: don't ignore the return code of svc_proc_register()

Links to More Info: K000160079

2217485-1 : TMSH Improvements

Links to More Info: K000161107, BT2217485

2217445-1 : GTM Virtual Server can be deleted while referenced by GTM Pools

Links to More Info: BT2217445

Component: Global Traffic Manager (DNS)

Symptoms:
A GTM virtual server object can be deleted even if it is referenced by GTM pools. Deleting the server will also remove it from the associated pool members without any warning.

Conditions:
Occurs when a GTM virtual server is referenced in one or more GTM pools.

Impact:
This may cause unexpected behavior or service disruption if the server is deleted while still in use.

Workaround:
None.

Fix:
A validation check has been added to prevent deletion of a GTM virtual server that is referenced by GTM pools, and a warning is now displayed to the user. This behavior is controlled by the DB variable gtm.gtmserverdeletevalidation, which is disabled by default and must be enabled to enforce the deletion restriction.

Fixed Versions:
17.5.1.6, 17.1.3.2

2216645-1 : UCS Backup Improvements

Links to More Info: K000160857, BT2216645

2213605-1 : "Live Update" ASU File Listed as Not Installed After Successful Scheduled Installation

Links to More Info: BT2213605

Component: Application Security Manager

Symptoms:
The "Live Update" ASU file appears with a "Pending" status in the GUI, even though it was successfully downloaded and installed.

Conditions:
Installations run in "Scheduled" mode

Impact:
The system provides incorrect reporting on the installation status of the latest "Live Update" ASU file.

Workaround:
Click on "Install" button for latest "Pending" ASU file

Fixed Versions:
17.5.1.6, 17.1.3.2

2208913 : iControl SOAP hardening

Links to More Info: K000160973, BT2208913

2208709-1 : Failure to match specific WAF signatures

Links to More Info: BT2208709

Component: Application Security Manager

Symptoms:
A signature is not matched as expected.

Conditions:
Specific configuration and traffic.

Impact:
A false negative on a specific scenario.

Workaround:
None.

Fixed Versions:
17.5.1.6, 17.1.3.2

2202281-1 : Primary Admin DB Change to Non-Existing User Results in Admin User Lockout

Links to More Info: BT2202281

Component: TMOS

Symptoms:
When the `systemauth.primaryadminuser` value is changed to a non-existing user, the primary admin value is updated to the non-existing user, resulting in an admin user lockout scenario.

Conditions:
When a user does not existing in the system and primary admin value is changed to non existing user value.

Impact:
-- The admin user becomes disabled, logged out of TMUI and TMSH, and is unable to log back in.
-- If the root account login is also disabled, both the root and admin users are logged out of the system.

Workaround:
None

Fix:
When the primary admin DB is udated below operations takes place; in case of failure to update sys db these will get rollbacked.

-> Writes localusers file
-> Writes URP file
-> Clears PAM cache
-> Writes f5_public file

Fixed Versions:
17.5.1.6, 17.1.3.2

2202097-1 : Apply limitations on certain object creation

Links to More Info: K000160916, BT2202097

2201965-1 : TMSH improvement

Links to More Info: K000160863, BT2201965

2201877-3 : SCTP multihoming fails with ICMP unreachable for alternate paths.

Links to More Info: BT2201877

Component: TMOS

Symptoms:
SCTP multihoming fails with ICMP protocol unreachable for alternate paths.

Conditions:
- SCTP profile with multihoming and alternate addresses configured.
- Alternate address is a self-ip configured on a system.

Impact:
Unable to establish alternate path connection.

Workaround:
None

2201813-1 : BIG-IP enforces maximum concurrent streams limit immediately over HTTP/2 connection

Links to More Info: BT2201813

Component: Local Traffic Manager

Symptoms:
BIG-IP negotiates a number of concurrent streams over HTTP/2 connection per RFC requirement. It immediately enforces this limitation once the protocol is agreed and first SETTINGS frame is issued.

Conditions:
-- BIG-IP virtual server with a http2 profile.
-- A client connects to the virtual server and negotiates or starts HTTP/2 connection.

Impact:
The client may send more requests than the limit set by BIG-IP over the established HTTP/2 connection and it causes the BIG-IP system to reset the extra streams. If Reset Stream Protection is enabled, it may result in the connection being shutdown by the BIG-IP system.

Workaround:
None.

Fix:
BIG-IP no longer sends RST_STREAM frames when the number of streams exceeded the configured limit until SETTINGS/ACK is received to designate the honoring of the the limit by BIG-IP peer.

Behavior Change:
On initial period until SETTINGS/ACK frame is arrived from the peer, TMM follows HTTP/2 RFC and assumes "unlimited" number of concurrent streams rather than enforcing the configured limit right away. If SETTINGS/ACK is not received, the timeout of 1 (one) seconds is used to start the stream concurrency enforcement. Until the enforcement starts, TMM queues stream-specific frames and "softly" enforces the limit to the configured one, allowing 128 frames and 128K of frame body (frame->length) at most.

2201789-4 : TMSH improvements

Links to More Info: K000160975, BT2201789

2201769-1 : TMSH improvements

Links to More Info: K000160975, BT2201769

2201745-1 : TMSH improvements

Links to More Info: K000160975, BT2201745

2201725-1 : TMSH improvements

Links to More Info: K000160975, BT2201725

2201697-1 : TMSH improvements

Links to More Info: K000160975, BT2201697

2201693-3 : Empty Detected Value Length for Parameters with Empty Values

Links to More Info: BT2201693

Component: Application Security Manager

Symptoms:
When a request contains a parameter with a zero-length value, the system fails to recognize it as having zero length and instead displays the parameter as having an empty value.

Conditions:
Using GUI with "Illegal parameter value length" violation

Impact:
GUI displays parameter length with an empty value when the parameter has zero length

Workaround:
Modify checking the parameter length also for zero length

Fix:
Modified the condition logic to use <= instead of < when comparing parameter lengths, ensuring zero-length values are correctly set

Fixed Versions:
17.5.1.6, 17.1.3.2

2201377-1 : iControl REST improvements

Links to More Info: K000160979, BT2201377

2200561-1 : Repeated MCPD service crashes

Links to More Info: BT2200561

Component: TMOS

Symptoms:
Repeated restarts of the MCPD service in a high availability setup occur when a modified object is deleted within the same transaction

Conditions:
When a modified object is deleted, it causes the MCPD service to restart due to a software issue

Impact:
Restart of the MCPD service indicates that the data path is disrupted due to a TMM restart, which was triggered by the MCPD crash

Workaround:
There is no alternative except to update to a software version that includes the fix

Fix:
Do not modify the deleted object within the same transaction

2200537-2 : Audio captcha script error

Links to More Info: BT2200537

Component: Application Security Manager

Symptoms:
A script error in audio captcha on specific browsers

Conditions:
-- Audio captcha is required.
-- The user is using Internet Explorer on Windows 11

Impact:
Error in the captcha page. Unable to use captcha causing client side enforcement to fail.

Workaround:
None

Fixed Versions:
21.0.0.3

2200437-1 : SNMP Improvement

Links to More Info: K000160981, BT2200437

2200421-1 : SNMP Improvement

Links to More Info: K000160981, BT2200421

2200209-2 : Support NVMe-based disk (newer generation instance families)

Links to More Info: BT2200209

Component: TMOS

Symptoms:
The newer generation of instance families were not being supported for BIG IP Images

Conditions:
All prior versions of BIG-IP that did not have the NVMe Support flag set

Impact:
Enabling the NVMe support flag enhances disk I/O performance and ensures compatibility with modern Alibaba Cloud instance types, which utilize NVMe devices for disk exposure. This adjustment modifies the way block devices are identified and accessed at the operating system level.

Workaround:
Save the image as a custom image and set the NVMe support flag to yes

Fix:
Newer images are being published with the relevant flag turned on

Fixed Versions:
17.5.1.6, 17.1.3.2

2200053-2 : Virtual interfaces inside the F5OS tenant are going into 'uninit' state

Links to More Info: BT2200053

Component: TMOS

Symptoms:
Some virtual network interfaces were stuck in the “uninit” state on the active BIG-IP tenant.

Conditions:
-- F5 CX1610 chassis with BX520 blade
-- Reboot the standby BIG-IP device first, then wait for one minute and reboot the active BIG-IP device.

Impact:
Virtual interfaces can get stuck in the "uninit" state.

Workaround:
None.

Fixed Versions:
21.0.0.3

2200009-1 : PEM HA failover may cause traffic drops for new connections

Links to More Info: BT2200009

Component: Policy Enforcement Manager

Symptoms:
All traffic belonging to some connections established to the new Active unit immediately after a failover between PEM units could be dropped.

Conditions:
- PEM units in HA pair.

- New connections established to the new Active unit immediately after a failover.

Impact:
All traffic belonging to new connections established immediately after a failover could be dropped.

Workaround:
None

Fixed Versions:
17.5.1.6, 17.1.3.2

2199485-3 : Export and re-import of a security policy in XML format fails due to invalid 'openapi-array' user_input_format value

Links to More Info: BT2199485

Component: Application Security Manager

Symptoms:
Import fails with error: Field 'parameter/user_input_format' may not contain the value 'openapi-array'.

Conditions:
URL level parameter configured with Parameter value type: User-input value and Data type: URI

Impact:
Import of security policy in XML format fails.

Workaround:
Manually change user_input_format from openapi-array to uri in the xml file before importing.

Fixed Versions:
17.5.1.6, 17.1.3.2

2198757-3 : PEM: use-after-free of mw_msg in session_del_msg_entries hash

Links to More Info: BT2198757

Component: Policy Enforcement Manager

Symptoms:
There is a rare scenario where tmm crashes while passing PEM traffic.

Conditions:
-- PEM is licensed and enabled.
-- Policies are assigned from the PCRF. Subscriber additions and deletions are happening regularly.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None.

Fix:
The delayed response or timeout of the request is now handled gracefully.

Fixed Versions:
17.5.1.6, 17.1.3.2

2198721-1 : SAML apmd memory leak

Links to More Info: BT2198721

Component: Access Policy Manager

Symptoms:
Apmd process will leak memory when configured with SAML authentication.

Conditions:
APM configured with SAML
Any BIG-IP version >= 17.1.0

Impact:
BIG-IP can run out of memory and some services killed to release memory.

Workaround:
None

Fixed Versions:
21.0.0.3

2198661-1 : Resource administrator not working as expected

Links to More Info: BT2198661

Component: TMOS

Symptoms:
The resource administrator user role is not working as expected

Conditions:
NA

Impact:
Unexpected behaviour

Workaround:
None

Fix:
Resource administrator user is now working as expected.

Fixed Versions:
17.5.1.6, 17.1.3.2

2197377-1 : TMM crashes under specific traffic.

Links to More Info: K000160945, BT2197377

2197173-1 : Insufficient sanitization in SNMP configuration

Links to More Info: K000160926, BT2197173

2196761-1 : TMM core found while doing DAG and SP DAG related tests

Links to More Info: BT2196761

Component: TMOS

Symptoms:
TMM crashes and restarts.

Conditions:
In an F5OS multi-slot tenant environment, during boot-up after a tmsh reboot slot all or upgrading to a new volume, a switch of the primary slot can occur between the slots due to slot readiness states. If tmm sends a shared_random_data message before receiving the updated primary slot ID from mcpd, it might use the previous primary slot ID, resulting in a data mismatch and causing tmm to crash and restart.

Note: This issue occurs very rarely as it depends on a race condition.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None.

Fix:
The issue has been fixed by skipping the setting of shared random data when this race condition occurs. The operation will be retried after TMM receives the primary slot change notification.

Fixed Versions:
17.5.1.6, 17.1.3.2

2195809-2 : Xnet driver prevents TMM from starting

Component: Local Traffic Manager

Symptoms:
TMM does not start up and stays in INOPERATIVE

Conditions:
- BIG-IP VE edition
- xnet driver being used

Impact:
TMM does not start up

Workaround:
Switch to sock driver

Fix:
Fixed root cause within xnet driver

Fixed Versions:
17.5.1.4

2190373-1 : Platform_agent core found while tmstats updation.

Links to More Info: BT2190373

Component: F5OS Messaging Agent

Symptoms:
Platform agent crashes and restarts.

Conditions:
-- VELOS platforms with BX510 blades
-- Platform agent startup

Impact:
Platform agent crashes and successfully restarts. No functionality impact.

Workaround:
None.

Fix:
Issue fixed so that stats updation happens correctly without crashing, variable properly managed.

Fixed Versions:
17.5.1.3, 17.1.3.2

2189993 : Upgrade from 17.5.1.3 to 21.0.0 and the config failed to load with error:01071197:3: Metacharacter '*' must be at end of the session variable name★

Links to More Info: BT2189993

Component: TMOS

Symptoms:
When upgrading BIG-IP Virtual Edition from 17.5.1.3 to 21.0.0, a configuration load error occurs:

01071197:3: Metacharacter '*' must be at end of the session variable name.
Unexpected Error: Loading configuration process failed.

Conditions:
-- APM provisioned and configured

Impact:
You are unable to complete the upgrade from v17.5.1.3 to v21.0.0

Workaround:
None

Fixed Versions:
21.0.0.3

2187529-3 : CVE-2025-12818: postgresql: libpq undersizes allocations, via integer wraparound

Links to More Info: K000160291, BT2187529

2187385-3 : Brute force set to CAPTCHA also raises a violation and blocks traffic

Links to More Info: BT2187385

Component: Application Security Manager

Symptoms:
Brute force is raised, but the config is set to CAPTCHA. Brute force contributes to the violation rating, and traffic is blocked by the violation rating, instead of triggering a CAPTCHA.

Conditions:
Brute force and violation Rating threat detected are both enabled.

Impact:
CAPTCHA does not occur as expected.

Workaround:
None

Fixed Versions:
17.5.1.6, 17.1.3.2

2187365 : BIG-IP v21.0.0 VE or F5OS tenant remains INOPERATIVE after cold boot

Links to More Info: BT2187365

Component: TMOS

Symptoms:
BIG-IP VE or F5OS tenant fails to reach an operational state after cold boot. For example, after stopping and starting the VM, or power cycling the rSeries appliance.

A message similar to the following is observed in /var/log/ltm:

err mcpd[983]: 01070596:3: An unexpected failure has occurred, Can't load structure (global_sync_status.sync_status) status:52 transaction: 2, status: 52 - EdbStructData.cpp, line 39, exiting...

Conditions:
- BIG-IP VE or F5OS tenant running TMOS v21.0.0
- Cold boot of the BIG-IP VE or F5OS tenant
- First startup of the BIG-IP VE or F5OS tenant ("cold boot")

Impact:
- MCPD starts but never becomes ready; the system remains INOPERATIVE
- ecmd CPU utilization is elevated
- Configuration management and control-plane services are unavailable due to MCPD not becoming ready
- High CPU utilization by ecmd can impact overall system stability and resource availability

Workaround:
From bash, delete the /var/db/mcpdb.bin and /var/db/mcpd.info files and reboot the BIG-IP VE or F5OS tenant:

rm -fv /var/db/mcpdb.bin /var/db/mcpdb.info
reboot

MCPD will perform a full configuration load on the next startup and the system will return to operation.

Note: In some cases the workaround may need to be applied more than once before a successful startup and configuration load will occur.

Fixed Versions:
21.0.0.1

2187185-1 : BIG-IP v21.0 REST framework incorrectly processes Content-Range in HTTP GET requests

Links to More Info: BT2187185

Component: Device Management

Symptoms:
On BIG-IP v21.0, REST-based file download requests may fail with errors such as “attempt to read past end of file” when the client includes a Content-Range header in an HTTP GET request. This occurs when the specified byte range exceeds the actual size of the requested file.

The failure is triggered by the BIG-IP REST framework incorrectly attempting to process the Content-Range header for GET requests, resulting in an invalid file offset calculation and an EOF read condition. As a result, the REST request is terminated and the file download does not complete.

Conditions:
HTTP GET request includes a Content-Range header

The byte range specified in Content-Range exceeds the actual size of the requested file

Impact:
REST-based file downloads fail unexpectedly

Workaround:
Determine the actual size of the target file and ensure that any Content-Range header sent by the client specifies a byte range that does not exceed the file length.

Alternatively, remove the Content-Range header entirely from HTTP GET requests, as it is not required and may cause request failures.

2186897-3 : TMM core SIGSEVG upon replacing L7 DOS policy

Links to More Info: BT2186897

Component: Anomaly Detection Services

Symptoms:
On rare cases of expired connection, tmm can crash.

Conditions:
BADOS L7 configured
Replacing DOS policy under traffic

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

Fix:
TMM does not crash upon replacing L7 DOS policy.

Fixed Versions:
21.0.0.1, 17.5.1.4, 17.1.3.1

2186153-6 : CVE-2025-8194 cpython: Cpython infinite loop when parsing a tarfile

Component: TMOS

Symptoms:
A flaw was found in the Python tarfile module. Processing a specially crafted tar archive, specifically an archive with negative offsets, can cause an infinite loop and deadlock. This issue results in a denial of service in the Python application using the tarfile module.

Conditions:
The application uses the Python tarfile module to process an attacker-supplied malicious tar archive containing negative offsets.

Impact:
It can cause an infinite loop leading to application hang or denial of service.

Workaround:
Update to a patched Python version and avoid processing untrusted tar archives, or validate archives before extraction

Fix:
Upgrade to a Python version that includes the tarfile module fix for this issue.

Fixed Versions:
21.0.0.1, 17.5.1.4, 17.1.3.1

2186009-2 : Increased TX IQ size for netvsc

Links to More Info: BT2186009

Component: TMOS

Symptoms:
In some environments, during periods of high traffic, messages could build up in the TX internal queue due to xnet-DPDK being slow to inform that messages were sent. If this goes for long enough, the internal queue will fill up and become stuck.

Conditions:
1) Using xnet-DPDK driver
2) Azure or Hyper-V
3) Sustained high (multi-GB/s) traffic rate

Impact:
Internal queue gets stuck preventing BIG-IP from being able to send messages and causing traffic disruption.

Workaround:
Create '/config/tmm_init.tcl' and add the following line
  ndal tx_iq_sz 1024 f5f5:f550

Afterwards, restart tmm with 'bigstart restart tmm' to apply change.

Fix:
Increased default size of TX IQ when netvsc driver is being used

Fixed Versions:
17.5.1.6

2185485-1 : The value of /proc/sys/vm/min_free_kbytes might be too big on Hyper-V and Azure VEs with multiple cores and multiple NICs★

Links to More Info: BT2185485

Component: TMOS

Symptoms:
After a software upgrade to one of the affected versions, the value of /proc/sys/vm/min_free_kbytes might too big on Hyper-V and Azure VEs with multiple cores and multiple NICs.

This can prevent the Virtual Edition from booting into the new software volume installed with one of the affected versions.

Conditions:
BIG-IP VE running on Hyper-V hypervisor or on Azure with:
- more than 4 cores and more than 4 NICs configured
- 16GB of RAM or less allocated

Attempt to upgrade to one of the affected versions.

Impact:
After an upgrade to one of the affected versions, the BIG-IP VE boot process hangs, or the VE takes hours to boot into the new volume and is so slow to result unusable.

Workaround:
There are two possible workarounds:


(1)
Before booting into the new volume, shutdown the VE and increase the total allocated RAM to 32GB.


(2)
- Install the new software volume.

- Take note of the current value <KBYTES> of /proc/sys/vm/min_free_kbyte :

# cat /proc/sys/vm/min_free_kbyte

- Before rebooting into the new software volume, mount the "vg--db--vda-set.<N>.root" disk volume on a temporary directory, where <N> is the number of the new volume after the dot.
E.G.: if the new volume is "HD1.2", then <N> is 2.

# mkdir /mnt/temp
# mount /dev/mapper/vg--db--vda-set.<N>.root /mnt/temp/

- Edit the /etc/rc.sysinit.f5 file:

# vi /mnt/temp/etc/rc.sysinit.f5

- Replace this line:

        echo $VADC_MIN_FREE_KB > /proc/sys/vm/min_free_kbytes

with this line (use the <KBYTES> value noted before):

        echo <KBYTES> > /proc/sys/vm/min_free_kbytes

- Unmount the disk volume:

# umount /mnt/temp/

- Reboot into the new software volume

Fixed Versions:
17.5.1.6

2184897-2 : Tenant disk size modification is ineffective for var/log folder

Links to More Info: BT2184897

Component: TMOS

Symptoms:
Due to insufficient free disk space on the VM, the /var/log resize operation could not be applied on reboot.

Conditions:
When available disk space on the VM is insufficient for the requested directory resizing.

Impact:
You will not know if resizing will succeed/fail ahead of time.

Workaround:
Manually calculate and allocate disk space within the range of available disk space.

Fix:
Improved validation has been added for directory resize operations. If the available disk space is less than the requested size, the command now fails immediately with a clear error message, allowing users to identify resize issues at the time of requesting.

Fixed Versions:
21.0.0.1, 17.5.1.3, 17.1.3.1

2183705-1 : Improper access control on SMTP

Links to More Info: K000156643, BT2183705

Component: Application Visibility and Reporting

Symptoms:
Security best practices are not being followed for SMTP in BIGIP.

Conditions:
NA

Impact:
Unexpected behaviour

Fix:
Security best practices are being followed.

Fixed Versions:
21.0.0.1, 17.5.1.4, 17.1.3.1

2183353-4 : TMM Intel E810 VF driver updates the link state with 1 second delay

Links to More Info: BT2183353

Component: Local Traffic Manager

Symptoms:
TMM gets the old link state from the driver level. It leads to 1 second delay for the link state change.
The problem may also create link flapping messages in /var/log/ltm for the same interface in some conditions:
Sep 17 15:02:22 notice mcpd[7553]: 01b5004a:5: Link: 1.8 is UP
Sep 17 15:02:22 notice mcpd[7553]: 01b5004a:5: Link: 1.2 is UP
Sep 17 15:02:22 notice mcpd[7553]: 01b5004a:5: Link: 1.8 is DOWN
Sep 17 15:02:22 notice mcpd[7553]: 01b5004a:5: Link: 1.2 is DOWN
Sep 17 15:02:22 notice mcpd[7553]: 01b5004a:5: Link: 1.8 is UP

Conditions:
- The interface link state is changed.
- Multiple VFs of the same physical interface are attached to BIG-IP VE.

Impact:
Link state is updated with a delay.

Workaround:
None

Fix:
TMM correctly get the link state from the driver layer.

Fixed Versions:
17.5.1.4, 17.1.3.1

2182357-3 : Inconsistent Default Source Address Selection for Virtual Server Between POST and PUT Requests

Links to More Info: BT2182357

Component: TMOS

Symptoms:
When a PUT request is made without specifying a source address, the system defaults to an IPv6 address (::). If the destination address is IPv4, this causes a validation error due to the mismatch between the source and destination address types.

Conditions:
A PUT request issued without a source address, having the destination address IPv4
The system attempts to apply a default IPv6 source address

Impact:
The request fails with an address type mismatch error, requiring users to specify a compatible source address. This inconsistency between POST and PUT operations may cause confusion for users.

Workaround:
Explicitly specify a source address that matches the type (IPv4 or IPv6) of the destination address in the request payload.

Fix:
The behavior of PUT requests has been updated to match that of POST requests. If a source address is not specified, the system now selects an appropriate default (IPv4 or IPv6) based on the destination address, ensuring consistency and avoiding address type mismatch errors.

Fixed Versions:
17.5.1.6, 17.1.3.2

2182045-3 : The iavf driver might drop some IPv6 packets that contain destination option or routing type 2 headers

Links to More Info: BT2182045

Component: Local Traffic Manager

Symptoms:
Some IPv6 packets that contain a destination option header and/or a routing type 2 header are processed by the BIG-IP.

A tcpdump on the BIG-IP does not show the packets.

The tmm/xnet_rx_stats:cd_empty stat is incremented
The tmm/xnet/iavf/per_q_stats:rx_sw_drop might be incremented.

Conditions:
A platform that utilizes the iavf driver:
  R2800
  R4800
  VE with SR-IOV with an Intel 810 NIC

IPv6 traffic is sent to the BIG-IP that contains a destination option or routing type 2 header.

Impact:
Packets are dropped and not processed.

Workaround:
None

Fixed Versions:
17.5.1.6, 17.1.3.1

2179729-1 : MCPD memory leaks during repetitive configuration create/modify/delete cycles combined with ongoing config-sync activity.

Links to More Info: BT2179729

Component: TMOS

Symptoms:
The eXtremeDB configuration database grows continuously over time in long‑duration testing, even when objects are deleted.

Conditions:
-- Long duration run with create, modify, delete configuration objects.
-- High Availability (HA) enabled

Impact:
MCPD memory becomes very large on lab HA devices.

Workaround:
None

Fixed Versions:
21.0.0.1

2173429-2 : Digest and NTLM Authorizations Not Functioning

Links to More Info: BT2173429

Component: Application Security Manager

Symptoms:
-- Bruteforce violations are not raised for NTLM or Digest authorization types.

Conditions:
-- Bruteforce with NTLM or Digest authorization enabled

Impact:
-- Bruteforce enforcement is not happening for Digest and NTLM Authorization types

Workaround:
None

Fix:
Digest and NTLM authorizations work as expected

Fixed Versions:
17.5.1.6, 17.1.3.2

2171845-3 : Manual Sync in Sync-Failover device group may result in differences in attached Logging Profiles on virtual server

Links to More Info: BT2171845

Component: TMOS

Symptoms:
Devices show "In Sync" but have different logging profiles attached to the same Virtual Server.

Conditions:
- Manual with Incremental sync or Manual with Full sync in sync and overwrite scenario

Impact:
Discrepancy in attached logging profiles on the Virtual Server across HA devices.

Workaround:
Manually align logging profiles

Fixed Versions:
17.5.1.6, 17.1.3.2

2163777-3 : Tmm core on fw_nat_classify() while nat rule configuration is being changed

Links to More Info: BT2163777

Component: Advanced Firewall Manager

Symptoms:
TMM may crash with a segmentation fault in fw_nat_classify() during NAT rule configuration changes, causing service disruption.

Conditions:
Occurs during NAT rule delete configuration modification

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

Fixed Versions:
17.5.1.6, 17.1.3.2

2163585-1 : Migration fails "Spanning Tree Protocol (STP) is not supported on this platform"

Links to More Info: BT2163585

Component: TMOS

Symptoms:
Migration fails due to "Spanning Tree Protocol (STP) is not supported on this platform".
STP is a configuration for physical interfaces; F5OS tenants use interfaces/vlans defined in the F5OS underlying operating system.

Conditions:
migration to F5OS tenant from bare-metal BIG-IP with STP configured (e.g. from iSeries bare-metal to F5OS tenant).

Impact:
migration fails with:
010713d0:3: Symmetric Unit Key decrypt failure - decrypt failure
Unexpected Error: Loading configuration process failed.

/var/log/ltm shows:
Dec 2 13:55:11 localhost.localdomain err mcpd[7147]: 010713d0:3: Symmetric Unit Key decrypt failure - decrypt failure
...
Dec 2 13:55:14 localhost. localdomain err mcpd[7147]: 01070686:3: Spanning Tree Protocol (STP) is not supported on this platform.
Dec 2 13:55:14 localhost.localdomain err tmsh[20673]: 01420006:3: Loading configuration process failed.
Dec 2 13:55:14 localhost.localdomain emerg load_config_files[20656]: "/usr/bin/tmsh -n -g -a load sys config partitions all platform-migrate" - failed. -- Loading schema version: <BIG-IP-version>

Workaround:
Modify the "net stp-globals" object to not contain "mode" stp/mstp/rstp

Fix:
STP configuration is removed during the migration to F5OS tenant.

Fixed Versions:
21.0.0.1

2162937 : TMM crash when AFM is enabled

Links to More Info: BT2162937

Component: Advanced Firewall Manager

Symptoms:
The BIG-IP system experiences repeated TMM crashes when handling DNS DoS traffic.

Conditions:
This issue occurs on BIG-IP AFM version 21.0.0 with DNS DoS

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

Fix:
Handled malformed packets.

Fixed Versions:
21.0.0.1

2162905-2 : AFM GUI does not display Port List members in Properties panel

Links to More Info: BT2162905

Component: Advanced Firewall Manager

Symptoms:
AFM GUI fails to display port-list members in the Properties pane

Conditions:
Occurs when viewing any Port List object in the AFM Policy Editor GUI

Impact:
Administrators cannot visually verify port-list contents in the GUI

Workaround:
Tmsh list security firewall port-list <port_list_name>

Fixed Versions:
21.0.0.1, 17.5.1.4

2162861-3 : 'Connectors' creation screen does not appear

Links to More Info: BT2162861

Component: Access Policy Manager

Symptoms:
When you click Access > Authentication from the WebUI, select AAA Server By Type > Connectors & Configurations from the pull-down menu, and click the Create button, the creation screen does not appear.

Conditions:
Connectors & Configurations from AAA Server by Type

Impact:
Creation screen does not appear.

Workaround:
None

Fixed Versions:
21.0.0.3, 17.5.1.6

2162849-2 : Removing the active controller does not trigger an immediate tenant failover

Links to More Info: BT2162849

Component: TMOS

Symptoms:
When a system controller is removed from a VELOS chassis, any Active BIG-IP tenants running from that controller do not automatically fail over.

Conditions:
-- BIG-IP Tenant is active for a traffic group
-- The BIG-IP tenant is running on a controller that is active for the partition on which the tenant is running
-- The Active system controller is removed or powered off using AOM

Impact:
Tenant failover is delayed by up to 4 minutes when an active system controller of the active tenant is pulled out .

Workaround:
None

Fixed Versions:
21.0.0.1, 17.5.1.4, 17.1.3.2

2162801 : MCP hung during shutdown when any exception/ abnormal restart while booting up

Links to More Info: BT2162801

Component: TMOS

Symptoms:
The MCP would hang during shutdown if any exceptions or abnormal restarts occurred while booting up.

Conditions:
Rarely getting this, so there is no specific scenario

Impact:
MCPD will not be up and running

Workaround:
MCPD restart

Fix:
Make sure it kills the proper PID while rebooting.

Fixed Versions:
21.0.0.1

2162705-2 : Tmm restarting on multi-NUMA AWS instances with ENA interfaces★

Links to More Info: BT2162705

Component: Local Traffic Manager

Symptoms:
Tmm is in the restart loop because dpdk driver is failing to attach with the error message in tmm log:

notice dpdk: [0000:00:06.0]: Multiple NUMA nodes usage is unsupported.

Conditions:
- BIG-IP VE large instance deployed on AWS cloud.
- NUMA node count more than 1 (check "lscpu | grep NUMA").

Impact:
Unable to use dpdk driver on some large AWS instances.

Workaround:
Switch to sock driver: https://my.f5.com/manage/s/article/K10142141

Fix:
DPDK correctly initializes the memory on multi-NUMA AWS instances.

Fixed Versions:
21.0.0.1, 17.5.1.4

2162589-1 : BD crash with a specific configuration

Links to More Info: K000160727, BT2162589

2162189-3 : "Live Update" reinstalls the genesis ASU file, while the latest ASU file is installed manually★

Links to More Info: BT2162189

Component: Application Security Manager

Symptoms:
When operating in automatic mode, Live Update installs the genesis Automatic Signature Update (ASU) file instead of the manually installed latest ASU file.

Conditions:
Live Update is operating in automatic mode, there are only 2 installations in ASU files installations list, one is genesis file and another is latest ASU file that was published on ESDM.

Impact:
BIG-IP will not install the latest signatures.

Workaround:
Live Update should be switched to manual mode. The latest ASU file should be installed manually again instead of the genesis ASU file. When the newer ASU file is available on ESDM, do not install it manually, but switch Live Update to automatic mode again.

Fixed Versions:
17.5.1.4, 17.1.3.1

2161077-2 : Bot profile properties page does not load when there are large number of SSL certs (> 1000)

Links to More Info: BT2161077

Component: TMOS

Symptoms:
When a large number of SSL certs are present, the Bot Defense profile properties page (Security > Bot Defense > Bot Profile Properties) does not load correctly

Conditions:
- ASM is provisioned
- SSL cert count > 1000

Impact:
Bot Defense profile properties page does not load

Workaround:
Use tmsh to manage the Bot profiles.

Fix:
Increase restjavad memory to 1.3GB after applying the fix and restart restjavad

> tmsh modify sys db provision.restjavad.extramb value 1280
> bigstart restart restjavad

Fixed Versions:
21.0.0.1, 17.5.1.4, 17.1.3.1

2153893-4 : With DNS64 configured, resolution aborts early on the first error response without trying other name servers.

Links to More Info: BT2153893

Component: Global Traffic Manager (DNS)

Symptoms:
When multiple name servers for a zone are known, as soon as one name server responds with an error rcode, resolution is aborted and other name server are not tried.

Conditions:
-- DNS64 is configured.
-- More than one name server is configured for a zone.
-- One name server responds with an error rcode.

Impact:
DNS resolution will intermittently fail. DNS resolution will succeed only if the cache randomly selects a working name server to contact first.

Workaround:
Disable DNS64.

Fixed Versions:
21.0.0.1, 17.5.1.4, 17.1.3.1

2153489-1 : MCPD crash in FolderMgr::validate_deleted_folder_queue due to race condition clearing folder_delete_queue mid-iteration (v21)

Links to More Info: BT2153489

Component: TMOS

Symptoms:
-- System crashes with a segmentation fault during folder deletion operations.

-- Core dump observed in FolderMgr::validate_deleted_folder_queue.

Conditions:
Concurrent Operations

Thread 1 is performing a folder deletion and iterating over folder_delete_queue in FolderMgr::validate_deleted_folder_queue.

Thread 2 is processing a virtual server query and calls AuthZ::current_context (setter), which invokes FolderMgr::reset_deleted_folder_queue().

Impact:
Traffic and management disrupted while mcpd restarts.

Workaround:
None

Fixed Versions:
21.0.0.1

2153425 : MCPD worker core

Links to More Info: BT2153425

Component: TMOS

Symptoms:
MCPD worker core due to a possible double free.

Conditions:
While the main thread is processing the folders, the worker is processing the query and, in doing so, sets the context, which resets the delete folder queue as well. This causes the main thread to access an empty queue and could lead to a crash.

Impact:
MCPD core

Fix:
Make sure the worker is not going to delete folders while handling the folder context

Fixed Versions:
21.0.0.1

2152877-3 : Exclude /opt/CrowdStrike directory from Integrity Test

Links to More Info: BT2152877

Component: TMOS

Symptoms:
CrowdStrike directory needs to be excluded from Integrity Test

Conditions:
CrowdStrike directory not present in Integrity Test exception list

Impact:
System integrity fails after Crowdstrike installation via falcon sensor

Workaround:
None

Fix:
CrowdStrike directory added Integrity Test exclusion

Fixed Versions:
21.0.0.1, 17.5.1.4, 17.1.3.1

2152785-1 : TMM may crash under certain conditions.

Links to More Info: K000159034, BT2152785

2152689-3 : ASM GUI "Failed to load requests" pop-up

Links to More Info: BT2152689

Component: Application Security Manager

Symptoms:
A "Failed to load requests" pop-up appears on the page.

REST framework responds with:
{"code":400,"message":"A valid filename must be supplied"}
This is visible in the log of the web browser's interaction with the BIG-IP UI (.har file).

Conditions:
A user with username that contains a slash i.e. "my＼name"
clicking
on Security -> Event Logs -> Application -> Requests
or Security -> Event Logs -> Bot Defense -> Bot Requests

Impact:
Can't view request details

Workaround:
Do not use '/' in the username

Fixed Versions:
21.0.0.1, 17.5.1.4, 17.1.3.1

2152601 : Repeated restarts of the MCPD service result in a continuous restart loop accompanied by error messages: An unexpected failure has occurred, MCO_ERR_EV_SYN - Synchronous events

Links to More Info: BT2152601

Component: TMOS

Symptoms:
Continuous restart of MCPD accompanied by error messages: An unexpected failure has occurred, MCO_ERR_EV_SYN - Synchronous events.

Conditions:
This occurs after 10 restarts of MCPD service.

Impact:
BIGIP services are impacted as MCPD is down.

Workaround:
Reboot device.

Fix:
This issue is fixed by cleaning up the resource during every MCPD restart.

Fixed Versions:
21.0.0.1

2152545-2 : [APM][SAML] High TMM memory sso_saml leak

Links to More Info: BT2152545

Component: Access Policy Manager

Symptoms:
Tmm crashes due to out of memory while passing SAML-SSO traffic

Conditions:
-- Configure a BIG-IP as SAML-SP with ACS binding.
-- Configure SSO for IDP.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

Fixed Versions:
21.0.0.3

2152445-3 : "Live Update" API is unresponsive after upgrade and recover only after tomcat restart★

Links to More Info: BT2152445

Component: Application Security Manager

Symptoms:
After upgrading BIG-IP, the Live Update GUI displays an empty installation list. Errors are logged in the Tomcat log file. When attempting to refresh the Live Update page, additional errors appear in the Live Update log file.

Conditions:
"Live Update" has very long list of installations of ASU files.

Impact:
After the upgrade, BIG-IP retains the latest signatures that were present before the upgrade. The Live Update feature becomes non-functional until it is restarted.

Workaround:
Before upgrading, shorten ASU file installations by removing old entries. This helps prevent issues. If a problem occurs, restart the Live Update system.

Fixed Versions:
17.5.1.4, 17.1.3.1

2152397-1 : BIG-IP support for f5optics packages built after October 2025★

Links to More Info: BT2152397

Component: TMOS

Symptoms:
-- F5optics v1.0.0 packages released in November 2025 (build 66.0) or later cannot be installed on BIG-IP or BIG-IQ versions released during November 2025 or earlier.
-- If F5optics v1.0.0 packages prior to build 67.0 (January 2026) are included in an Engineering Hotfix, the F5optics v1.0.0 package will not be upgraded successfully.

Conditions:
This may occur under the following conditions:
-- Attempting to install an updated f5optics v1.0.0 package build 66.0 (November 2025) or later, on a BIG-IP or BIG-IQ version released November 2025 or earlier.
-- Installing an Engineering Hotfix containing F5optics v1.0.0 package build 66.0 or earlier.

Impact:
-- You cannot install the latest f5optics v1.0.0 package.
-- You may not be able to update the f5optics v1.0.0 package when included in an Engineering Hotfix.

Workaround:
None

Fix:
F5optics v1.0.0 packages released in November 2025 (build 66.0) or later can now be successfully installed.
F5optics v1.0.0 packages released in January 2026 (build 67.0) or later can now be successfully installed via an Engineering Hotfix.

Behavior Change:
BIG-IP and BIG-IQ releases with this fix will not allow installation of f5optics v1.0.0 packages prior to build 66.0.

Fixed Versions:
17.5.1.6, 17.1.3.2

2152301-2 : After upgrading from version 17.1.2 to 17.5.1.3, the guest-role user is unable to run the command show running-config in TMSH.★

Links to More Info: BT2152301

Component: TMOS

Symptoms:
Guest-role user is unable to run the command show running-config in TMSH.
Executing this command from TMSH results in an error:

"Unexpected Error: Can't display all items, can't get object count from mcpd"

MCPD throws error:

result_message "01070823:3: Read Access Denied: user (myguest) type (HPKE Key)"

Conditions:
Except for all these 4 user roles, all the other user roles (operator, cert manager, app editor...etc) hit the same error.

- admin
- resource-admin
- log-manager
- auditor

Impact:
Unable to show the running config, or use list or list sys commands.

Workaround:
Login with an account with admin access.

Fixed Versions:
17.5.1.4

2152269-8 : Low reputation URIs are found in the URL DB binary

Links to More Info: BT2152269

Component: Access Policy Manager

Symptoms:
Publishing BIG-IQ image to Azure cloud is blocked due to malware scan detecting these low reputed URLs.

Conditions:
When uploading the image on Azure Cloud and these low reputed URLs are detected in malware scanners.

Impact:
No impact on the functionality

Workaround:
None.

Fix:
Low reputation URIs such as che168, cssplay, newliveplayer, tinypic.info referring test code are removed from the product.

Fixed Versions:
21.0.0.1, 21.0.0, 17.5.1.4, 17.1.3.1

2152137-2 : New DB variable ve.ndal.driver.netvsc to provide driver selection for Azure/HyperV deployments

Links to More Info: BT2152137

Component: TMOS

Symptoms:
Starting v17.5.0, data-plane interfaces in BIG-IP VE deployed in HyperV or Azure automatically use the high-speed, user-space "dpdk" as the default driver.

Conditions:
BIG-IP VE deployments on Microsoft Azure or HyperV with multiple interfaces.

Impact:
None

Workaround:
No mitigation needed as this is not a bug.

Fix:
The new DB variable ve.ndal.driver.netvsc is introduced to allow to switch the driver back to sock.

To switch to sock driver:
tmsh modify sys db ve.ndal.driver.netvsc value sock && reboot

To switch back to dpdk driver:
tmsh modify sys db ve.ndal.driver.netvsc value dpdk && reboot

Fixed Versions:
17.5.1.6

2150669-3 : TCP Packet loss after upgrade with AFM provisisoned★

Links to More Info: BT2150669

Component: Advanced Firewall Manager

Symptoms:
After an upgrade, disabled hardware DOS vectors may use old values.

Conditions:
-- F5OS tenant
-- Upgrade
-- AFM provisioned

Impact:
DOS thresholds may be incorrectly set or set too low resulting in packet loss that causes poor throughput.

Workaround:
Disable and re-enable the disabled DOS vectors.


Log into the BIG-IP GUI and navigate to
Security ›› DoS Protection : Device Protection

Filter attack vectors: tcp

click the "Network" text

Enable all the disabled vectors by clicking on the vector name and changing state from "disabled" to "mitigate".

Then disable the vectors by clicking on the vector name and changing state from "mitigate" to "disabled".

Fixed Versions:
17.5.1.6, 17.1.3.2

2150525-1 : Improvements in iControl SOAP

Links to More Info: K000159021, BT2150525

2149253-2 : QUIC connection stalls with early data

Links to More Info: BT2149253

Component: Local Traffic Manager

Symptoms:
When QUIC client connect with early data, connection stalled.

Conditions:
Configure virtual server with quic + client-ssl with Data 0-RTT enabled (w/ anti-replay).

QUIC client connects with existing session and early data.

Impact:
Failed QUIC/HTTP3 connections.

Workaround:
Disable client-ssl Data 0-RTT.

Fix:
Release SSL egress data.

Fixed Versions:
21.0.0.1

2149233-3 : TMM crashes when using SSL

Links to More Info: K000158082, BT2149233

2149197-1 : Rotated Public key used for signature verification of apmclients iso bundle in BIG-IP