967769-6 : During reset of high-speed interfaces, TMMs may mistakenly continue hardware watchdog checks

Links to More Info: BT967769

Component: TMOS

Symptoms:
Tmm crashes and restarts. The following panic message is found in /var/log/tmm:

    notice panic: ../dev/hsb/if_hsb.c:6129: Assertion "HSB lockup, see ltm and tmm log files" failed.

Conditions:
-- Some error or glitch is detected on the high-speed bus (HSB).
-- Software commands a reset of the HSB and interface hardware.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

Fixed Versions:
21.1.0.3, 17.5.1.9

945469-6 : [APM][tmm core detected oauth_send_response in APM Oauth Token generation

Links to More Info: BT945469

Component: Access Policy Manager

Symptoms:
Tmm crashes while passing APM traffic.

Conditions:
OAuth is configured and is used for Token generation.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

Fixed Versions:
21.1.0.1

941961-9 : Upgrading system using WAM TCP profiles may prevent the configuration from loading

Links to More Info: BT941961

Component: TMOS

Symptoms:
If a BIG-IP is on version 13.1.0 through 15.1.x and has profiles in use that use wam-tcp-wan-optimized and/or wam-tcp-lan-optimized as parent profiles, then when the configuration is upgraded to 16.0.0, the configuration fails to load, with an error similar to:

err mcpd[10087]: 01020036:3: The requested parent profile (/Common/wam-tcp-wan-optimized) was not found.

On devices that are provisioned with not just the LTM module this may lead to an out of memory condition as the config load failure prevents memory provisioning completing leaving too little 4KB page (host) memory and too much huge page memory.

If suffering memory pressure then management access to device will be sluggish or not possible.

Conditions:
-- Upgrading from version 13.1.0 through 15.1.x.
-- Using profiles derived from wam-tcp-wan-optimized and/or wam-tcp-lan-optimized.

Impact:
Configuration does not load.

Workaround:
Remove these profiles and adjust the configuration elements that use them accordingly. If it is difficult to work on the device it may be necessary to rollback to earlier version and make changes there. Usually it would be better then to delete newer software volume and reinstall it at which point the modified config will be copied across and installed on newer volume.

Here are two examples:

-- Copy the definition of 'wam-tcp-wan-optimized' from /defaults/wam_base.conf into /config/bigip.conf, and then reload the configuration.

-- Change the references to wam-tcp-wan-optimized to something else in your config file (e.g., tcp-wan-optimized), and then reload the configuration.

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

926417-5 : AFM not using the proper FQDN address information

Links to More Info: BT926417

Component: Advanced Firewall Manager

Symptoms:
Duplicate resolved entries in FQDN address-lists may cause FQDN to use incorrect address information until the next FQDN reload.

Conditions:
Any two FQDN address-lists having entries which DNS resolves to the same IP address present in the configuration, at any point since the last TMM restart/FQDN load.

Impact:
Even after one of the duplicate entries is removed, AFM does not use proper FQDN address information.

Workaround:
Remove the problematic rule and recreate the same rule again
or Remove one of the duplicate addresses, and run "tmsh load security firewall fqdn-entity all" command,
or restart TMM.

Fixed Versions:
21.1.0.1

914493-9 : Protocol Profile (Client) for virtual server is reset to the default profile for that protocol

Links to More Info: BT914493

Component: TMOS

Symptoms:
The GUI page always incorrectly shows that the default protocol profile is selected in a virtual server, even though it is not the actual configured profile

CLI will show the correct information for the virtual server

Conditions:
A virtual server is configured with a non-default protocol profile

Impact:
- The GUI always displays the default protocol profile (e.g., "tcp") regardless of the actual configured value
- The actual tmsh configuration remains correct
- If an administrator clicks "Update" while viewing the incorrect GUI values, the default profile gets pushed to the configuration, silently overwriting the intended setting, along with any other changes being made

Workaround:
No workarounds in the GUI to view the correctly selected profile

CLI will show the correct profile selected

Fixed Versions:
21.1.0.3, 17.5.1.9, 17.1.3.5

905749-9 : imish crash while checking for CLI help string in BGP mode

Links to More Info: BT905749

Component: TMOS

Symptoms:
imish crashes while checking the help strings of '(no) neighbor x.x.x.x fall-over bfd ?' when Border Gateway Protocol (BGP) is configured.

Conditions:
-- Configure BGP.
-- Check for help strings in imish using the '?' (question mark) character in the specific command "neighbour x.x.x.x fall-over bfd ?".

Impact:
imish crash.

Although imish crashes, BGP functionality is not impacted.

Workaround:
Avoid using '?' while entering the command "neighbour x.x.x.x fall-over bfd ?".

Fixed Versions:
21.1.0.3

893801-5 : Launching resources that are published on an APM Webtop from multiple VMware servers will fail when the Native View client is selected

Links to More Info: BT893801

Component: Access Policy Manager

Symptoms:
If APM is configured to publish multiple VMware resources (VCS servers) on an APM Webtop, and you select the Native View Client when you launch a resource, you can launch desktops and applications only from the first resource. Attempts to launch desktop or applications from other resources result in an error.

Conditions:
-- APM is configured to protect multiple VMware resources (VCS servers) and publish those resources on an APM Webtop.
-- You attempt to launch a desktop or application specifying the native VMware client on Linux and Mac.

Impact:
Cannot access desktops and applications from multiple VMware back-ends.

Workaround:
Use HTML5 client instead.

Fix:
APM now supports the launching of desktops and applications from multiple View resources published on the APM webtop using native View clients.

Note: Linux and Mac are not supported, as VMware has yet to add support for mid-parameter on Linux and Mac native clients.

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

880565-10 : Audit Log: "cmd_data=list cm device recursive" is been generated continuously

Links to More Info: BT880565

Component: Device Management

Symptoms:
The system generates and logs the following message continuously every 30 seconds, in /var/log/audit:

-- bigip1 notice tmsh[47755]: 01420002:5: AUDIT - pid=47755 user=root folder=/ module=(tmos)# status=[Command OK] cmd_data=cd / ;
-- bigip1 notice tmsh[47755]: 01420002:5: AUDIT - pid=47755 user=root folder=/ module=(tmos)# status=[Command OK] cmd_data=list cm device recursive

Conditions:
This occurs during normal operation.

Impact:
Audit log file contains numerous 'cmd_data=list cm device recursive' messages.

Workaround:
-- To prevent the two messages from being logged to /var/log/audit:

1. Edit the 'include' section of syslog configuration to suppress audit logs of 'cmd_data=cd /' and 'cmd_data=list cm device recursive':

# tmsh
# edit /sys syslog all-properties

2. Replace 'include none' with the following syntax:
===
sys syslog {
- snip -
    include "
    filter f_audit {
        facility(local0) and message(＼"AUDIT＼") and not message(＼"cmd_data=list cm device recursive|cmd_data=cd /＼");
    };"
- snip -
}


-- To filter the messages sent to remote syslog servers only, do the following:

1. Set sys syslog remote-servers none:

# tmsh modify sys syslog remote-servers none

2. Edit the 'include' section of syslog configuration to suppress audit logs of 'cmd_data=cd /' and 'cmd_data=list cm device recursive':

# tmsh
# edit /sys syslog all-properties

3. Add the following filter:

    filter f_remote_loghost {
        not (facility(local0) and message(＼"AUDIT.*cmd_data=list cm device recursive|cmd_data=cd /＼"));
    };

Result: The system sends all messages that match the filter to the remote syslog server. It uses the "not" operand to filter the messages out.

4. Add destination and log directives. Below is a sample configuration, with the filter in step 3:

sys syslog {
    include "
    filter f_remote_loghost {
        not (facility(local0) and message(＼"AUDIT.*cmd_data=list cm device recursive|cmd_data=cd /＼"));
    };
    destination d_remote_loghost {
        udp(＼"10.0.0.1＼" port(514));
    };
    log {
        source(s_syslog_pipe);
        filter(f_remote_loghost);
        destination(d_remote_loghost);
    };
    "
}

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

872165 : LDAP remote authentication for REST API calls may fail during authorization

Links to More Info: BT872165

Component: TMOS

Symptoms:
LDAP (or Active Directory) remote authentication fails during authorization for REST API calls.

Clients receive 401 Unauthorized messages and /var/log/restjavad.x.log may report messages similar to the following:

-- [I][1978][26 Mar 2021 13:23:36 UTC][8100/shared/authn/login AuthnWorker] User remoteuser failed to login from 192.0.2.1 using the tmos authentication provider

-- [WARNING][807][26 Mar 2021 14:43:24 UTC][RestOperationIdentifier] Failed to validate Authentication failed.

Conditions:
LDAP (or Active Directory) remote authentication configured with a User Template instead of a Bind Account.

Impact:
Unable to authenticate as remote-user for access that uses authorization, like REST API calls.

Workaround:
You can use either of the following workarounds:

-- Configure LDAP/AD remote authentication to utilize a Bind account instead of the User Template.
-- Create a local user account for each remote user, allowing local authorization (authentication remains remote).

Fixed Versions:
21.1.0.1, 17.5.1.9, 17.1.3.5

851837-8 : Mcpd fails to start for single NIC VE devices configured in a trust domain

Links to More Info: BT851837

Component: TMOS

Symptoms:
Single NIC BIG-IP Virtual Edition (VE) devices configured in a trust domain (e.g., in high availability (HA)) cannot reload a running configuration when restarted and/or when mcpd fails to load the config, and reports a validation error:

err mcpd[25194]: 0107146f:3: Self-device config sync address cannot reference the non-existent Self IP ([IP ADDR]); Create it in the /Common folder first.

Conditions:
Single NIC VE devices configured in a trust domain (e.g., HA)

Impact:
The mcpd process fails to start, and the configuration does not load.

Workaround:
Manually copy and paste the self IP configuration snippet into the /config/bigip_base.conf file:

1. Connect to the CLI.

2. Edit bigip_base.conf, and add the following:

net self self_1nic {
    address 10.0.0.1/24
    allow-service {
       default
    }
    traffic-group traffic-group-local-only
    vlan internal
}

Note: replace 10.0.0.1 with the IP indicated in the error message

3. Save the changes and exit.

4. Load the configuration using the command:
tmsh load sys config

5. If APM or ASM is provisioned/configured, then also restart services with this command:
bigstart restart

Fixed Versions:
21.1.0.3

842193-9 : Scriptd coring while running long-running iApp script

Links to More Info: BT842193

Component: TMOS

Symptoms:
When an iApp script should be terminated due to the max-script-run-time, the script still continues and finishes, sometimes with scriptd coring and posting error messages in /var/log/ltm:

-- err scriptd[13532]: 014f0004:3: script has exceeded its time to live, terminating the script <------ after 20 secs, it continues even after the scriptd core.

-- notice sod[3235]: 01140041:5: Killing /usr/bin/scriptd pid 13532.
-- warning sod[3235]: 01140029:4: high availability (HA) daemon_heartbeat scriptd fails action is restart.

Conditions:
An iApp runs a script which runs for longer than the configured max-script-run-time.

Impact:
Scriptd core.

Workaround:
Increasing the sys scriptd max-script-run-time higher then the default of 300 seconds might be helpful if the higher timeout allows the script to complete.

For example, if the script is saving a UCS and the save takes 400 seconds, then increasing the max-script-run-time to 430 seconds would allow the script to finish and would work around this issue.

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

759258 : Instances shows incorrect pools if the same members are used in other pools

Links to More Info: BT759258

Component: TMOS

Symptoms:
Monitor 'Instances' tab shows incorrect pools if the same members are used in other pools.

Conditions:
Steps to Reproduce:

1. Create custom monitor or use system default.
2. Assign that monitor to a test pool.
3. Navigate to Local Traffic :: Monitors, click the test monitor, then select the Instances tab.

Impact:
The test pool is displayed, as well any other pools that use the same member or members (but with other monitors assigned).

Workaround:
Use tmsh to list monitor instances

For example:

   tmsh show ltm monitor gateway-icmp /Common/gateway_icmp

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

741621-7 : CLI preference 'suppress-warnings' setting may show incorrectly

Links to More Info: BT741621

Component: TMOS

Symptoms:
At times when the 'suppress-warnings' setting is at its default value ('none'), it may be listed like this instead:

suppress-warnings { }

After loading the configuration, the 'suppress-warnings' setting may return to the default value, in which case it is no longer visible when listing out the CLI preferences (without specifying 'all-properties').

Conditions:
-- Using the default value for 'suppress-warnings' in the CLI preferences.
-- Listing out the CLI preferences.

Impact:
Possibly confusing listing for this value. The 'suppress-warnings' setting auto-populates with an incorrect default of empty { } (instead of 'none') on config load, causing it to be displayed when listing CLI preference in tmsh.

Workaround:
None

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

701341-8 : If /config/BigDB.dat is empty or the file is corrupt, mcpd continuously restarts

Links to More Info: K52941103, BT701341

Component: TMOS

Symptoms:
If an issue causes /config/BigDB.dat to be empty or its contents become corrupted, mcpd fails to start up.

System commands report errors about being unable to read DB keys. 'bigstart' outputs errors:

--dbval: Unable to find variable: [security.commoncriteria]

Conditions:
The event causing BigDB.dat to be truncated is unknown at this time.

Impact:
The system fails to start up, and mcpd continually restarts. The BIG-IP system fails to process traffic while the mcpd process is restarting.

Workaround:
To work around this issue, you can remove the empty or corrupted BigDB.dat file. To do so, perform the following procedure:

Impact of workaround: Performing the following procedure should not have a negative impact on your system.

1. Log in to bash.
2. To remove the zero-byte or corrupted BigDB.dat file, type the following command:
rm /config/BigDB.dat

Fixed Versions:
21.1.0.1, 21.0.0.3

680804-6 : TMM restart due to delayed keep alives

Links to More Info: BT680804

Component: Advanced Firewall Manager

Symptoms:
TMM killed with SIGABRT by the SOD process that monitors all process's health. TMM misses the keep alive, hence the restart.

The stack trace shows that tmm was killed when it was waiting on a memory map (sys_mmap_obj) call.

Conditions:
The memory map call is known to take a long time to complete when the disk IO sub-system is very slow.

High IO can also be a result of memory starvation accompanied by intensive paging

Impact:
Traffic disrupted while TMM restarts.

Workaround:
This problem is not likely to persist after a TMM service restart. So no user intervention is required.

If this problem happens repeatedly, it would be required to take a look at IO Resources in use at time of the database load or reload, and see if a way to lower IO can be found.

Fixed Versions:
21.1.0.1

675742-2 : Hardware-to-VE-platform-migrate of a UCS may fail with an error on db variable license.maxcores

Links to More Info: BT675742

Component: TMOS

Symptoms:
Using the platform-migrate option to load a UCS from a different platform may show this error from loaddb:

01080023:3: Error return while getting reply from mcpd: 0x107178a, 0107178a:3: Modifying license.maxcores to a value other than 8 is not allowed.

The UCS loads successfully, other than the DB variable, but this error message is printed and the DB variables are not loaded.

Conditions:
-- Migrating a UCS from physical platform hardware to a Virtual Edition (VE) configuration.

-- License has an attribute limiting the maximum number of cores, and the incoming UCS has a value of the DB variable 'license.maxcores' that contradicts this.

Impact:
The DB variable file fails to load, generating the error message, but that does not stop the loading of the regular configuration files in BIG-IP*.conf.

Workaround:
The 'license.maxcores' value is ignored on hardware devices, so set it to 8 before saving the UCS.

Fixed Versions:
21.1.0.1, 21.0.0.3, 17.5.1.8, 17.1.3.4

671545-8 : MCPD core while booting up device with error "Unexpected exception caught"

Links to More Info: BT671545

Component: TMOS

Symptoms:
Mcpd crashes.

Conditions:
The file-store path is missing with specific configuration file which is needed by mcpd while booting.

Impact:
Traffic and control plane disrupted while mcpd restarts.

Fixed Versions:
21.1.0.1, 21.0.0.3

632553-9 : DHCP: OFFER packets from server are intermittently dropped

Links to More Info: K14947100, BT632553

Component: Local Traffic Manager

Symptoms:
With a DHCP relay virtual server, OFFER packets from DHCP server are intermittently not forwarded to the client and dropped on BIG-IP system.

Conditions:
It is not known exactly what triggers this condition, but it occurs intermittently when the DHCP relay virtual server is in use.

Impact:
Client machines joining the network do not receive DHCP OFFER messages.

Workaround:
Manually delete the serverside to force it to be recreated by the next DHCP request.

For example, if the flow to the DHCP server 10.0.66.222 is broken, issue the following tmsh command:

tmsh delete sys connection ss-server-addr 10.0.66.222 cs-server-port 67

Fixed Versions:
21.1.0.2, 17.1.3.5

603380-13 : Very large number of log messages in /var/log/ltm with ICMP unreachable packets.

Links to More Info: BT603380

Component: Local Traffic Manager

Symptoms:
When dns cache receives ICMP unreachable packets, or timeouts, related to outbound DNS requests, each one generates a log message in /var/log/ltm. Depending on DNS activity, this can result in a large number of log messages, which takes up space without providing additional information about the cause.

Conditions:
You have a DNS virtual server with DNS resolver cache configured. The virtual server receives ICMP unreachable in response to the DNS query. Note that DNS cache may send out multiple concurrent DNS queries, and only needs one to be successful in order to result a result, but it will still log these messages for any copies of the query that resulted in an ICMP unreachable response.

Impact:
You will see messages similar to the following in /var/log/ltm.

   err tmm[5021]: comm_point_tmm_recv_from failed: Software caused connection abort

Workaround:
None.

Fixed Versions:
21.1.0.3

566995-7 : bgpd might crash in rare circumstances.

Links to More Info: BT566995

Component: TMOS

Symptoms:
Under unspecified conditions and in rare cases, bgpd might crash. Although bgpd restarts right away, routing table might be impacted.

Conditions:
The conditions under which this occurs are not known.

Impact:
This might impact routing table and reachability.

Workaround:
None known.

Fixed Versions:
21.1.0.2, 21.1.0, 17.5.1.4, 17.1.3.1

531848-3 : Call to Apply Policy can be lost and never retried in an autosync device group

Links to More Info: BT531848

Component: Application Security Manager

Symptoms:
ASM Changes in an auto-sync device group are sent over a direct channel to a device's peers. In rare conditions it is possible that messages are lost over this channel.

Configuration changes have fallbacks to ensure the missing change will be noticed, but there is no such fallback currently for Apply Policy calls.

Therefore, if an Apply Policy call goes missing in an autosync group, it will never retry.

Conditions:
ASM sync is configured on an autosync device group.

Impact:
Enforcement changes will not take effect on the peer devices until the next Apply Policy action.

Workaround:
Make a spurious change to the policy and set it active again.

Fixed Versions:
21.1.0.1, 21.0.0.3

2549661-1 : BIG-IP VE: eal-intr-thread uses 100% CPU after VF removal on some Engineering Hotfixes

Links to More Info: BT2549661

Component: TMOS

Symptoms:
After a Mellanox virtual function (VF) is removed, eal-intr-thread uses 100% CPU, and tmm stops processing traffic. This is the issue fixed in ID 2313441. It came back in some Engineering Hotfixes

Conditions:
- BIG-IP VE using Mellanox VFs, such as on Microsoft Azure with Accelerated Networking
- An Engineering Hotfix that includes ID 2355421 but not ID 2549661
- A VF is removed while the system is running, for example, during Azure host maintenance

Impact:
Traffic processing stops until you restart tmm or reboot the BIG-IP system

Workaround:
Restart TMM by running: bigstart restart TMM

Fix:
eal-intr-thread no longer uses excessive CPU after a VF is removed

Fixed Versions:
21.1.0.3

2524777-1 : BIG-IP APM vulnerability CVE-2026-94127

Links to More Info: K000162605

2505293-2 : VMware Horizon published desktop and applications are not sorted alphabetically within a webtop section

Component: Access Policy Manager

Symptoms:
When APM VDI apps and desktops are shown on the WebTop section, they are not displayed in sorted order

Conditions:
When APM VDI is configured, and an advanced resource item has VMware desktop or apps assigned to it, the user can access resources using the web top

Impact:
Apps and desktops are not showed in sorted order

Workaround:
None

Fix:
Apps and desktops should be shown in sorted order when it is configured in the Webtop section

Fixed Versions:
21.1.0.3

2503533-2 : HTTP AAA form-based authentication fails with multiple hidden form fields

Links to More Info: BT2503533

Component: Access Policy Manager

Symptoms:
HTTP AAA form-based authentication requests are rejected if the configuration of the AAA server's Hidden Form Parameters contains multiple fields. When this happens, APM logs the following error and the login attempt fails:

"HttpAgent: CR/LF detected in formParams after session variable interpolation - rejecting request."

Conditions:
An Access Policy employs an HTTP AAA agent utilizing Form-Based authentication. The AAA server object's Hidden Form Parameters field is set up with two or more name/value pairs, each on a separate line

Impact:
All authentication attempts using the affected HTTP AAA form-based configuration fail, preventing user login. The failure is entirely reproducible for any request that employs a multi-field Hidden Form Parameters configuration, with no instances of partial or intermittent success

Workaround:
None

Fix:
The HTTP AAA agent now processes the Hidden Form Parameters configuration by breaking it down into individual name/value pairs. It first parses these pairs and then applies session-variable interpolation and CRLF-injection validation to each one separately, rather than validating the entire raw multi-line configuration as a single string. This change allows legitimate multi-field configurations to authenticate successfully while still rejecting any CR/LF characters that may be introduced through session-variable interpolation

Fixed Versions:
21.1.0.3

2501929 : BIND Component Upgrade to Version 9.20.26

Component: Global Traffic Manager (DNS)

Symptoms:
The BIND 9.18 software branch officially reached End-of-Life (EOL) in June 2026 and is no longer supported with security patches or updates

Conditions:
Systems running any version within the BIND 9.18 release train

Impact:
Remaining on an EOL branch exposes the network infrastructure to unpatched security vulnerabilities, potential compliance failures, and a lack of official technical support

Workaround:
None

Fix:
Upgraded the BIND implementation to the latest secure stable version, 9.20.26

Fixed Versions:
21.1.0.3

2488365-1 : BD may crash while handling certain websockets traffic

Links to More Info: BT2488365

Component: Application Security Manager

Symptoms:
While handling high websockets traffic - bd might crash.

Conditions:
- ASM is provisioned
- Security policy attached
- The handled traffic contains high WebSocket traffic with certain characteristics

Impact:
ASM restart

Workaround:
None

Fix:
bd was fixed to properly handle the specific traffic

Fixed Versions:
21.1.0.3

2488077-1 : iControl LX extension installation may fail with IP-based HTTPS URLs using cloud-init

Component: TMOS

Symptoms:
An iControl LX extension package may fail to download when the extension URL uses an IP address over HTTPS

Conditions:
This can occur when:

- The extension URL uses an IP address
- The HTTPS server uses a self-signed or untrusted certificate
- The certificate does not match the IP address used in the URL

Impact:
The BIG-IP system cannot download the iControl LX extension package, and the extension installation fails

Existing installed iControl LX applications are not affected

Workaround:
Use an FQDN with a trusted certificate, or ensure the certificate is trusted and its SAN matches the hostname or IP address used in the URL

Fixed Versions:
21.1.0.3

2483197-2 : For BIGIPAuthCookie/BIGIPAuthUsernameCookie change SameSite value to Lax

Links to More Info: BT2483197

Component: TMOS

Symptoms:
BIGIPAuthCookie/BIGIPAuthUsernameCookie SameSite=Strict breaks APM WebTop redirect logins; this behaviour is seen after setting these cookie values to Strict

Conditions:
N/A

Impact:
It breaks APM WebTop redirect logins for cert/CAC auth

Workaround:
None

Fix:
Fix is done by changing BIGIPAuthCookie/BIGIPAuthUsernameCookie SameSite value to Lax

Fixed Versions:
21.1.0.3

2482505-1 : HA (High Availability) peers are unable to connect when ConfigSync uses the management IP

Links to More Info: BT2482505

Component: Global Traffic Manager (DNS)

Symptoms:
-- HA (High Availability) peers in a device group are shown as Disconnected.
-- SSL handshake failures are logged between the peer address and a device's internal TMM address.
-- Errors appear in var/log/gtm similar to:
err big3d[10046]: 012b300e:3: SSL Error: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure on connection to ::ffff:127.1.1.4:58366.
-- Peer certificate verification errors referring to a self-signed certificate appear in /var/log/ltm, and the connection to the CMI peer is subsequently removed.

This issue has previously been reported under ID2450009 and ID2450017.

Conditions:
-- BIG-IP systems in an HA (High Availability) configuration.
-- ConfigSync is configured to use the management IP address on both devices:
   -- sys db configsync.allowmanagement value enable
   -- management-ip is configured as the device configsync-ip

Impact:
-- Configuration synchronization between HA (High Availability) peers fails.
-- HA peer devices cannot connect.
-- Device Group members show a Status of Disconnected.
-- Configuration changes are not synchronized between devices.

Workaround:
Configure the device Config Sync address to use a self IP, not the device's Management IP.

Fix:
HA (High Availability) peers connect successfully and Config Sync succeeds when the device's Management IP is configured as the device Config Sync address.

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

2472389 : SAML SP page fails to render and displays

Component: TMOS

Symptoms:
In the GUI, clicking on Access > Federation results in an error: "General Exception: Check logs for more information. If the problem persists, please contact support"

Conditions:
On the GUI select menu, Access and click on Federation, and click on SAML Service Provider

Impact:
Not able to view SAML Service Provider Page

Workaround:
Fixed with code changes

Fix:
Fixed in TMUI code

Fixed Versions:
21.1.0.3

2471421 : Stale iControlPortal.cgi processes accumulate after repeated httpd restarts on BIG-IP 21.1.x

Links to More Info: BT2471421

Component: TMOS

Symptoms:
Multiple stale iControlPortal.cgi processes build up after each bigstart restart of httpd

Conditions:
- Occurs on BIG-IP 21.1.x only
- Triggered by restarting the httpd service via bigstart restart httpd
- BIG-IP 17.5.x and earlier are not affected

Impact:
- Stale processes consume memory over time
- No impact on traffic or end users

Workaround:
Stale processes can be manually killed as a temporary measure, but will recur until the fix is applied. Resolved in Change 3954408. After applying the fix, exactly one iControlPortal.cgi process runs after each restart — no accumulation.

Fix:
Resolved in Change 3954408. After applying the fix, exactly one iControlPortal.cgi process runs after each restart — no accumulation

Fixed Versions:
21.1.0.3

2460741-2 : FDB entries may not always be deleted when a tenant is rebooted or upgraded

Links to More Info: BT2460741

Component: F5OS Messaging Agent

Symptoms:
In a Velocity tenant, the tenant creates FDB entries on the host that inform the host about VLAN+MAC pairings. If a tenant has multiple VLANs and different MAC addresses assigned to each VLAN, and is rebooted or upgraded, there is a chance that MAC address + VLAN mappings change. K50122514 contains details describing MAC address changes after an upgrade, which is expected behavior

Example showing invalid FDB entries that do not match the current VLAN+MAC pairings on the tenant


[root@localhost:Active:Standalone] config # tmsh show net vlan | grep -e Mac -e Vlan | paste - -
Net::Vlan: VLAN43 Mac Address (True) 00:94:a1:6a:d5:60
Net::Vlan: VLAN44 Mac Address (True) 00:94:a1:6a:d5:61
Net::Vlan: VLAN45 Mac Address (True) 00:94:a1:6a:d5:62
 
 
R10900-R84-S35# show fdb SUB
                                                                                              MOD NDI
MAC ADDRESS VLAN TAG TYPE VLAN TAG TYPE VID ENTRY TYPE OWNER ID AGE ID SVC VTC SEP DMS DID CMDS MIRRORING INTERFACE
-------------------------------------------------------------------------------------------------------------------------------------------------------------------
00:94:a1:6a:d5:62 43 tag_type_vid 43 tag_type_vid 43 L2-LISTENER repro-tenant-2 0 - 4095 14 - - - - 1 - - <----- WRONG
00:94:a1:6a:d5:60 43 tag_type_vid 43 tag_type_vid 43 L2-LISTENER repro-tenant-2 0 - 4095 14 - - - - 1 - -
 
00:94:a1:6a:d5:60 44 tag_type_vid 44 tag_type_vid 44 L2-LISTENER repro-tenant-2 0 - 4095 14 - - - - 1 - - <----- WRONG
00:94:a1:6a:d5:61 44 tag_type_vid 44 tag_type_vid 44 L2-LISTENER repro-tenant-2 0 - 4095 14 - - - - 1 - -
 
00:94:a1:6a:d5:61 45 tag_type_vid 45 tag_type_vid 45 L2-LISTENER repro-tenant-2 0 - 4095 14 - - - - 1 - - <----- WRONG
00:94:a1:6a:d5:62 45 tag_type_vid 45 tag_type_vid 45 L2-LISTENER repro-tenant-2 0 - 4095 14 - - - - 1 - -

Conditions:
A Velocity tenant deployed with a MAC block size > 1
VLAN > MAC pairings that change after an upgrade

Impact:
Traffic disruption. Traffic returning to the tenant on the wrong VLAN

Workaround:
Either delete the old invalid FDB entries manually in F5OS, reboot the F5OS Appliance or blade to clear the entries

Fix:
Platform-agent removes static L2 listener on shutdown

Fixed Versions:
21.1.0.3

2459541-2 : APMD rejects valid SAMLResponse POST values containing URL-encoded CRLF line folding, breaking SAML SP ACS flow

Component: Access Policy Manager

Symptoms:
APM as SP fails during ACS processing for otherwise valid SAML responses from the IdP

/var/log/apm shows the following errors:
HTTPParser.cpp func: "parsePostParam()" ... POST param 'SAMLResponse' value contains CRLF, rejecting request

Conditions:
- Access policy has SAML auth configured
- SAMLResponse or RelayState contains CRLF characters

Impact:
Access policy execution fails, thereby rejecting sessions

Workaround:
None

Fixed Versions:
21.1.0.3

2459237-2 : Disk provisioning error does not identify available volume group capacity

Links to More Info: BT2459237

Component: TMOS

Symptoms:
When module provisioning fails due to insufficient disk space, the system displays a message indicating that the disk limit has been exceeded. This message includes a value representing the available capacity in megabytes. It’s important to note that this value may be confused with the amount of free space available in the /shared file system

Conditions:
- The system or tenant does not have enough available disk space in the volume group to provision the configured modules
- Configuration load or module provisioning fails and reports a disk limit exceeded message

Impact:
An attempt can be made to resolve the issue by increasing the size of the /shared file system. However, this action reduces the available disk space for module provisioning and does not actually fix the underlying problem; in fact, it may worsen the situation

Workaround:
- Increase the size of the disk allocated to the system or tenant
- Do not increase the size of the /shared file system to resolve this issue

Fix:
The configuration load provides the right error, identifying the value as the disk capacity available for module provisioning

Fixed Versions:
21.1.0.3

2457053-3 : An ASM Policy with IP Intelligence enabled exported in JSON format cannot be imported

Component: Application Security Manager

Symptoms:
When an ASM security policy with IP Intelligence enabled is exported in JSON format, the exported policy cannot be imported successfully

Conditions:
When an ASM security policy with IP Intelligence enabled is exported in JSON format

Impact:
The import failure is associated with the description for the "Tor Proxies" category in the IP Intelligence. This appears to be a regression of Bug 1632385. After the fix for that bug, the exported description for "Tor Proxies" changed from "originator’s" to "originator’s," which is causing the import failure

Workaround:
Workaround is to replace originator’s with originator＼u00e2＼u0080＼u0099s and the import will be successful

Fixed Versions:
21.1.0.3

2452769-1 : TMSH crash when writing to the command history

Links to More Info: BT2452769

Component: TMOS

Symptoms:
In rare instances, it is possible that TMSH will try to write to the history when the command history is NULL, which results in a crash

Conditions:
TMSH attempts to write to the command history when it has been destroyed and is NULL

Impact:
This results in a TMSH crash

Workaround:
None

Fix:
TMSH has been updated to check that the command history is not NULL

Fixed Versions:
21.1.0.3

2452089 : TMM may crash when using PQC DH group

Links to More Info: BT2452089

Component: Local Traffic Manager

Symptoms:
TMM experiences crashes on certain platforms when the PQC DH group is utilized

Note that FIPS-enabled licenses use PQC in their self-tests

Conditions:
- Enable the DH group X25519MLKEM768 on platforms that do not support the CPU feature AVX2

- This may rarely include CPUs used on hypervisor systems, but more often will be due to virtualization software not exposing the BMI2 feature set to the guest vCPUs


F5 r2xx and r4xx lack BMI2

Impact:
TMM cores with traffic disruption

With a FIPS-enabled license, there is TMM instability and a restart loop

Workaround:
None

Fixed Versions:
21.1.0.2

2449577-1 : TMM core after running tmsh load sys config default

Links to More Info: BT2449577

Component: TMOS

Symptoms:
TMM getting core

Conditions:
When "tmsh load sys config default"

Impact:
tmm is restarting

Workaround:
NA

Fix:
When the command "load sys config default" is executed, the VLAN configurations are not removed; however, the underlying trunk configurations are removed and then recreated. This operation results in a stale interface pointer (ifp) within the interface structure (ifc). Since existing VLANs are not deleted during the load system configuration process, the logic has been extended to include the associated trunks as well

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

2448441-2 : APM VPE Unable to load Access Policies containing starts_with expressions after upgrading to 17.5.1.8

Links to More Info: BT2448441

Component: Access Policy Manager

Symptoms:
The user is unable to open or edit Access Policies in the Visual Policy Editor (VPE). When trying to open /Common/<AP>, an error occurs indicating that "starts_with" is not a valid Tcl expression operator. Additionally, there is a warning stating that this issue may lead to TMM compile failures after a restart. Furthermore, VPE rules that do not begin with "expr {" are flagged as errors

Conditions:
BIG-IP with APM configured

Impact:
You are unable to load Access Policies containing starts_with expressions after upgrading to 17.5.1.8

Workaround:
None

Fix:
"starts_with" is allowed inside VPE rules and the use of "expr {" is not required to wrap all rules anymore

Fixed Versions:
21.1.0.3

2448129 : HMAC missing from HMAC DB for few modules in FIPS enabled device★

Links to More Info: BT2448129

Component: TMOS

Symptoms:
In a FIPS-enabled device, upgrading or installing a defective ISO image causes the BIG-IP to remain in an "INOPERATIVE" state indefinitely due to image integrity failure. This failure occurs due to missing or incorrect HMACs for several modules.

In /var/log/secure:
crit root[3947]: BIG-IP Integrity Check: [ FAIL ] -- THE SYSTEM WILL HALT UPON REBOOT, CONTACT F5 NETWORKS FOR TECHNICAL SUPPORT

Conditions:
-- BIG-IP FIPS-enabled device
-- Upgrade to an affected version

Impact:
The BIG-IP system remains in "INOPERATIVE" state after upgrade

Workaround:
Disabling FIPS is a workaround

Fix:
Fixed an issue causing integrity check to fail on FIPS-enabled BIG-IP systems that are upgraded.

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

2430933-1 : BD may crash while handling certain JSON body

Component: Application Security Manager

Symptoms:
bd might crash while processing a certain JSON body

Conditions:
- ASM is provisioned
- JSON profile has a schema attached
- traffic includes a very large JSON body

Impact:
bd might crash

Workaround:
N/A

Fix:
BD Fixed to process the problematic JSON body correctly

Fixed Versions:
21.1.0.3

2430669-1 : BD may crash while handling certain JSON body

Component: Application Security Manager

Symptoms:
BD might crash while processing a certain JSON body

Conditions:
- ASM is provisioned
- JSON profile has a schema attached
- Traffic includes a very large JSON body

Impact:
BD might crash

Workaround:
None

Fix:
BD fixed to correctly process the problematic JSON body

Fixed Versions:
21.1.0.3

2405133-3 : Fix for external/database monitor status issue

Links to More Info: K000162365, BT2405133

Component: Local Traffic Manager

Symptoms:
External monitors, and also some built-in database (MS SQL, MySQL, Oracle, PostgreSQL) monitors may fail to correctly track pool member status (e.g., a member not returning to up after a backend outage).

Conditions:
When a pool uses an external or built-in 'database' type monitor

Impact:
Pool members monitored by external monitors or built-in database monitors may show incorrect status, potentially routing traffic to unavailable members or marking available members as down.

Workaround:
No workaround

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

2397785-4 : TCL error "Invalid index 0 in class" thrown in ltm log for external data group

Links to More Info: BT2397785

Component: Local Traffic Manager

Symptoms:
TCL error "Invalid index 0 in class" thrown in /var/log/ltm for external data group

Conditions:
- virtual server with iRule
- iRule using the class command with the element option
class element -value 0 <external_dg>

Impact:
iRule execution will fail

Workaround:
None

Fix:
Added code for proper boundary check for class item

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

2389757-4 : ICMP with ID 0 flows with ipother profile does not work

Links to More Info: BT2389757

Component: Local Traffic Manager

Symptoms:
Virtual server with 'ipother' profile fails to forward ICMP echo reply when ICMP identifier is 0x0000

Conditions:
- Virtual server with ipother profile
- ICMP reply packet with identifier 0

Impact:
Virtual server with 'ipother' profile fails to forward ICMP echo reply when ICMP identifier is 0x0000

Workaround:
None

Fixed Versions:
21.1.0.3

2389549 : CVE-2026-55693

Component: TMOS

Symptoms:
This is a stack out-of-bounds vulnerability that corrupts the call frame and crashes the vim editor. Out-of-bounds memory write leading to a crash of Vim during spell suggestion when processing a specially crafted spell file

Conditions:
A user must load a malicious spell file and invoke the spell suggestion feature to trigger the vulnerability.

Impact:
Denial of service due to a crash of Vim caused by memory corruption, potentially exploitable for crashing the editor but limited otherwise due to required user interaction.

Workaround:
Avoid loading spell files from untrusted sources.
Apply any security patch that addresses this vulnerability.
Temporarily disable spell suggestions or the loading of external spell files.

Fix:
CVE has been fixed

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

2389533 : CVE-2026-52858: Vim is an open source, command line text editor.

Component: TMOS

Symptoms:
Vim Python omni-completion behaves unexpectedly.

Conditions:
Editing externally sourced Python files with omni-completion enabled.

Impact:
Unintended code may run during completion.

Workaround:
Disable Python omni-completion for external files.

Fix:
this issue has been fixed now

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

2389529 : CVE-2026-52860 vim: Arbitrary code execution through Python omni-completion.

Component: TMOS

Symptoms:
Python omni-completion in Vim executes crafted code from hostile buffers during autocompletion, enabling unintended code execution.

Conditions:
N/A

Impact:
Systems with Vim versions prior to 9.2.0597 may execute crafted Python code during autocompletion from hostile buffers.

Workaround:
Upgrade to Vim version 9.2.0597, which patches this vulnerability.

Fix:
N/A

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

2389517 : CVE-2026-41411 vim: Vim: Command injection allows arbitrary code execution via malicious tag files

Component: TMOS

Symptoms:
A flaw was found in Vim, an open-source command-line text editor. This command injection vulnerability occurs during tag file processing.

Conditions:
N/A

Impact:
When Vim resolves a tag from this file, it executes the embedded command via the system shell, leading to arbitrary code execution with the privileges of the running user.

Workaround:
the issue involves exercising caution when opening or processing tag files from untrusted sources. Users should avoid loading tag files from unknown or suspicious origins to prevent the execution of arbitrary commands

Fix:
N/A

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

2389341 : UCS save fails for large iAppsLX packages due to rpmbuild timeout causing persistent IllegalStateException

Component: iApp Technology

Symptoms:
tmsh save sys UCS completes, but one or more iAppsLX packages are missing from RPMS.save/ inside the UCS archive
The following errors appear in /var/log/ltm during UCS save:

err iAppsLX_save_pre[19798]: Failed task: /shared/iapp/build-package/f9405734-9ca2-45f7-ad4c-9164c277bddb: java.lang.IllegalStateException: Invalid state in the chain of requests - RPM_BUILD_FAILED.
err iAppsLX_save_pre: Failed to get getRPM build response within timeout for <package-name>
err iAppsLX_save_pre[19798]: Failed to get getRPM build response within timeout for f5-service-discovery

Conditions:
One or more large iAppsLX packages are installed (e.g., f5-service-discovery, f5-telemetry — 100MB+)
The rpmbuild for those packages exceeds the configured iapplxrpm.timeout (default: 60 seconds), and the build fails and hits an IllegalStateException immediately

Impact:
Large iAppsLX packages are not included in the UCS archive.
The failure is silent from a UCS perspective, as the UCS is created successfully but is incomplete

Workaround:
Increasing the iapplxrpm timeout value allows saving the file without getting a timeout failure

tmsh modify sys db iapplxrpm.timeout value 600
bigstart restart restjavad

Fix:
- Hard timeout set to IAPPLXRPM_TIMEOUT_SEC_MAXIMUM (600s) so large packages have sufficient time to build, and exits after build succeeds.
- Stall detector added — cancels rpmbuild only if filesystem activity stops growing for 90s (distinguishes a genuinely hung build from a slow but progressing one)
RPM_BUILD_FAILED case added to processStep() — calls failTask() cleanly instead of throwing IllegalStateException
FAILED tasks skipped in duplicate check — next save triggers a fresh build instead of returning the stale failure

Fixed Versions:
21.1.0.3

2389277-3 : ASM GUI Learning and Blocking page search result returning extra unnecessary items

Links to More Info: BT2389277

Component: Application Security Manager

Symptoms:
Under Security -> Application Security -> Policy Building -> Learning and Blocking Settings, if searching for "Unescaped", the HTTP Protocol Compliance section will appear despite having no matching entries

Conditions:
- BIG-IP with ASM provisioned

Impact:
This is cosmetic only. There is no functional impact

Workaround:
N/A

Fixed Versions:
21.1.0.3

2389273-3 : Incorrect GUI HTTP Protocol Sub-Violation counts under Learning and Blocking Settings

Links to More Info: BT2389273

Component: Application Security Manager

Symptoms:
Under Security -> Application Security -> Policy Building -> Learning and Blocking Settings, the Enabled and Total counts for the HTTP Protocol Compliance section are each 1 higher than they should be

Conditions:
- BIG-IP with ASM provisioned

Impact:
This is cosmetic only. There is no functional impact

Workaround:
N/A

Fixed Versions:
21.1.0.3

2388377 : APM Portal Access Fails to Parse "from" and "as" outside of import export cases

Links to More Info: BT2388377

Component: Access Policy Manager

Symptoms:
Apps hosted through portal access fail if they contain "from" and "as" outside of import export cases

Conditions:
Have an App hosted in Portal Access that uses "from" and "as" outside of import export cases

Impact:
Apps hosted through Portal Access will not work as intended

Workaround:
None

Fix:
Applications that use "from" and "as" outside of import/export cases now work as intended in Portal Access

Fixed Versions:
21.1.0.2

2388333-1 : BIG-IP terminates HTTP/2 with GOAWAY/PROTOCOL_ERROR when client sends empty initial SETTINGS frame

Links to More Info: BT2388333

Component: Local Traffic Manager

Symptoms:
The HTTP/2 protocol requires that an empty SETTINGS frame be sent as the first frame. When BIG-IP receives this empty initial SETTINGS frame, it incorrectly terminates the connection with a PROTOCOL_ERROR

Conditions:
- BIG-IP has a virtual server with an HTTP/2 profile
- Client initiates an HTTP/2 connection and sends its initial SETTINGS frame with no settings

Impact:
Connection is immediately terminated, preventing the client from serving any requests

Workaround:
None

Fixed Versions:
21.1.0.3

2388309-3 : Error (TypeError: "x" is not a function) in jquery-ui-1.8.17.min.js:49:4075

Links to More Info: BT2388309

Component: Advanced Firewall Manager

Symptoms:
Custom search not working for Security ›› Event Logs : Network : Firewall

Conditions:
AFM Provision
- Security ›› Event Logs: Network: Firewall
- Custom search
= Drag and drop the required field

Impact:
Custom search not working for Security ›› Event Logs : Network : Firewall

Workaround:
None

Fixed Versions:
21.1.0.3

2384421-4 : False positive with BruteForce in certain configuration

Links to More Info: BT2384421

Component: Application Security Manager

Symptoms:
False positive with BruteForce in a certain configuration

Conditions:
Blocking is enabled for the "Brute Force: Maximum login attempts are exceeded" policy level, but only an alarm is set at the detection object level, such as "username". For the detection object, the request should not be blocked and should alarm only; however, it is blocked

Impact:
- This can only happen with a release that has the fix for ID2296473

- Blocking is enabled with "Brute Force: Maximum login attempts are exceeded"

- Mitigation Action" is set to "Alarm" for the detection object, such as "username

- Detect Credential Stuffing" is enabled

Workaround:
None

Fixed Versions:
21.1.0.1, 17.5.1.8, 17.1.3.4

2384197-3 : TLS handshake failure when intermediate CA certificates are used as Trusted CA in SSL profile

Links to More Info: BT2384197

Component: Local Traffic Manager

Symptoms:
* SSL/TLS handshake failures with "certificate unknown" alert
* Certificate validation fails when an intermediate CA is used as a trusted CA
* OCSP response control set to "Ignore" is not honored in server-ssl profiles
* Connections fail in both forward and reverse proxy scenarios

Conditions:
Server-SSL Profile (Reverse Proxy):

    * When an intermediate CA certificate is configured as a trusted CA (ca-file) -> FAILS
    * When root CA is configured as trusted CA -> PASSES
    OCSP "Ignore" setting is not respected

Client-SSL Profile (Forward Proxy):

    * When bundle containing root + intermediate CAs is used -> PASSES
    * When intermediate CA alone is configured as a trusted CA -> FAILS

Impact:
* SSL/TLS connections fail when intermediate CA certificates are used as trusted CAs in SSL profiles
* Affects both client-ssl and server-ssl profile configurations
* Prevents proper certificate validation in proxy scenarios
* Admin users cannot configure intermediate CAs as trusted CAs without workarounds.

Workaround:
Use a certificate bundle containing both root CA and intermediate CA certificates instead of using the intermediate CA alone as the trusted CA.

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

2380665-1 : FIPS Key Deletion via tmsh/GUI/iControl Fails When /config/filestore/.trash_bin_d Path is Missing.

Links to More Info: BT2380665

Component: TMOS

Symptoms:
FIPS key deletion initiated through tmsh, GUI, or iControl fails. The operation attempts to access /config/filestore/.trash_bin_d for file content manipulation during the deletion workflow, but the process errors out if the path does not exist

Conditions:
FIPS key deletion is performed via tmsh, GUI, or iControl
/config/filestore/.trash_bin_d directory is missing or not created on the system

Impact:
- FIPS key deletion operation fails.
- Users are unable to remove keys, potentially blocking key lifecycle management and related administrative operations.

Workaround:
Manually create the /config/filestore/.trash_bin_d directory prior to performing the key deletion operation

Fix:
With the fix applied, the /config/filestore/.trash_bin_d path is created before being accessed, ensuring the key deletion operation completes successfully

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

2365469-1 : Mdmsyncmgr truncates SAS signature when following Intune redirect to Azure Blob Storage, leading to NonCompliantDevice retrieval failure

Links to More Info: BT2365469

Component: Access Policy Manager

Symptoms:
- mdmsyncmgr fails to retrieve NonCompliantDevice details from Intune
- APM logs show authentication errors during device detail updates:
“Authentication error for get all non-compliant devices request”
- Azure Blob Storage responds with HTTP 403 AuthenticationFailed and message: “Signature fields not well formed”
- Packet capture shows SAS signature truncated in redirected request
- Issue correlates with the presence of two newly added HTTP headers in Intune redirect response

Conditions:
- BIG-IP APM configured with mdmsyncmgr and Microsoft Intune integration
- Intune returns an HTTP 303 redirect to Azure Blob Storage with an SAS token
- Redirect response includes additional HTTP headers (recent change on Intune side)
- Resulting HTTP request size exceeds internal handling limit (~1515 bytes observed)
- mdmsyncmgr follows the redirect (HTTP scheme) and truncates the request payload (~15 bytes lost).

Impact:
- NonCompliantDevice retrieval fails completely
- Device compliance data cannot be synchronized from Intune
- Affects visibility and enforcement of compliance policies

Workaround:
None

Fix:
Fix async HTTP response header parsing for fragmented headers
 
        Accumulate fragmented header field/value callbacks in HttpSenderAsio
        instead of overwriting them. This prevents truncation of long Location
        headers, including Intune compliance retrieval redirects with long Azure
        Blob SAS query strings.

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

2365353 : Snat-translation object may get orphaned after running "tmsh delete ltm snat all" command.

Links to More Info: BT2365353

Component: TMOS

Symptoms:
After running the "tmsh delete ltm snat all" command, the snat-translation object, which was automatically created while creating the snat object, may not be removed and becomes orphaned. With the orphaned snat-translation object, a couple of problems can occur

- Orphaned snat-translation object cannot be deleted. An error message "01070321:3: Snat translation address /Common/x.x.x.x is still referenced by a snat pool." is returned.

# tmsh delete ltm snat-translation 10.1.1.1
01070321:3: Snat translation address /Common/10.1.1.1 is still referenced by a snat pool.
#

- New snat-translation object cannot be created on either CLI or GUI. An error message "01070712:3: Invalid primary key on trans_addr object - path is empty." is returned.

# tmsh create ltm snat-translation 10.2.2.1 { address 10.2.2.1 traffic-group traffic-group-1 }
01070712:3: Invalid primary key on trans_addr object - path is empty.
#

- New snat object cannot be created on either CLI or GUI. An error message "01070734:3: Configuration error: Invalid primary key on trans_addr object () - not a full path 2." is returned.

# tmsh create ltm snat my_snat2 origins add { 10.4.4.1 } translation 10.5.5.1
01070734:3: Configuration error: Invalid primary key on trans_addr object () - not a full path 2.
#

Conditions:
- Executed "tmsh delete ltm snat all" command

Impact:
- Cannot delete orphaned snat-translation object.
- Cannot create new snat object or snat-translation object

Workaround:
Avoid running "delete ltm snat all" TMSH command. Instead, delete snat object on GUI. Or alternatively, avoid using "all" keyword when you delete snat object on CLI (i.e., delete each snat object by "delete ltm snat [snat-object-name]" command)

If you have already had orphaned snat-translation object and have difficulty in creating new snat/snat-translation object, follow K13030 and refresh mcpdb. After reboot, you can manually delete the orphaned snat-translation object without using "all" TMSH command option

# touch /service/mcpd/forceload
# reboot
# tmsh delete ltm snat-translation 10.1.1.1 ; tmsh save sys config

Fixed Versions:
21.1.0.2

2359001-2 : Portal access fails with the error 'ERROR: Fetching cookie failed' when large cookies are present.

Component: Access Policy Manager

Symptoms:
Portal access intermittently fails when the HTTP Analytics profile is enabled. Access logs display cookie fetch errors in RewritePlugin, such as:

error rewrite - RewritePlugin.cpp:3290 (0x2005bd0): ERROR: Fetching cookie failed.

Conditions:
Observed when large cookies are send by backends.

Impact:
Connections face interruptions in service availability due to the inability to fetch backend cookies.

Fixed Versions:
21.1.0.3

2358921-2 : Large JWTs causes tmm core while encoding

Links to More Info: BT2358921

Component: Access Policy Manager

Symptoms:
When JWTs with an encoded length greater than 2MB are processed by TMM for OAuth, it causes TMM to crash

Conditions:
JWT configured with large claims or scope - increasing the overall payload size

Impact:
The TMM crashes, causing the BIG-IP to become unavailable

Workaround:
Reduce JWT payload length by modifying the claims or scopes

Fixed Versions:
21.1.0.2, 17.5.1.9

2358897-2 : After upgrading to version 17.5.1.6, APM rejects HTTP requests containing unencoded double quotes in the URI.

Links to More Info: BT2358897

Component: Access Policy Manager

Symptoms:
- After upgrading to BIG-IP 17.5.1.6, HTTP requests containing unencoded double quotes (") in the URI query string are rejected by APM (access.c framework)
- This behavior results from stricter RFC 3986 enforcement
- Applications that previously functioned now fail if requests include URIs that are non-compliant with RFC 3986

Conditions:
- BIG-IP version: 17.5.1.6
- APM enabled: Access Policy Manager is active
- Request characteristics: Contains unencoded special characters (e.g., " in query strings)
- Traffic flow: Processed through the APM access policy (access.c)

Example Trigger:

/test?option2="method"&option3="POST"

Impact:
- Existing applications (e.g., Oracle WebLogic) fail to function after the upgrade
- Requests are rejected before reaching backend servers
- This issue prevents upgrading to version 17.5.1.6
- Results in production outages or degraded functionality
- Workarounds lead to performance degradation

Workaround:
Apply an iRule to encode unsupported characters (e.g., double quotes) before APM processing:

when HTTP_REQUEST priority 100 {
    set my_uri [HTTP::uri]
    if { $my_uri contains "＼"" } {
        HTTP::uri [string map { "＼"" "%22" } $my_uri]
    }
}

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.4

2355421-1 : BIG-IP VE on Azure: Traffic loss with no self-recovery after Accelerated Networking VF is rescinded by the platform

Links to More Info: K000161773, BT2355421

Component: TMOS

Symptoms:
When Azure rescinds or re-presents an SR-IOV Virtual Function (VF) on a BIG-IP VE with Accelerated Networking, the data interface associated with that VF will stop forwarding traffic and will not recover automatically without manual intervention. Other interfaces remain unaffected. The Traffic Management Microkernel (TMM) does not crash, but you may see the following messages in the kernel logs:

- pci_hyperv: PCI dom# 0x<N> has collision, using 0x<M>
- mlx5_core <addr>: no netdev found for vf serial <N>

Conditions:
- BIG-IP VE is deployed on Microsoft Azure
- Accelerated Networking is enabled on the VM
- The Azure platform may rescind and re-present the SR-IOV VF during host maintenance, platform servicing, or other internal Azure events that might not be visible to the tenant or reflected in scheduled event notifications
- VF re-presentation results in a PCI domain collision in the guest kernel

Impact:
Traffic on the affected interface stops. Associated pool members and virtual servers become unavailable. Recovery requires restarting TMM or rebooting

Workaround:
Restart TMM to restore traffic forwarding:
  
bigstart restart tmm or reboot the unit

Fix:
When an interface is affected, the BIG-IP system automatically switches to the synthetic network path, allowing traffic to continue forwarding without disruption. Accelerated Networking will not be restored on that interface until the TMM is restarted

Fixed Versions:
21.1.0.3

2354469-3 : Flood and Sweep Attack Counters Not Incremented for Certain Suspicious Packet Types

Component: Advanced Firewall Manager

Symptoms:
When the Flood attack vector is configured for the "suspicious" packet type, sending packets such as "TCP Option Overruns TCP Header," "TCP Option Present with Illegal Length," or "Unknown TCP Option Type" to the BIG-IP system should result in an increase in both the Flood attack statistics and drop counters. However, this is not occurring. The same issue also applies to the Sweep attack vector

Conditions:
Single Endpoint Flood/Sweep vector is configured with specific detection and mitigation thresholds, and "TCP Option Overruns TCP Header" packets are sent to the system

Impact:
The Flood attack vector statistics are not increasing as expected

Workaround:
None

Fix:
For most packet types, except for "bad packets," enforcement is typically delayed until a flow is established. Once the flow is active, enforcement is applied. However, for the three specific vector types mentioned, the flow already exists when the packet is processed, so enforcement is applied immediately within this flow rate path

Fixed Versions:
21.1.0.3

2351525-4 : Restrictions on files and iFiles that can be created may be overly restrictive.

Component: TMOS

Symptoms:
When creating files on the device, the specified source path may be overly restrictive, even for admin or root roles

Conditions:
Attempt to create a file object, such as an iFile, on the device using one of the restricted paths

Impact:
The file creation will fail, and the command will not complete successfully

Workaround:
None

Fix:
Top-level roles should no longer be as restricted in non-appliance mode when creating file objects, such as an ifile

Fixed Versions:
21.1.0.3

2347033-3 : [APM] Kerberos authentication fails after upgrading from version 17.5.1.3 to 17.5.1.6.★

Links to More Info: K000162055, BT2347033

Component: Access Policy Manager

Symptoms:
After upgrading to version 17.5.1.6 Build 0.67.25 (EHF), some users are prompted to re-enter their credentials for Kerberos authentication.

In /var/log/apm:
err apmd[14955]: 01490000:3: HTTPParser.cpp func: "parseHttpGenericHeader()" line: 608 Msg: HTTP header line too long (10289 bytes), dropping.

Conditions:
APM is configured to use Kerberos authentication

Impact:
Kerberos enduser logon fails, errors are logged.

Workaround:
None

Fixed Versions:
21.1.0.3

2347029-4 : Light memoy leak after signatures detected attack ended

Links to More Info: BT2347029

Component: Anomaly Detection Services

Symptoms:
35K memory leak after attack ends

Conditions:
After each attack, and when Bados signature detection is enabled

Impact:
After many attacks, admd consumes too much memory and restart itself

Workaround:
None

Fix:
Memory leak resolved

Fixed Versions:
21.1.0.1, 21.0.0.3, 17.5.1.8, 17.1.3.4

2345869 : APM Portal Access Fails to Parse ES13 Class field syntax

Links to More Info: BT2345869

Component: Access Policy Manager

Symptoms:
Apps hosted through portal access fail if they contain Class field syntax

Conditions:
Have an App hosted in Portal Access that uses Class field syntax

Impact:
Apps hosted through Portal Access will not work as intended

Workaround:
None

Fixed Versions:
21.1.0.2

2344733 : Updated BIND to version 9.18.50.

Links to More Info: BT2344733

Component: Global Traffic Manager (DNS)

Symptoms:
BIG-IP was previously shipped with BIND version 9.18.49, and ISC has since released the latest version, 9.18.50.

Conditions:
BIG-IP is shipped with BIND version 9.18.49.

Impact:
BIND version 9.18.50 includes:
- 1 security fix
- 1 new feature
- 2 bug fixes

See https://downloads.isc.org/isc/bind9/9.18.50/doc/arm/html/changelog.html

Workaround:
NA

Fix:
BIND version 9.18.50 includes:
- 1 security fix
- 1 new feature
- 2 bug fixes

See https://downloads.isc.org/isc/bind9/9.18.50/doc/arm/html/changelog.html

Fixed Versions:
21.1.0.1, 21.0.0.3, 17.5.1.9, 17.1.3.5

2339917-1 : Configuration utility vulnerability CVE-2026-66842

Links to More Info: K000162521, BT2339917

2339721-4 : PEM Session Creation Fails For Subsequent Subscribers Sharing The Same towerid When tmm.pem.rancon.towerid.enabled Is Enabled

Links to More Info: BT2339721

Component: Policy Enforcement Manager

Symptoms:
When the setting `tmm.pem.rancon.towerid.enabled` is activated, only the very first subscriber associated with a specific tower ID is successfully added to the PEM session table. Any subsequent subscriber that attempts to connect to the same tower ID—including the same subscriber after a RADIUS stop/start cycle—will fail to create a session, resulting in the log message "RANCON: towerid add failed." Additionally, the session will be deleted immediately after its creation

Conditions:
- The sys db key tmm.pem.rancon.towerid.enabled is set to enabled
- A RADIUS-initiated PEM session is created for a towerid that already has an existing entry in the towerid database (i.e., another subscriber is or was previously connected to the same tower)
- Reproducible with a single subscriber performing RADIUS start → RADIUS stop → RADIUS start (same towerid reused on second session)

Impact:
Only the first PEM session per towerid succeeds. All subsequent sessions associated with the same towerid are incorrectly torn down, causing subscriber traffic to go unmanaged by PEM policies. In deployments where multiple subscribers share a cell tower (the common case), this effectively breaks PEM session management for all but one subscriber per tower

Workaround:
- Disable the towerid feature by setting tmm.pem.rancon.towerid.enabled to disabled:

- tmsh modify sys db tmm.pem.rancon.towerid.enabled value disable

- This prevents the towerid lookup/add path from executing during session creation, allowing all PEM sessions to succeed normally (at the cost of losing RAN congestion towerid tracking).

Fixed Versions:
21.1.0.3

2338881-2 : SecurID authentication failures cause apmd file descriptor leak leading to service disruption

Links to More Info: BT2338881

Component: Access Policy Manager

Symptoms:
After multiple SecurID authentication failures, the apmd process runs out of file descriptors. The logs indicate that "epoll_create() failed [Too many open files]," leading to failures in subsequent authentication attempts or Active Directory (AD) queries, which generate "Too many open files" errors. Additionally, sockets connecting to the aced daemon accumulate in a CLOSE_WAIT state

Conditions:
- SecurID authentication is configured with logon retry enabled (maxLogonAttempt > 1)
- Multiple authentication failures occur (e.g., wrong credentials, brute-force attempts)
- The user does not complete the retry flow (session is abandoned after initial failure)

Impact:
APMD cannot process new access policy requests when file descriptors are exhausted. All APM functionality—including Active Directory queries, authentication, and session management—is affected for all users. A restart of APMD is necessary to recover

Workaround:
Restart the apmd service to recover file descriptors. Reducing the maxLogonAttempt value to 0 limits exposure but does not eliminate the issue. Implementing rate-limiting for login attempts at the network layer can help slow FD exhaustion.

Fix:
The SecurID authentication module now immediately closes the socket connection to the aced daemon once the authentication process reaches a terminal state, either accepted or denied, instead of keeping it open for potential retries. Additionally, the session cleanup process has been corrected to properly locate and free the SecurID context object when sessions are aborted

Fixed Versions:
21.1.0.2, 17.5.1.8, 17.1.3.5

2338077-1 : Upgrade Unbound DNS Resolver from version 1.23.1 to 1.25.1

Links to More Info: BT2338077

Component: Global Traffic Manager (DNS)

Symptoms:
The product includes Unbound version 1.23.1, which had robustness issues that were later fixed in subsequent Unbound releases

Conditions:
This issue affects systems using the embedded Unbound DNS resolver version 1.23.1 or earlier

Impact:
Robustness issues are addressed in Unbound 1.25.1

Workaround:
None

Fix:
Upgraded Unbound from version 1.23.1 to 1.25.1. This update remediates robustness issues

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

2337757-2 : Secondary Addresses Not Displayed When Client Side Multi-homing Is Enabled

Links to More Info: BT2337757

Component: TMOS

Symptoms:
Secondary addresses are not displayed when client-side multi-homing is enabled

Conditions:
When Client Side Multi-homing Is Enabled in the TMUI SCTP profile page

Impact:
Secondary Addresses cannot be configured when client side multi-homing is enabled in the TMUI SCTP profile page

Workaround:
None

Fix:
Fixed the issue, and now Secondary Addresses are displayed when Client Side Multi-homing Is Enabled in the TMUI SCTP profile page

Fixed Versions:
21.1.0.3

2333437 : Some monitor types might fail under v21.1 when bigd runs with multiple threads

Links to More Info: BT2333437

Component: Local Traffic Manager

Symptoms:
- After upgrading to BIG-IP 21.1.0, pools using certain monitor types such as tcp_half_open monitor may go offline unexpectedly
- If a monitor has a recv-disabled string and a particular pool member sends the recv-disabled string, a different pool member may be marked disabled (instead of the correct one)
- Pool members show monitor status as down, and /var/log/bigdlog (if bigd debug is enabled) may contain errors such as:

get kernel route failed; cannot determine management interface for address [ tmm?=false td=true tr=false addr=::ffff:10.1.1.1:80 srcaddr=::%0:6 ]

- No monitor probe traffic is observed for affected pools.

Conditions:
- Upgrade to v21.1.0
- Bigd process using more than one thread

To confirm if bigd is running with more than one thread, run the bash command 'ps aux | grep bigd' and check what number is after '-P'. Example output for two threads:

root 15966 8735 0.2 0.3 158.0M 52.4M ? S Jun03 00:00:00.83 bigd -P 2

Impact:
Pools may be marked offline or disabled, causing service disruption or loss of availability for applications relying on those pools

Workaround:
Set bigd to use a single thread by running:

# tmsh modify sys db bigd.numprocs value 1
# tmsh save sys config
# tmsh restart sys service bigd

Fixed Versions:
21.1.0.1

2333277-3 : BIGD HTTPS monitors now honor the certificate verification

Links to More Info: BT2333277

Component: Local Traffic Manager

Symptoms:
When an HTTPS monitor used a server SSL profile configured with peer-cert-mode set to require, in-TMM monitors correctly rejected expired certificates, but BIGD-based monitors accepted them

Conditions:
Steps to Reproduce:

Configure:
ltm profile server-ssl serverssl-1 {
    app-service none
    ca-file backend_selfsigned_ca
    peer-cert-mode require
}
ltm monitor https https-1 {
    adaptive disabled
    defaults-from https
    destination *:*
    interval 5
    ip-dscp 0
    recv none
    recv-disable none
    send "GET / HTTP/1.1＼r＼n＼r＼n"
    ssl-profile /Common/serverssl-1
    time-until-up 0
    timeout 16
}
ltm pool pool-1 {
    members {
        10.1.1.200:irdmi {
            address 10.1.1.200
            session monitor-enabled
            state down
        }
    }
    monitor https-1
}
sys db bigd.tmm {
    value "disable"
}

Hint:
- peer-cert-mode must be configured to "required". Its default is ignored. If it is ignored, the in-tmm monitor does not care if the certificate is expired or not
- If peer-cert-mode is configured to "required", it does not accept self-signed certificates by default. So we need to create a ca-file from the certificate file cert.pem and configure to ca-file of serverssl

Steps to configure the ca-file are:
  - scp cert file (cert.pem or cert_exp.pem) to BIG-IP /shared/
  - install sys crypto cert selfsigned_ca from-local-file /shared/cert.pem
  - modify ltm profile server-ssl serverssl-1 ca-file selfsigned_ca

Then okay to make SSL traffic with a valid certificate


Verify Steps:
- Generate valid certificate and expired certificate
** generate valid certificate:
  openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes

** generate expired certificate:

# 1) Generate key + CSR
openssl req -new -newkey rsa:2048 -nodes ＼
  -keyout key_exp.pem ＼
  -out cert_exp.csr ＼
  -subj "/CN=localhost"

# 2) Self-sign CSR with explicit past validity window (expired cert)
openssl x509 -req ＼
  -in cert_exp.csr ＼
  -signkey key_exp.pem ＼
  -out cert_exp.pem ＼
  -startdate 20200101000000Z ＼
  -enddate 20200102000000Z

- Start SSL server with valid certificate
openssl s_server -cert cert.pem -key key.pem -accept 8000

If a monitor is added to the pool, you should see something like that
-----BEGIN SSL SESSION PARAMETERS-----
MH8CAQECAgMDBALALwQgK4cBz7kd1uU7vIK5463zue92H5Jv/6l3T4UgciiR6FUE
MPENptbh0MVh4S9SZUzRZLZeFVJeZ4kxdH4MYESJjzcYPku85nEyf6/SmA6qZZs7
XaEGAgRqKyVrogQCAhwgpAYEBAEAAACtAwIBAbMDAgEX
-----END SSL SESSION PARAMETERS-----
Shared ciphers:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:AES128-GCM-SHA256:AES128-SHA:AES128-SHA256:AES256-GCM-SHA384:AES256-SHA:AES256-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA:DHE-RSA-AES256-SHA256
Signature Algorithms: RSA+SHA512:DSA+SHA512:ECDSA+SHA512:RSA+SHA384:DSA+SHA384:ECDSA+SHA384:RSA+SHA256:DSA+SHA256:ECDSA+SHA256:RSA+SHA224:DSA+SHA224:ECDSA+SHA224:RSA+SHA1:DSA+SHA1:ECDSA+SHA1
Shared Signature Algorithms: RSA+SHA512:DSA+SHA512:ECDSA+SHA512:RSA+SHA384:DSA+SHA384:ECDSA+SHA384:RSA+SHA256:DSA+SHA256:ECDSA+SHA256:RSA+SHA224:DSA+SHA224:ECDSA+SHA224
Supported Elliptic Curve Point Formats: uncompressed:ansiX962_compressed_prime:ansiX962_compressed_char2
Supported groups: secp256r1:secp521r1:brainpoolP512r1:brainpoolP384r1:secp384r1:brainpoolP256r1:secp256k1
Shared groups: secp256r1:secp521r1:secp384r1
CIPHER is ECDHE-RSA-AES128-GCM-SHA256
Secure Renegotiation IS supported
GET / HTTP/1.1

- Switch between in-tmm monitor and bigd monitor using "tmsh modify sys db bigd.tmm value enable/disable". enable is in-tmm monitor, disable is bigd monitor. If the certificate is valid, both work fine

- stop that SSL server and start SSL server with expired certificate
openssl s_server -cert cert_exp.pem -key key_exp.pem -accept 8000

- then switch between in-tmm monitor and bigd monitor. If it is the in-tmm monitor, there is nothing received at the server. If it is the bigd monitor, there is still "GET / HTTP/1.1" at the server

Impact:
When a pool member certificate expires, the HTTPS monitor still has a good transaction and sets the pool member state to UP. For the in-tmm monitor, it failed to make an SSL handshake and set the pool member state to DOWN

Workaround:
None

Fix:
BIGD HTTPS monitors now honor the certificate verification settings from the associated server SSL profile, including peer-cert-mode and the configured CA file. BIGD monitors reject expired or otherwise invalid server certificates when certificate verification is required.

As a result, BIGD and in-TMM HTTPS monitors now provide consistent certificate-validation behavior

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

2333065-4 : APM Logon Page Fails for Usernames Containing Single Quote (')

Links to More Info: BT2333065

Component: Access Policy Manager

Symptoms:
After upgrading to BIG-IP APM version 17.1.3.2, users with a single quote (') in their surname or username (e.g., "o'brien", "labmno'test") are unable to log in via the APM logon page. The system logs show input validation failures for such usernames, with hexadecimal conversion of the input value and error messages indicating rejection

Conditions:
BIG-IP APM version 17.1.3.2
Usernames containing a single quote (') character

Impact:
Legitimate users with a single quote in their username or surname cannot log in to applications protected by BIG-IP APM. This affects user access and may disrupt business operations with such naming conventions

Workaround:
None

Fixed Versions:
21.1.0.1, 21.0.0.3, 17.5.1.9, 17.1.3.4

2331657-2 : APM OAuth OIDC Discovery extra callbacks cause access policies to be dropped

Links to More Info: BT2331657

Component: TMOS

Symptoms:
On BIG-IP APM version 17.5.1, the OAuth/OIDC Provider Discovery task may intermittently fail. This occurs when McpRequestMultiCompletion receives more callbacks than expected from the doChainQuery() function. This results in an IllegalStateException, which can lead to an incomplete access-policy apply list. Consequently, one or more policies associated with the OAuth provider may be omitted from the apply operation

Conditions:
Affected access policies remain in the “Apply Access Policy: Required” state. Because newly discovered JWK keys may not be applied to those policies, JWT signature validation can fail, and users may be locked out of VPN or OAuth-protected applications

Impact:
The issue requires:
- BIG-IP APM with OAuth/OIDC Provider Discovery configured.
- Multiple access policies associated with the same OAuth provider
- An OIDC Discovery task execution
- Extra MCP callbacks from the APM discovery worker
- The issue is intermittent and timing-dependent

Workaround:
None

Fixed Versions:
21.1.0.3

2331445-3 : HTTP/2 Connection May Stall When a Single Response (or request) Exceeds The Per-pass Egress Write Limit

Links to More Info: BT2331445

Component: Local Traffic Manager

Symptoms:
HTTP/2 traffic can stop mid-transfer. The connection delivers approximately 16 KB of payload and then goes idle until it is closed by an idle timeout

Conditions:
- A single HTTP/2 message produces more queued DATA frames in one egress pass than the HTTP/2 profile's per-pass write size (default 16 KB)
- No further application-layer writes follow on the affected stream(s) (typical for a completed response or a fully buffered request body)

Impact:
Stalled HTTP/2 streams; the client or server peer eventually times out

Workaround:
A workaround is possible by having the frame-size lower than

ltm profile http2 http2_New {
    app-service none
    defaults-from Profile_http2
    frame-size 8191 # Lower than write-size 8192
    header-table-size 65536
    write-size 8192
}

Fix:
The HTTP/2 egress flush logic now schedules an additional flush callback whenever the per-pass write-size cap is reached while frames remain queued on the connection

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

2330425-3 : AVR Core is Generated

Links to More Info: BT2330425

Component: Application Visibility and Reporting

Symptoms:
In the ESXI longevity pipeline on the control plane running with LTM objects creation and deletion, the AVR core is generated

Conditions:
- HA setup with 8 vCPUs
- LTM and ASM are provisioned
- AVR isn't provisioned

Impact:
Functionality may be affected

Workaround:
Fixed

Fix:
Internal pointer handling was fixed

Fixed Versions:
21.1.0.3

2329957-4 : Stale mac masquerade fdb entires are observed on rSeries devices after killing tmm on the active tenant.

Links to More Info: BT2329957

Component: F5OS Messaging Agent

Symptoms:
Stale mac masquerade fdb entires are observed on rSeries devices after killing tmm on the active tenant.

Conditions:
- HA setup using mac masquerade
- the active tmm is killed

Impact:
- traffic disruption possible

Workaround:
- perform manual failover twice 'tmsh run sys failover standby` to remove the unnecessary entries.

Fix:
Mac masquerade fdb entires are now correctly removed after killing tmm on the active tenant.

Fixed Versions:
21.1.0.3, 17.5.1.9

2326721 : DNS NXDOMAIN Query DoS vector statistics not updating for NXDomain responses

Links to More Info: BT2326721

Component: Advanced Firewall Manager

Symptoms:
When Device/Profile DoS protection is configured with the DNS NXDOMAIN Query vector, the DoS statistics (stats, drops, and attack count) remain at zero, even when NXDomain responses are received from the server

Conditions:
DoS protection is configured for the device/profile using the DNS NXDOMAIN query vector, along with an LTM virtual server employing the UDP protocol and a backend DNS server that returns NXDomain responses

Impact:
DNS NXDOMAIN attack detection and mitigation are ineffective. The system fails to count or drop NXDomain-based attack traffic, leaving it vulnerable to DNS NXDOMAIN flood attacks

Workaround:
Configure the DNS profile for the Virtual Server

Fix:
The issue is fixed

Fixed Versions:
21.1.0.1, 21.0.0.3, 17.5.1.8, 17.1.3.4

2313505-2 : guestagentd Fails To Acquire a Token.

Links to More Info: K000161680, BT2313505

Component: TMOS

Symptoms:
These errors are seen every 5 minutes:

info guestagentd[6007]: 01810007:6: Rest request failed: {"code":400,"referer":"Unknown","restOperationId":17678971,"kind":":resterrorresponse"}
[WARNING][673][03 Jun 2026 16:22:29 PDT][com.f5.rest.common.RestWorker] dispatch to worker http://localhost:8100/shared/authz/tokens caught following exception: java.lang.NullPointerException
[I][674][03 Jun 2026 16:22:29 PDT][ForwarderPassThroughWorker] {"user":"local/admin","method":"POST","uri":"http://localhost:8100/mgmt/shared/authz/tokens","status":400,"from":"Unknown"}

Conditions:
The guest is running a TMOS version that includes the fix for ID2229021

Impact:
The Guest Status page in the GUI appears empty

Workaround:
None.

Fix:
guestagentd successfully acquires a token, and the guests are displayed on the Guest Status page in the GUI

Fixed Versions:
21.1.0.3, 17.5.1.9

2313477-2 : TMC Fallback Wildcard Synthesis Incorrectly Sets prefix_len(0), Causing Config Load Failure When Coexisting Wildcard Forwarding virtual server Already Owns The 0.0.0.0 Virtual Address

Links to More Info: BT2313477

Component: Local Traffic Manager

Symptoms:
After upgrading to an affected version, a configuration containing both a wildcard IP-forwarding virtual server and a second virtual server using a Traffic Matching Criteria (TMC) with a source address list may fail to load with the following error:
0107176c:3: Invalid Virtual Address, the IP address 0.0.0.0 already exists
Unexpected Error: Validating configuration process failed

Conditions:
All of the following must be true:
- A wildcard IP-forwarding virtual server exists with destination 0.0.0.0:0 and mask any (ipv4) or ::.0 and any6 (ipv6)
- A second virtual server in any partition references a TMC configured with:
  - destination-address-inline 0.0.0.0 (any destination ipv4) or :: (ipv6)
  - destination-port-inline <port>
  - source-address-list <list-name>
  - No destination-address-list
- The configuration is loaded from disk (upgrade, reinstall, or MCP force-reload)

Impact:
The BIG-IP system fails to load its configuration after upgrade, interrupting traffic processing

Workaround:
None

Fixed Versions:
21.1.0.3

2313453 : RSA Key related statistics not incremented

Component: Local Traffic Manager

Symptoms:
The RSA statistics, like Handshakes using RSA and handshakes offloaded for RSA for different key sizes, are not incremented and will always be set to 0

Conditions:
No specific conditions, but during RSA key exchange, these stats need to be udpated but not getting udpated

Impact:
There will be RSA key size statistics in the Profile stats which are useless and always be zero

Workaround:
None

Fixed Versions:
21.1.0.3

2313441-3 : TMM stops processing traffic when an accelerated networking interface is removed on Azure

Links to More Info: BT2313441

Component: TMOS

Symptoms:
TMM stops processing traffic and consumes high CPU on BIG-IP VE running on Microsoft Azure when an accelerated networking virtual function (VF) is removed at runtime.

Conditions:
- BIG-IP VE deployed on Microsoft Azure with Accelerated Networking enabled.
- Azure platform performs host maintenance, live migration, or other operations that remove the virtual function (VF) at runtime.

Impact:
Traffic disruption. TMM stops processing traffic and must be restarted.

Workaround:
Restart TMM or reboot the BIG-IP system to restore traffic processing

Fix:
BIG-IP VE running on Microsoft Azure now continues processing traffic when an accelerated networking virtual function (VF) is removed at runtime.

Fixed Versions:
21.1.0.2, 17.5.1.9

2312245 : SOD killing MCPD while doing load sys config file

Links to More Info: BT2312245

Component: TMOS

Symptoms:
MCPD restart

Conditions:
- Provision LTM and configure 4096 extraMb
- Load 16k nodes config
- Observe 16000 nodes, one pool with all nodes associated, and one VS
- And then load VS config using load sys config file, and the incoming VS should have the same pool name as the existing one

Impact:
MCPD restart

Workaround:
- While loading a new VS config with pool, make sure not to use the same pool name as the older one
- First, load the system configuration to the default settings, and then load the new VS file

Fix:
As it is taking more time, while handling large VS status updates, heartbeat is sent to SOD from MCPD to make sure, it is intact and SOD will not kill MCPD

Fixed Versions:
21.1.0.1, 21.0.0.3, 17.5.1.8, 17.1.3.4

2311605 : Updated Common Criteria cipher suite list to include TLS1.3 ciphers and excludes SHA1 based ciphers.

Links to More Info: BT2311605

Component: Local Traffic Manager

Symptoms:
The Common Criteria cipher suite list did not have the TLS1.3 ciphers and also contains SHA-1-based cipher suites

Conditions:
- Configure clientssl and serverssl with "f5-cc-stip-ciphers" or "f5-cc-ciphers"
- Configure virtual server with the same clientssl or serverssl profile

Impact:
Virtual server fails to connect with TLS1.3 cipher suites and also accepts connections with SHA1-based ciphers

Workaround:
Create a custom cipher-rule which includes TLS1.3 ciphers and excludes SHA-1-based ciphers

Fix:
Updated the Common Criteria cipher list

Fixed Versions:
21.1.0.1

2310821-1 : Support for F5 Web App Scanning in Vulnerability Import

Component: Application Security Manager

Symptoms:
Users cannot select F5 Web App Scanning as a scanner source for automated vulnerability import and policy tuning workflows.

Conditions:
-- The environment uses scanner integration/import features.
-- Users want to onboard findings from F5 Web App Scanning.
-- The scanner source is configured as F5 Web App Scanning.

Impact:
You cannot import and process findings from F5 Web App Scanning through the existing scanner integration pipeline.

Workaround:
Use another supported scanner integration path or perform manual policy updates based on scan findings.

Fix:
Added support for F5 Web App Scanning as a scanner source in scanner configuration. Findings from F5 Web App Scanning now flow through the standard parsing and handling logic used by supported scanner integrations.

Fixed Versions:
21.1.0.3

2306833 : MCPD process crash in DelayedEvalList during Virtual Address status recalculation on BIG-IP 21.1.0

Links to More Info: BT2306833

Component: TMOS

Symptoms:
The MCPD process crashes and restarts unexpectedly, generating a core file

Conditions:
- BIG-IP version 21.1.0
- HA pair configuration (Active/Standby)
- Virtual servers configured with deferred status recalculation active (standard LTM configuration)
- Crash occurs during the event-loop-driven timer callback for - Virtual Address status recalculation

Impact:
MCPD crashes and restarts, causing TMM restart and datapath disruption

Workaround:
None

Fixed Versions:
21.1.0.1

2304897-2 : SELinux audit denials occur when APM uses Active Directory or Kerberos agents

Links to More Info: BT2304897

Component: Access Policy Manager

Symptoms:
SELinux errors similar to below observed in /var/log/auditd/auditd.log:

time->Wed May 27 12:16:44 2026
type=PROCTITLE msg=audit(1779909404.672:3492): proctitle=2F7573722F6C6962657865632F61706D64002D640035002D66002D6E003430002D750034
type=SYSCALL msg=audit(1779909404.672:3492): arch=c000003e syscall=250 success=yes exit=9 a0=b a1=338ac093 a2=0 a3=0 items=0 ppid=7778 pid=31621 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="apmd" exe="/usr/libexec/apmd64" subj=system_u:system_r:apd_t:s0 key=(null)
type=AVC msg=audit(1779909404.672:3492): avc: denied { read } for pid=31621 comm="apmd" scontext=system_u:system_r:apd_t:s0 tcontext=system_u:system_r:initrc_t:s0 tclass=key

Conditions:
APM access policy has AD/Kerberos Auth Agent configured

Impact:
No behavioural impact

Workaround:
None

Fix:
The issue has been resolved, and the SELinux errors should no longer appear

Fixed Versions:
21.1.0.1, 17.5.1.8, 17.1.3.4

2304693-1 : Improvements in HTTP/2 on TMM

Links to More Info: K000162231

2304105-1 : Remote users with usernames starting with an underscore, or containing a backslash or at sign, cannot access some GUI pages

Links to More Info: K000161535, BT2304105

Component: TMOS

Symptoms:
After logging in to the BIG-IP Configuration Utility, some pages display the error
"Error getting auth token from login provider." Affected pages include Device
Management, Shared Objects, and iApps Application Services

Conditions:
- BIG-IP is configured to use a remote authentication provider (such as Active Directory, LDAP, or RADIUS)
- The remote user's username begins with an underscore, or contains a backslash or an at sign character (for example, _username, DOMAIN＼username, or user@domain)

Impact:
Remote users with usernames that begin with an underscore, or that contain a backslash or at sign, cannot access some Configuration Utility pages. Other pages and CLI access are unaffected.

Workaround:
None

Fix:
Remote users with usernames that begin with an underscore, or that contain a backslash or at sign, can now access all Configuration Utility pages.

Fixed Versions:
21.1.0.3, 17.5.1.9, 17.1.3.5

2302637-4 : Throughput Out statistic incorrectly shows zero on BIG-IP VE

Links to More Info: BT2302637

Component: Local Traffic Manager

Symptoms:
The tmsh show sys performance throughput Output value displays 0 on BIG-IP VE despite normal data plane traffic. The tx_hw_drop counter on the external interface increments while tx_pkts and bytes_out remain at 0. Monitoring and SNMP tools relying on throughput statistics report incorrect values

Conditions:
BIG-IP VE using the socket network driver. This applies to virtual edition deployments across all hypervisors and cloud platforms, including Azure, AWS, VMware, KVM, and Hyper-V

Impact:
Throughput monitoring and reporting show incorrect values. Actual data plane traffic is not affected

Workaround:
None

Fixed Versions:
21.1.0.1, 21.0.0.3, 17.5.1.8, 17.1.3.4

2298637-1 : Gateway ICMP Monitor Properties Cannot Be Modified When Attached to a Pool/Node with Destination Set to All Addresses

Links to More Info: BT2298637

Component: Local Traffic Manager

Symptoms:
-- Create an LTM gateway-icmp monitor with the destination set to all addresses ":""
   - TMSH Command: tmsh create ltm monitor gateway-icmp test_gateway_icmp_monitor destination *:*
-- Create an LTM pool with a node and attach the gateway-icmp monitor:
   - TMSH Command: tmsh create ltm pool test_gateway_icmp_pool monitor test_gateway_icmp_monitor members add { 10.2.3.4:80 }
-- Modify the LTM gateway-icmp monitor:
   - TMSH Command: tmsh modify ltm monitor gateway-icmp test_gateway_icmp_monitor destination *:* description Updated

Conditions:
Gateway_icmp monitor created with all addresses and attached to the pool

Impact:
Gateway-icmp monitor properties, like description, etc., cannot be modified when attached to a pool/node, and the destination is set to all addresses

Workaround:
None

Fix:
Problem fixed with validation of gateway-icmp monitors

Fixed Versions:
21.1.0.1

2298469-2 : Header-Based Content Profile Entries Display Gaps And Incorrect Order After Delete/Add

Component: Application Security Manager

Symptoms:
After subsequent add/delete GUI operations, the header-based content profile entries for a URL may have a gap or be inserted before the last entry instead of last as expected

Conditions:
Delete and Add operations are performed on URL header-based content profiles

Impact:
Potentially unexpected enforcement priority of header-based content profiles

Workaround:
Ensure the new element has been inserted in the expected priority after edits

Fix:
Order gaps are compressed on delete, and new elements are inserted in the expected order precedence

Fixed Versions:
21.1.0.3

2298245-3 : Access Profile rejects HTTP requests containing unencoded characters in the URI★

Links to More Info: BT2298245

Component: Access Policy Manager

Symptoms:
After upgrading to BIG-IP 17.5.1.6, all users experience failures with certain requests when an Access Profile is applied to the virtual server. Specifically, SharePoint edits or updates fail, and any request containing curly braces ({ or } or | or ＼ ) triggers the error: 'Access encountered an error (Operation not supported).' This issue does not occur when the Access Profile is removed or when using standard bracket characters (e.g., ( or ))

Conditions:
Requests contain curly braces ({ or } or | or ＼ ) in the URI

Impact:
This issue has a significant impact, particularly in environments using Microsoft SharePoint/IIS and browsers such as Chrome or Edge, which may send non-encoded curly braces

Workaround:
iRule,
when HTTP_REQUEST priority 100 {
    set my_query [HTTP::query]
    if { ($my_query contains "{") or ($my_query contains "}") or ($my_query contains "|") or ($my_query contains "＼"") } {
        HTTP::query [string map {"{" "%7B" "}" "%7D" "|" "%7C" "＼"" "%22" "＼＼" "%5C" "^" "%5E"} $my_query]
    }
}

Fixed Versions:
21.1.0.1, 21.0.0.3

2297761-4 : "Data Type: File Upload" does not set for all binary media type

Links to More Info: BT2297761

Component: Application Security Manager

Symptoms:
When creating an ASM policy from an OpenAPI 3.1 file, any parameters defined with a binary content media type other than `application/octet-stream` are categorized as "data type: alpha-numeric" instead of "data type: file upload." Additionally, binary parameters are mistakenly set with "base64 decoding" enabled, whereas it should be disabled

Conditions:
An OpenAPI 3.1 file is imported to create a security policy, and the file includes parameters defined with a binary content media type

Impact:
Parameters appear in the GUI with "Data Type: Alpha-Numeric"

Workaround:
Parameters appear in the GUI with "Data Type: File upload"

Fix:
Set the data type to "File upload" for all binary media types by selecting each of those types

Fixed Versions:
21.1.0.1

2297737-4 : Base64 Decoding is enabled for parameters imported from OpenAPI files

Links to More Info: BT2297737

Component: Application Security Manager

Symptoms:
When creating a policy from an OpenAPI file containing a parameter defined with type: string and format: binary, the resulting parameter is configured with "Base64 Decoding" enabled

Conditions:
An OpenAPI file is imported to create an ASM policy, and the file contains a parameter defined with type: string and format: binary

Impact:
Base64 Decoding enabled in GUI

Workaround:
Base64 Decoding disabled in GUI

Fix:
Changed flg_detect_base64 to 0 to be disabled

Fixed Versions:
21.1.0.1, 21.0.0.3, 17.5.1.8, 17.1.3.4

2297717-4 : Base64 decoding is disabled for disabled on the url request body for "image/png" Header-Based Content profile

Links to More Info: BT2297717

Component: Application Security Manager

Symptoms:
When creating an ASM policy from an OpenAPI file containing a requestBody with a schema defined as type: string and format: base64, a header-based content profile on the URL is configured with "base64 decoding" set to "disabled" while it must be "required"

Conditions:
An OpenAPI file is imported to create a policy, and the file contains a URL with a request body content type image/png, and the schema is defined with type: string and format: base64.

Impact:
Base64 Decoding disabled in GUI

Workaround:
Base64 Decoding enabled in GUI

Fix:
In handle_request_body, extract from the schema format or contentEncoding instead of just contentEncoding

Fixed Versions:
21.1.0.1, 21.0.0.3, 17.5.1.8, 17.1.3.4

2297681 : pem_sessiondump --li reports "Error geting sessions!" when PEM subscriber sessions are active

Links to More Info: BT2297681

Component: Local Traffic Manager

Symptoms:
Running pem_sessiondump --li to list all active PEM subscriber sessions prints the following output and exits immediately with no session data

List all session (use with care)
PEM session dump all[pemdb_session_bin] ....

Error getting sessions!

Conditions:
BIG-IP with the Policy Enforcement Manager (PEM) module requires at least one active PEM subscriber session, which can be created via a RADIUS Accounting-Request START using a Gx Diameter interface. The operator then executes pem_sessiondump --li from the system shell

Impact:
- The pem_sessiondump --li and pem_sessiondump --summary command-line diagnostic tools are non-functional for listing active subscriber sessions. Operators cannot use this tool to enumerate or inspect session state for troubleshooting

- There is no impact to the data path: subscriber sessions are created, provisioned, and terminated correctly. PEM policy enforcement, Gx/Radius integration, and all session statistics visible via tmsh show pem sessiondb all and tmsh show pem continue to operate normally

Workaround:
Use tmsh show pem sessiondb all to view active subscriber session details, and tmsh show pem for aggregate statistics

Fixed Versions:
21.1.0.3

2296989-1 : DNS Express Does Not Fall Back to AXFR When Upstream Returns NOTIMPL to IXFR, Causing Stale Zone Data

Links to More Info: BT2296989

Component: Global Traffic Manager (DNS)

Symptoms:
- DNS Express logs indicate that it will attempt an AXFR after receiving a NOTIMPL response to an IXFR request, but it does not actually initiate the AXFR.
- DNS Express repeatedly retries IXFR requests instead of falling back to AXFR.
- The affected DNS zone remains stale and is not updated from the primary server.
- Administrators may be misled by log messages stating AXFR will be attempted.

Conditions:
- BIG-IP DNS Express is configured as a secondary server for a DNS zone.
- The upstream (primary) DNS server supports only AXFR and returns NOTIMPL (RCODE 4) in response to IXFR requests (e.g., NSD 4.3.8).
- A zone update occurs on the primary server, causing the secondary to initiate an IXFR.

Impact:
- DNS Express fails to update its zone data, serving stale DNS records to clients.
- Manual intervention is required to update the zone data.

Workaround:
Manually disable and re-enable the affected DNS zone on BIG-IP DNS Express to force a full AXFR and update the zone data:
   tmsh modify ltm dns zone <zone-name> enabled false
   tmsh modify ltm dns zone <zone-name> enabled true

Fix:
N/A

Fixed Versions:
21.1.0.3

2296725 : ECONNRESET errors in Declarative Onboarding caused cloud-lib test failures★

Links to More Info: BT2296725

Component: TMOS

Symptoms:
The tmos_cloudinit_declared test was failing in AWS and Azure due to ECONNRESET errors

Conditions:
- Install DO on an AWS or Azure-deployed BIG-IP

Impact:
tmos_cloudinit_declared could not reliably pass in AWS or Azure causing development delays

Workaround:
- The fix was to switch from a Promise.all() to 10 managed threads

- This limits the number of calls to the BIG-IP, improving reliability. 10 threads was an arbitrary decision

Fix:
The issue is resolved

Fixed Versions:
21.1.0.1

2296697-4 : The violation_details Field Displays 'N/A' In Remote Logging

Links to More Info: BT2296697

Component: Application Security Manager

Symptoms:
When remote logging is configured with the violation_details field enabled, the violation_details value appears as 'N/A' in the remote log messages

Conditions:
A security policy is configured with remote logging.
The remote logging profile has the violation_details field enabled, and a request triggers a security violation

Impact:
Remote log consumers receive incomplete security event data when the violation_details field is missing

Workaround:
None

Fix:
Remote log contains violation_details

Fixed Versions:
21.1.0.1, 21.0.0.3

2296513-1 : BIND Upgraded to Stable Version 9.18.49

Links to More Info: BT2296513

Component: Global Traffic Manager (DNS)

Symptoms:
BIND upgrade to stable version 9.18.49

Conditions:
Using local BIND

Impact:
BIND upgrade to stable version 9.18.49

Workaround:
None

Fix:
BIND upgrade to stable version 9.18.49

Fixed Versions:
21.1.0.1, 21.0.0.3

2296473-1 : SSRF violation in alarm mode is not counted in Violation Rating

Links to More Info: BT2296473

Component: Application Security Manager

Symptoms:
Blocking for Violation Rating happens on response, instead of request

Conditions:
When you have the configuration below
- Server-side access to disallowed host (Alarm)
- Violation Rating Need Examination detected (Block)

Impact:
The request that has a flag alarm for SSRF is forwarded to the server-side

Workaround:
Set Block on Server-side access to disallowed host violation

Fixed Versions:
21.1.0.1, 17.5.1.8, 17.1.3.4

2295473-1 : Chmand Leaking Memory On Running The Back To Back F5OS Configs Related To VLANs and LAGs.

Links to More Info: BT2295473

Component: TMOS

Symptoms:
- Chmand is leaking memory

Conditions:
- On executing any F5OS commands related to VLANs or LAGs

Impact:
- Chmand will be leaking memory.
- Exhausted memory.

Workaround:
None

Fixed Versions:
21.1.0.1, 21.0.0.3, 17.1.3.4

2295233-1 : Remote users with usernames starting with underscore cannot access some GUI pages

Links to More Info: BT2295233

Component: TMOS

Symptoms:
After logging in to the BIG-IP Configuration Utility, some pages display the error "Error getting auth token from login provider." Affected pages include Device Management, Shared Objects, and iApps Application Services

Conditions:
- BIG-IP is configured to use a remote authentication provider (such as Active Directory, LDAP, or RADIUS)
- The remote user's username begins with an underscore character (for example, _username)

Impact:
Remote users with usernames starting with an underscore cannot access some Configuration Utility pages. Other pages and CLI access are unaffected

Workaround:
None

Fix:
Remote users with usernames starting with an underscore can now access all Configuration Utility pages

Fixed Versions:
21.1.0.1

2294485-2 : Internal transmit queue size setting not applied to all interfaces on VE

Links to More Info: BT2294485

Component: Local Traffic Manager

Symptoms:
When configuring the internal transmit queue size in tmm_init.tcl, the setting is not applied to all interfaces. One interface retains the default queue size, while all other interfaces reflect the configured value

Conditions:
- BIG-IP VE with multiple TMM instances.
- Internal transmit queue size configured in tmm_init.tcl.

Impact:
The affected interface uses the default queue size. No traffic disruption is expected

Workaround:
None

Fixed Versions:
21.1.0.3

2294317-1 : HA connection is disconnected after a mcpd crash followed by a license install or a config-sync ip address change

Links to More Info: BT2294317

Component: TMOS

Symptoms:
HA ConfigSync enters a permanently disconnected state.

Error present in the logs:
May 7 14:36:35 err mcpd[7116]: 0107142f:3: Can't connect to CMI peer 10.64.245.129, TMM outbound listener not yet created

Conditions:
Any of the following:
- A config sync address is changed to some other address
- Self-IP used previously by config-sync is modified
- A MCPD crash followed by a license install

Impact:
Config changes on the active unit are not synced to the standby

Workaround:
A `bigstart restart tmm` on the Active unit fixes the issue.

Note - restarting tmm will impact all traffic processing on the unit

Fixed Versions:
21.1.0.3

2293617-1 : Management Interface Intermittently Goes Down During Bootup/Reboot

Links to More Info: BT2293617

Component: TMOS

Symptoms:
During the VM bootup process, either after creation or reboot, the management interface intermittently goes down, resulting in the loss of the SSH connection to the VM.

Conditions:
During bootup, if the `cloud-init-local.service` and `network.service` are executed concurrently, there’s a possibility that `network.service` will time out because the DHCP lease is temporarily held by `cloud-init-local`. The `cloud-init-local` service briefly activates the management interface to obtain the DHCP lease and metadata, after which it deactivates the interface. By the time this happens, `network.service` may have already exited, resulting in no active service to retry or re-establish the management interface

Impact:
SSH connection to the VM will be lost. The user can access the VM only from the console

Workaround:
Reboot the VM

Fix:
Run cloud-init-local.service after network.service so that the management interface and IP addresses are already available by the time cloud-init-local.service starts

Fixed Versions:
21.1.0.1

2292333-1 : BIG-IP Configuration utility vulnerability CVE-2026-63020

Links to More Info: K000161728

2291609-4 : ASM crashes when dynamic parameter name configured (rare configuration)

Links to More Info: BT2291609

Component: Application Security Manager

Symptoms:
BD process crash

Conditions:
ASM policy attached to a virtual server and flow level parameter configured as dynamic parameter name

Impact:
BIG-IP failover

Workaround:
N/A

Fix:
The issue has been resolved, and the crash no longer occurs after applying the fix.

Fixed Versions:
21.1.0.1, 21.0.0.3, 17.5.1.8, 17.1.3.4

2291277-1 : Limited support for long strings in Login/Logout expected or unexpected string configurations.

Links to More Info: BT2291277

Component: Application Security Manager

Symptoms:
Login/Logout expected and unexpected strings are supposed to support up to 1024 characters, but they fail to handle strings of this length.

Conditions:
Configuring 1024 characters with Login/Logout expected/unexpected string.

Impact:
After ASM is restarted, the bd process enters a restart loop.

Workaround:
Use shorter strings for those fields.

Fix:
1024 characters are now handled.

Fixed Versions:
21.1.0.2, 17.5.1.9

2290681-4 : Use-after-free on ABORT/TEARDOWN

Links to More Info: BT2290681

Component: Application Security Manager

Symptoms:
The tmm crash

Conditions:
Bot defense profile attached to a virtual

Impact:
BIG-IP failover

Fix:
Code fixed by memset zero on garbage struct at ABORT/TEARDOWN time

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

2290241-5 : Improve the timeout and failure handling logic for multiple TACACS authentication servers.

Links to More Info: BT2290241

Component: TMOS

Symptoms:
The timeout logic does not function properly when a TACACS server is reachable but fails to return an authentication response, resulting in a hang instead of moving to the next available server for authentication.

Conditions:
Set up two TACACS servers and configure them on the BIG-IP system.

Impact:
When the TACACS server is reachable but does not return an authentication response, the load balancer fails to move to the next TACACS server and remains stuck while attempting to authenticate the user.

Workaround:
None

Fix:
N/A

Fixed Versions:
21.1.0.2, 17.5.1.8

2290205-4 : APM Portal Access Fails to Parse ES13 Class Static Initialization Blocks (static {})

Links to More Info: BT2290205

Component: Access Policy Manager

Symptoms:
Apps hosted through portal access fails if they contain Static Class Initialization Blocks

Conditions:
Have an App hosted in Portal Access that uses Static Class Initialization Blocks

Impact:
Apps hosted through Portal Access will not work as intended

Fix:
Statis Class Initialization Blocks are now supported in Portal Access

Fixed Versions:
21.1.0.1

2290085-1 : Excessive OCSP requests from BIG-IP when accessing TMUI with Firefox or Safari using cert-LDAP authentication

Links to More Info: BT2290085

Component: TMOS

Symptoms:
When BIG-IP TMUI is configured with cert-LDAP authentication and OCSP validation, accessing the TMUI using Mozilla Firefox or Apple Safari browsers causes BIG-IP to send excessive OCSP requests to the responder approximately every 5 seconds.

Conditions:
This occurs when all of the following conditions are met:
-- BIG-IP TMUI is configured with cert-LDAP authentication with OCSP validation enabled.
-- The TMUI is accessed using Mozilla Firefox or Apple Safari browsers.

Impact:
This can overwhelm the OCSP responder and cause intermittent authentication failures or forced re-authentication on the TMUI.

Workaround:
Use Google Chrome or Microsoft Edge to access the BIG-IP TMUI, as these browsers reuse TLS sessions and do not trigger frequent OCSP requests.

Fix:
BIG-IP TMUI no longer sends excessive OCSP requests when accessed via Mozilla Firefox or Apple Safari browsers with cert-LDAP authentication and OCSP enabled.

Fixed Versions:
21.1.0.1, 21.0.0.3, 17.5.1.8, 17.1.3.4

2288617-1 : The SNAT pool is not applied to the virtual server when source address translation is not configured as SNAT.

Links to More Info: BT2288617

Component: TMOS

Symptoms:
When creating an LTM virtual server with source-address-translation and attempting to assign a pool to this property, the pool will not be applied unless the type is explicitly set to snat. Although it may appear successful, reviewing the LTM logs will reveal the correct log message indicating the issue.

Conditions:
Attempting to create an LTM virtual object with the source-address-translation pool property without configuring the type property.

Impact:
The LTM virtual object will be created, but the source-address-translation will not include a pool.

Workaround:
To work around this issue, users should configure source-address-translation and pool properties as usual, but ensure the type property is set to snat."

Fixed Versions:
21.1.0.2, 17.5.1.9

2285073-2 : AbandonedTaskSweep Removes Tasks Prematurely

Links to More Info: BT2285073

Component: Application Security Manager

Symptoms:
When an asynchronous worker reaches a lifecycle limit for memory or calls handled, it hands its remaining task queue off to another worker.
Some timing conditions exist where the AbandonedTaskSweep periodic job will remove an unfinished task (such as a BulkTask) before the new worker updates the status to finished.

Conditions:
Normal operations.

Impact:
When the update to the task fails, the impact is cosmetic, as the task was already successfully completed.
The result of the task will not be retrievable.

Workaround:
None

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

2284397-3 : iRules PEM::session IPv6 Address Subscriber-ID Lookup Causes "Pending Rule Abort" Errors

Links to More Info: BT2284397

Component: Policy Enforcement Manager

Symptoms:
- PEM::Session info irule fails, saying "Pending rule abort" error in logs
- iRule Execution aborts

Conditions:
Data traffic iRule should use PEM::Session info <ipv6-address> command

Impact:
Functional issue. iRule will not provide the expected result

Workaround:
None

Fix:
Fixed the issue

Changes ensure IPv6 lookups now use matching address formats and execute synchronously

Fixed Versions:
21.1.0.1, 21.0.0.3

2284341-5 : PEM Gx Session Bin Entry Stay Even After PEM Session Deletion.

Links to More Info: BT2284341

Component: Policy Enforcement Manager

Symptoms:
GGx sessions remain even after the deletion of PEM sessions.
The memory allocated to Gx sessions remains intact. As more PEM sessions are created and deleted, the memory for Gx sessions continues to grow and is not released.

Conditions:
This is a rare timing-based scenario in which the diam_app is busy sending requests to a non-responsive PCRF. As a result, the middleware (MW) message bus becomes full. When this happens, the notification from SPM to Gx to end the Gx session is dropped because the MW bus has reached its capacity.

Impact:
A slight increase in memory due to Gx sessions persisting even after PEM session deletion may lead to consequences over time, such as memory shortages.

Workaround:
None

Fix:
Measures were implemented to ensure the deletion of the Gx session if the PCRF is unresponsive and a Gx session cannot be established with it.

Fixed Versions:
21.1.0.1, 21.0.0.3

2279009-4 : With large configured receive-window-size, BIG-IP advertises non-zero SYN/SYN-ACK window, but zero window in final 3WHS ACK and all subsequent packets

Links to More Info: BT2279009

Component: Local Traffic Manager

Symptoms:
BIG-IP advertises non-zero window in SYN/SYN-ACK (as expected), but zero window in the final 3WHS ACK and in all subsequent packets, stalling the tcp connection forever.

Conditions:
Virtual server configured with a tcp profile having a Receive Window value ('receive-window-size' in tmsh) between 536862721 and 1073725440

Impact:
All tcp connections get stalled, both on the client-side and on the server-side.

Workaround:
Two possible workarounds.

- Configure a Receive Window value ('receive-window-size' in tmsh) to any value lower than 536862721.

- On the tcp profile, set the Initial Receive Window Size ('init-rwnd' in tmsh) to 64

Fixed Versions:
21.1.0.1, 21.0.0.3

2278945 : TMSH can intermittently crash due to thread cancellation

Links to More Info: BT2278945

Component: TMOS

Symptoms:
In some instances, TMSH may experience a segmentation fault if a thread is not properly cancelled

Conditions:
The crash was intermittent, but in certain situations, when a thread was improperly cancelled, TMSH could crash

Impact:
TMSH would crash without any immediate indication as to why

Workaround:
None

Fix:
Fixed an intermittent crash that could happen during process shutdown

Fixed Versions:
21.1.0.1, 21.0.0.3, 17.5.1.8, 17.1.3.4

2277637 : TMM may crash when using PQC DH group

Links to More Info: BT2277637

Component: Local Traffic Manager

Symptoms:
TMM experiences crashes on certain platforms when the PQC DH group is utilized

Conditions:
Enable the DH group X25519MLKEM768 on platforms that do not support the CPU feature AVX2

This may rarely include CPUs used on hypervisor systems, but more often will be due to virtualisation software not exposing the AVX2 feature set to the guest vCPUs.

F5 r2xx and r4xx lack AVX2.

Impact:
Service availability

Workaround:
If AVX2 instruction family is not exposed to guest then this might be a configuration issue on hypervisor, if hypervisor host CPU has the feature.
On ESXi, for example, guest virtual machine type 13 (compatibility with ESXi 6.5) and above for would be needed to expose AVX2 on guest vCPU.

If AVX2 not present then disable PQC DH group on BIG-IP.

Fix:
TMM uses software alternative when AVX2 instruction is not available.

Fixed Versions:
21.1.0.1

2269969-4 : Using TCP congestion BBR might lead to TMM core

Links to More Info: BT2269969

Component: Local Traffic Manager

Symptoms:
Using TCP congestion BBR might lead to TMM core

Conditions:
TCP congestion BBR is in use.

Impact:
TMM crash/core.

Workaround:
N/A

Fix:
N/A

Fixed Versions:
21.1.0.3

2267713-1 : BD might enter CPU loop

Links to More Info: BT2267713

Component: Application Security Manager

Symptoms:
BD might enter a CPU spin loop while processing specific traffic

Conditions:
- ASM is provisioned
- Security policy uses UTF-8 encoding
- JSON profile has a schema attached
- Traffic includes a JSON body with certain character combinations

Impact:
BD enters a CPU loop and crashes

Workaround:
None

Fix:
The characters' combination is now correctly processed

Fixed Versions:
21.1.0.3

2264845-4 : TMM may crash when enabling DNS Express

Links to More Info: BT2264845

Component: Global Traffic Manager (DNS)

Symptoms:
TMM may crash when enabling DNS Express.

Conditions:
Occurs when enabling DNS express feature with traffic actively hitting the modified virtual-server.

Impact:
TMM core crashes.

Workaround:
None

Fix:
N/A

Fixed Versions:
21.1.0.1, 21.0.0.3

2264037-1 : TMM may generate a core file after an SSL cipher group is deleted

Links to More Info: BT2264037

Component: Local Traffic Manager

Symptoms:
TMM crashes and generates a core file

Conditions:
- An SSL cipher group previously referenced by an SSL profile is removed from the configuration.
- Connections established while the profile referenced that cipher group remain active.
- At least one of those connections initiates a TLS renegotiation.

Impact:
Traffic interruption while TMM generates a core file and restarts.

Workaround:
Do not remove a cipher group if any active connections may still reference an older SSL profile that used it.

Fix:
N/A

Fixed Versions:
21.1.0.1, 21.0.0.3, 17.5.1.8

2264013-3 : Unable to retrieve the tower ID using an iRule when the user-location-info size exceeds 8 bytes.

Links to More Info: BT2264013

Component: Policy Enforcement Manager

Symptoms:
When creating a subscriber/session with user-location-info greater than 8 bytes and attempting to extract it using a custom iRule filter in the PEM policy.

Conditions:
Subscriber/session creation with user-location-info greater than 8 bytes (e.g., string length 0x + (2 * 8) = 18 characters).
Example: 0x001300621A2B3C4D.

Impact:
Unable to extract user-location-info using a custom iRule filter in the PEM policy.

Fix:
With the fix, user-location-info can now be extracted in all formats, with a maximum size of 13 bytes (equivalent to 28 characters in string length).

Fixed Versions:
21.1.0.1, 21.0.0.3

2263101 : TMSH rrset commands do not list DNS cache serve-expired records

Links to More Info: BT2263101

Component: Global Traffic Manager (DNS)

Symptoms:
With serve-expired enabled on a DNS cache resolver, records at TTL=0 no longer appear in the rrset cache via tmsh show and cannot be deleted via tmsh delete, yet they may still be served to clients as stale responses.

Conditions:
Serve-expired is enabled for a DNS cache resolver

Impact:
Records could still be served to clients as stale responses via the serve-expired mechanism.

Workaround:
N/A

Fixed Versions:
21.1.0.1

2262381-1 : Connection limit prompt is always displayed for the show sys connection command

Links to More Info: BT2262381

Component: TMOS

Symptoms:
When executing the show sys connection command, a yes/no prompt is always displayed for the max number of prompts, even if there are only a small number of connections.

Conditions:
Using the TMSH show sys connection command will result in a yes/no prompt.

Impact:
By default, the user is presented with a prompt that asks if they want to see 1000 connections. This is not the expected behavior if there are only a small number of connections.

Workaround:
None.

Fix:
The user will now be prompted only when the connections are equal to or more than the max-result-limit value. The default value of max-result-limit is 1000.

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

2261221 : SNMPv3 queries may return "Unknown user name" for a configured v3 user

Component: TMOS

Symptoms:
After adding or modifying an SNMPv3 user via tmsh or iControl REST, SNMPv3 queries may return an unknown user name even though the user is correctly listed in tmsh list sys snmp users

Conditions:
- An SNMPv3 user is created, modified, or deleted via tmsh or iControl REST
- SNMP configuration changes are issued in rapid succession with very little time interval in milliseconds
- An SNMPv3 query is issued immediately after the configuration change

Impact:
SNMPv3 monitoring may report an unknown user name, causing a false report even though the user is present with mcps

Workaround:
A slight delay between successive snmp configuration change queries. Now with this fix its resolved though

Fixed Versions:
21.1.0.3

2261137-5 : TMM may crash if DNS cache resolver concurrency settings are changed during live traffic

Links to More Info: BT2261137

Component: Global Traffic Manager (DNS)

Symptoms:
TMM crashes with a SIGSEGV and then restarts.

Conditions:
- The DNS cache resolver is configured and processing queries.
- A DNS cache-resolver object is changed, specifically a setting that alters max-concurrent-queries or max-concurrent-tcp.
- Live DNS traffic is in progress when the change is applied.

Impact:
Traffic is disrupted during a TMM restart, and the redundant unit fails over.

Fixed Versions:
21.1.0.3

2260905-3 : Full config-sync adds remotely authenticated user to sdm group in /etc/group on sync receiver

Links to More Info: BT2260905

Component: TMOS

Symptoms:
During a full config-sync on BIG-IP LTM (e.g., 17.5.1.x), remotely authenticated administrative users may be added to the sdm group in /etc/group on the sync receiver.

Conditions:
- BIG-IP is configured with remote authentication (e.g., LDAP, Active Directory, TACACS+).
- A remotely authenticated administrative user is used to access the system.
- A full config-sync operation is performed between BIG-IP devices.

Impact:
An inconsistency has been observed in the /etc/group file content between the sync initiator and the receiver.

Workaround:
NA

Fixed Versions:
21.1.0.3

2259777-1 : Spurious 'Config error: Error updating categories' messages are logged by each TMM during boot.

Component: Access Policy Manager

Symptoms:
On every TMM start, /var/log/ltm contains:

  err tmm[<pid>]: 01010007:3: Config error: Error updating categories in urlcat
  err tmm[<pid>]: 01010007:3: Config error: Error updating categories in urlcat items
  err tmm[<pid>]: 01010007:3: Config error: Error updating categories in classification

The triplet repeats twice per TMM and is logged by every TMM instance.

Conditions:
- Install BIG-IP 17.1.3.1.
- Occurs with any provisioning or licensing combination (reproducible with LTM-only).
- The issue arises during every TMM start, including boot, upgrade, or upon running bigstart restart tmm.

Impact:
This issue results in cosmetic log noise only and may trigger monitoring systems that parse /var/log/ltm for error-severity or 'Config error' strings. It does not affect URL categorization, filtering, classification, or traffic processing.

Fix:
Not Applicable

Fixed Versions:
21.1.0.3

2259609-1 : Wildcard deletes for tmsh ltm node fail without an error message

Links to More Info: BT2259609

Component: TMOS

Symptoms:
When trying to delete LTM node objects using a wildcard in the name, the command would execute, but it would fail silently, and no nodes would be removed.

Conditions:
Try to delete LTM node objects by using a wildcard in the name

Impact:
Any nodes that match the wildcard pattern will remain on the BIG-IP after the delete command is executed.

Workaround:
None.

Fix:
A delete ltm node command can now delete ltm node objects when a wildcard is used for the name

Fixed Versions:
21.1.0.1, 21.0.0.3, 17.5.1.8, 17.1.3.4

2259269-3 : CRLDP Agent Validates CRL Distribution Point URLs to Prevent Connections to Loopback and Link-Local Addresses

Links to More Info: BT2259269

Component: Access Policy Manager

Symptoms:
The CRLDP authentication agent in APM extracts CRL Distribution Point URLs from client certificate X.509 extensions and connects to the specified host without validating the destination IP address. This could allow a crafted client certificate to cause BIG-IP to initiate outbound connections to loopback or link-local addresses

Conditions:
-- BIG-IP APM is configured with client certificate authentication and CRLDP validation enabled
-- A client presents a certificate containing a CRL Distribution Point extension with a URL pointing to a loopback (127.x.x.x) or link-local (169.254.x.x) address
-- The certificate chains to a CA trusted by BIG-IP

Impact:
An attacker presenting a valid client certificate with a crafted CRL Distribution Point URL could cause APMD to make outbound HTTP or LDAP connections to loopback or link-local addresses, potentially accessing local services or cloud metadata endpoints

Workaround:
None

Fix:
The CRLDP agent now validates CRL Distribution Point URLs before initiating connections. URLs that resolve to loopback, link-local addresses are rejected. When a URL is blocked, the CRL is treated as unavailable, and existing APM CRLDP policies for CRL unavailability apply. The localhost hostname is also explicitly rejected

Fixed Versions:
21.1.0.1, 21.0.0.3

2258709-3 : Unable to delete an AS3 tenant partition due to cross-partition reference.

Links to More Info: BT2258709

Component: TMOS

Symptoms:
Unable to delete an AS3 tenant partition from BIG-IP LTM.
Partition deletion attempts fail with the following error:
0107082a:3: All objects must be removed from a partition (<name>) before the partition may be removed, type ID (9411).

Conditions:
-- BIG-IP system with AS3 tenant partitions deployed.
- -An iCall script is configured and active on the system.

Impact:
AS3 tenant partitions cannot be deleted even after all tenant-scoped objects are successfully removed.

Workaround:
Workaround 1: Manually remove the partition

rm -rf /config/partitions/<name>
Delete 'sys folder' and 'auth partition' for <name> in bigip_base.conf
tmsh load sys config verify
tmsh load sys config
forceload mcpd (#touch /service/mcpd/forceload) && reboot
guishell -c "select name,partition_id from tcl_user_proc_call_graph" ---> shows the partition NOT being referenced
Delete the partition using AS3 or the tmsh command

Workaround 2: Completely remove the ICALL_SCRIPT configuration

delete iApp (iApps ›› Application Services : Applications <ICALL_SCRIPT_IAPP>)
delete iAPP template (iApps ›› Templates : Templates <ICALL_SCRIPT_TEMPLATE>)
Delete 'sys folder' and 'auth partition' for <name> under bigip_base.conf
tmsh load sys config verify
tmsh load sys config
forceload mcpd (#touch /service/mcpd/forceload) && reboot
guishell -c "select name,partition_id from tcl_user_proc_call_graph" ---> As the ICALL_SCRIPT is deleted, no partitions are being referenced by one.
Delete the partition using AS3 or the tmsh command

Fixed Versions:
21.1.0.2, 17.1.3.4

2256985-3 : Authentication delays occur with REST API requests when using X-Forwarded-For.

Links to More Info: BT2256985

Component: TMOS

Symptoms:
Token-based authentication attempts via the iControl REST API to the /mgmt/shared/authn/login endpoint may experience significant delays when the request includes the X-Forwarded-For header and the device is configured with proxy servers.

Conditions:
This occurs when:

* REST API call issued to /mgmt/shared/authn/login endpoint as part of Token Authentication
* The X-Forwarded-For (XFF) header is included in the API login request.

Impact:
Authentication processes are delayed by 60 to 120 seconds due to unnecessary reverse DNS lookups on unparsed X-Forwarded-For (XFF) header values. If the DNS server drops the request or is unreachable, it can result in extended delays and authentication failures caused by timeouts.

Workaround:
* Exclude the X-Forwarded-For header from iControl REST API requests.

* Ensure DNS servers configured on the system is responsive to avoid prolonged lookups or returns NXDOMAIN error, if no such name exists.

Fix:
When a BIG-IP iControl REST API login request passes through one or more proxies, the X-Forwarded-For header may contain multiple comma-separated IP addresses. BIG-IP was incorrectly using this entire string as the client address during authentication, causing an unnecessary DNS lookup. When DNS servers were unreachable, this lookup timed out after 60-120 seconds, resulting in HTTP 401 Unauthorised. The fix corrects BIG-IP to extract only the original client IP address from the header before authentication, eliminating the DNS lookup. REST API login requests with X-Forwarded-For headers now complete successfully in under one second regardless of DNS availability.

Fixed Versions:
21.1.0.3, 17.5.1.9

2256681-1 : [APM] ECA random rumber fetch is stuck after forced TMM Core

Links to More Info: BT2256681

Component: Access Policy Manager

Symptoms:
After a forced TMM core, the ECA process may use abnormally high CPU indefinitely.

Conditions:
This issue occurs when:

1. TMM core is forcibly generated.
2. ECA attempts to fetch random numbers from TMM while TMM is unavailable or restarting.

Impact:
- The ECA process sustains high CPU usage.
- APM services may degrade.
- The issue persists until the ECA process is restarted.

Workaround:
Restart the ECA process to restore normal CPU utilization

Fix:
N/A

Fixed Versions:
21.1.0.3

2256657-1 : Some regular expressions in JSON schema can cause traffic to be blocked

Links to More Info: BT2256657

Component: Application Security Manager

Symptoms:
A legitimate request is blocked with a violation "JSON data does not comply with JSON schema"

Conditions:
- Violation "JSON data does not comply with JSON schema" is set to Block;
- JSON content profile with JSON schema file attached;
- The attached JSON schema contains a "pattern" field with a specific regex.

Impact:
Legitimate traffic may be blocked

Workaround:
N/A

Fix:
Handling of regular expressions in JSON schema was improved

Fixed Versions:
21.1.0.1, 21.0.0.3

2244561-1 : TMSH can crash during repeated creation/deletion of pool members

Links to More Info: BT2244561

Component: TMOS

Symptoms:
When pool members of repeatedly created and deleted, TMSH can crash. This could result in interrupting things like a script.

Conditions:
Pool members are repeatedly created and deleted.

Impact:
TMSH crashes, which can result in the interruption of things like a script that may be running TMSH commands.

Workaround:
None.

Fix:
In cases where TMSH would crash from repeated creation/deletion of pool members, TMSH should now provide an error back without crashing.

Fixed Versions:
21.1.0.3

2240957-4 : ASM Does Not Send a Webhook When a HTTP Proxy Server Is Used.

Links to More Info: BT2240957

Component: Application Security Manager

Symptoms:
Handshake failure logs observed in /var/log/asm:

ASM subsystem error (asmcrond,(eval)): Failed to send webhook:
ASM subsystem error (asmcrond,(eval)): 500 handshakefailed

Conditions:
Use webhook with a HTTP proxy server

Impact:
Cannot use webhook function when using a http proxy server

Workaround:
None

Fix:
Upgarde perl-LWP-Protocol-https from 6.04 to 6.10

Fixed Versions:
21.1.0.1, 21.0.0.3, 17.5.1.8, 17.1.3.4

2240889-1 : TMM route can unexpectedly overwrite MGMT kernel route

Links to More Info: BT2240889

Component: TMOS

Symptoms:
MGMT kernel route gets overwritten by a TMM route with the same destination and netmask as the MGMT kernel route.

Conditions:
1. VELOS tenant
2. mgmt route exists with a dest and netmask (ex. 192.0.2.0/24 dev mgmt proto kernel scope link src 192.0.2.24)
3. A TMM route is created with the same dest and netmask as the mgmt route: tmsh create net route test network 192.0.2.0/24 gw 198.51.100.1

Impact:
Mgmt route is no longer present in 'ip route' and gets overwritten by the TMM route created

Workaround:
Do not create a tmm route with the same destination and netmask as the mgmt route.
Filter out the mgmt route from the receiving dynamic route

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

2238385-1 : Some Regular Expressions In JSON Schema Can Cause Traffic To Be Blocked

Links to More Info: BT2238385

Component: Application Security Manager

Symptoms:
A legitimate request is blocked with a violation "JSON data does not comply with JSON schema"

Conditions:
- Violation "JSON data does not comply with JSON schema" is set to Block
- JSON content profile with JSON schema file attached
- The attached JSON schema contains a "pattern" field with a specific regex

Impact:
Legitimate traffic may be blocked

Workaround:
N/A

Fix:
Handling of regular expressions in JSON schema was improved

Fixed Versions:
21.1.0.1, 21.0.0.3

2230705-3 : SSL handshake failure with Session Ticket that is rejected by backend server

Links to More Info: BT2230705

Component: Local Traffic Manager

Symptoms:
SSL handshake failure occurs with "Connection error: ssl_hs_rx:5756: alert(10) unexpected msg" found in /var/log/ltm

Conditions:
- Server SSL profile is enabled with the Session Ticket feature
- Backend server also supports Session Ticket
- Backend server rejects the Session Ticket sent by the BIG-IP

Impact:
- Service is disrupted because of a handshake failure.

Workaround:
Disable the Session Ticket feature on the Server SSL Profile or the backend server.

Fixed Versions:
21.1.0.3, 17.5.1.9

2230613-4 : Bot defense stateful anomalies and microservices not fully enforced on blade setups

Links to More Info: BT2230613

Component: Application Security Manager

Symptoms:
Bot-Defense is failing to sync statefull anomalies (including microservices) between blades, causing partial enforcement.

Conditions:
Bot Defense is attached to VS, and includes a statefull anomalies enables, and/or microservices.
Instance contains blades (VELOS etc)

Impact:
Statefull anomalies and Microservices enforcement works on primary blade only.

Workaround:
N/A

Fix:
Fixed blades sync.

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

2230137-4 : Multicast forwarding entry might not be created during a traffic burst.

Links to More Info: BT2230137

Component: TMOS

Symptoms:
When handling a traffic burst of multicast traffic going to different multicast destinations, some multicast forwarding cache entries might not be created in TMM.

Conditions:
BIG-IP configured with multicast routing.

Impact:
Some multicast routes might not be created. Some streams might not be forwarded.

Workaround:
None

Fixed Versions:
21.1.0.3

2229893-5 : PEM mw_bus is missing stats in production builds

Links to More Info: BT2229893

Component: Policy Enforcement Manager

Symptoms:
Middleware runtime statistics are unavailable in production builds because middleware tmstat instrumentation is only enabled in debug builds

Conditions:
Running a production (non-debug) TMM build and attempting to inspect middleware runtime statistics for troubleshooting or post-incident analysis is not possible

Impact:
Reduced diagnosability for engineering and support teams, as middleware runtime statistics used for debugging and troubleshooting are unavailable in production builds. There is no impact on customer traffic handling or feature functionality

Workaround:
Use a debug build with middleware tmstat instrumentation enabled

Fix:
Middleware tmstat instrumentation is now enabled in production builds, providing access to middleware runtime statistics for troubleshooting and post-incident analysis while preserving existing functionality

Fixed Versions:
21.1.0.1, 21.0.0.3

2229525-4 : TMM crash due to stale shared memory mapping after wr_urldbd restart

Links to More Info: BT2229525

Component: Traffic Classification Engine

Symptoms:
When the webroot database (wr_urldbd) is restarted, tmm can crash.

Conditions:
wr_urldbd is restarted

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

Fix:
Fixed a race condition between TMM and wr_urldbd to ensure the correct shared memory is mapped while the database is actively being loaded by wr_urldbd.

Fixed Versions:
21.1.0.1, 21.0.0.3, 17.5.1.6

2227661-3 : Sys variable db tm.fw.defaultaction is honor when AFM is not provisioned

Links to More Info: BT2227661

Component: Advanced Firewall Manager

Symptoms:
Connections are dropped due to sys db variable tm.fw.defaultaction is set to drop when AFM is not provisioned.

Conditions:
-- LTM+ASM provisioned, AFM not provisioned
-- set "db tm.fw.defaultaction" to drop
-- send test traffic through a virutal server on the BIG-IP system

Impact:
Connections are dropped due to sys db variable tm.fw.defaultaction is set to drop when AFM is not provisioned.

Workaround:
Reset tm.fw.defaultaction to default value(accept):

tmsh modify sys db tm.fw.defaultaction value default

Fixed Versions:
21.1.0.3

2221941-4 : IP Intelligence Incorrectly Programs FPGA/HW Shun for Legitimate Endpoints Due to Stray Post-Session ACK After Flow Teardown, Blocking New Subscriber Connections

Links to More Info: BT2221941

Component: Advanced Firewall Manager

Symptoms:
When a subscriber's TCP session to a blocked website ends, the remote server may send a stray acknowledgment packet to the BIG-IP. As there is no active session for this packet, the BIG-IP views it as unsolicited traffic and blocks that IP address in hardware. This action causes all new subscriber connections to that website to be dropped until the hardware entry expires.

Conditions:
AFM is provisioned with an IP Intelligence global policy using a feed list
-- The platform supports SPVA hardware offload, and force_sw_dos is not enabled
-- A subscriber initiates a TCP session to an endpoint whose IP address is present in the feed list
-- The session is torn down (client sends RST-ACK; BIG-IP tears down the flow and forwards the RST-ACK to the endpoint)
-- The remote endpoint sends a packet back to BIG-IP after the session entry has already been removed

Impact:
The entire subscriber base at an ISP/SP deployment can lose access to websites present in the IPI feed lists, even when subscribers are the initiating party. IPI is rendered unusable in subscriber-facing service provider environments

Workaround:
Disable SPVA hardware offload for IPI by setting force_sw_dos true (trades hardware blocking for software-only enforcement, with performance impact), or remove the global IPI policy. Neither is acceptable long-term for ISP deployments

Fix:
- SP Endpoint Tracking: The SP Endpoint tracking feature for the IPI global policy allows tracking of blocked endpoint IPs in a per-TMM database with three states: NONE, NEG, and POS. When enabled via "tmsh modify sys db dos.ipint.sp_endpoint.enabled value true" (requires TMM restart), if a subscriber connects to a blocked endpoint, it is promoted to POS, allowing traffic through in software, while unsolicited inbound traffic is still dropped. This feature is disabled by default and requires opt-in

- SPVA Programming Rate Gate: A configurable per-source rate threshold for SPVA hardware shun programming is introduced, controlled by "tmsh modify sys db dos.ipint.spva.global.program_rate value <N>". When set to N (pps), hardware shun is programmed only if the source packet rate meets or exceeds N packets per second. The default value of 0 maintains existing behavior of immediate HW programming

Fixed Versions:
21.1.0.1, 21.0.0.3

2218309 : CVE-2025-22026 kernel: nfsd: don't ignore the return code of svc_proc_register()

Links to More Info: K000160079, BT2218309

2217657-3 : An intermittent chmand core dump is observed during the boot process.

Links to More Info: BT2217657

Component: TMOS

Symptoms:
A core file similar to the following is generated:
chmand.bld0.0.<build>.core.gz

Crash signature:

SIGSEGV (Segmentation fault)
Seen in:
publish_system_information()
hal_mcpif.cpp
std::auto_ptr<Publisher>::operator->()

Conditions:
- Occurs intermittently during:
   System boot
   ISO installation
   HA (High Availability) creation

- Observed across multiple branches:
  21.1.x
  21.0.x
  17.5.x
  17.1.x

- Trigger scenarios include:
  Installation of BIG-IP image
  HA setup initiation
  BVT / automation pipelines execution

Impact:
The issue results in a chmand process crash and generates a core file during system initialization. While no consistent functional outage has been reported after the system completes booting, the crash during the initialization phase presents a potential system stability concern.

Fix:
None

Fixed Versions:
21.1.0.1, 17.5.1.8, 17.1.3.4

2208413-4 : APM NLAD encounters a "Too many open files" error

Links to More Info: BT2208413

Component: Access Policy Manager

Symptoms:
Following message is seen in /var/log/apm .
Dec 11 04:42:01 <example.com> err nlad[xxxx]: xxxxxxx:3: <0xxxxxx> client[109]: DC[x.x.x.x]: schannel[x]: STL exception: eventfd_select_interrupter: Too many open files

Conditions:
Occurs when there are frequent changes to the NTLM configuration while active user sessions are using the current configuration.

Impact:
When NLAD exhausts its file descriptors, NTLM user authentication fails.

Workaround:
Restarting TMM with bigstart should resolve the issue.

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

2207893-2 : Error seems to indicate DTDI not DTCA certificate has expired

Links to More Info: BT2207893

Component: TMOS

Symptoms:
Error seems to indicate DTDI not DTCA certificate, has expired:
Unexpected Error: Could not add device (error from devmgmtd): The device (/Common/error-bigip2.moskal) certificate expired on Jan 16 13:00:19 2026 GMT

Conditions:
Configure an HA pair of BIGIP devices and set the system clock back just over 10 years. Regenerate the trust domain and update the date back to the present day, then try to add a Device Trust Member

Impact:
- The error when a device trust member is being added is misleading for the customers
- The error seems to indicate the DTDI certificate has expired, not the DTCA certificate

Workaround:
Reset device trust and generate a new CA certificate, and then re-establish device trust

Fix:
Changed the code for the error msg to indicate that DTCA certificate has expired instead of DTDI

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

2201145-2 : Added support for the TLS 1.3 cipher suites TLS13_AES_128_CCM and TLS13_AES_128_CCM_8

Links to More Info: BT2201145

Component: Local Traffic Manager

Symptoms:
When the client sends requests using the TLS 1.3 CCM or CCM_8 cipher suites, the handshake fails with a ‘no shared cipher suite’ error.

Conditions:
Configure the client to send requests using the TLS 1.3 CCM and CCM_8 cipher suites.

Impact:
The handshake fails with a ‘no shared cipher suite’ error.

Workaround:
There is no workaround. If the client sends a request using the TLS 1.3 CCM or CCM_8 cipher suites, the handshake will fail.

Fix:
Support for the TLS 1.3 CCM and CCM_8 cipher suites has been added, allowing the handshake to succeed when the client sends these cipher suites to BIG-IP.

Fixed Versions:
21.1.0.1, 17.5.1.6, 17.1.3.5

2200053-1 : Virtual interfaces inside the F5OS tenant are going into 'uninit' state

Links to More Info: BT2200053

Component: TMOS

Symptoms:
Some virtual network interfaces were stuck in the “uninit” state on the active BIG-IP tenant.

Conditions:
-- F5 CX1610 chassis with BX520 blade
-- Reboot the standby BIG-IP device first, then wait for one minute and reboot the active BIG-IP device.

Impact:
Virtual interfaces can get stuck in the "uninit" state.

Workaround:
None.

Fixed Versions:
21.1.0.1, 21.0.0.3, 17.5.1.8, 17.1.3.4

2199541-2 : BIG-IP GUI auth-pam-idle-timeout behaves as if capped at 1200 seconds when configured with higher values

Links to More Info: BT2199541

Component: TMOS

Symptoms:
BIG-IP GUI users are logged out after 1200 seconds of inactivity, regardless of the configured value of sys httpd auth-pam-idle-timeout when the value exceeds 1200 seconds.

HTTPD / mod_auth_pam debug logs explicitly report:

AUTHCACHE Error processing cookie XXXXX - Cookie Expired (idle_timeout=1200)

Conditions:
Sys httpd auth-pam-idle-timeout is configured to a value greater than 1200 seconds.

Impact:
GUI users are logged out after 1200 seconds of inactivity.

Workaround:
Login back with the same credentials once after getting logged out

Fixed Versions:
21.1.0.3, 17.1.3.2

2197305-4 : BIG-IP generates invalid SSL key share

Links to More Info: BT2197305

Component: Local Traffic Manager

Symptoms:
SSL handshakes fail on the client due to an Illegal Parameter alert.

Conditions:
ClientSSL that mixes both FFDHE and Non-FFDHE groups and has session tickets enabled.

The client tries to resume an SSL session with a Non-FFDHE key share that used FFDHE previously.

Impact:
SSL handshake fails and the connection terminates

Workaround:
None

Fixed Versions:
21.1.0.1, 21.1.0, 17.5.1.9

2187141-4 : DNS generic server stuck offline after monitor removal

Links to More Info: BT2187141

Component: Global Traffic Manager (DNS)

Symptoms:
Removing the monitor from the virtual server can leave the DNS generic server stuck in “Offline (Enabled) – No enabled virtual server available.”

Conditions:
Removes a monitor from the Virtual Server and uses a Generic Server type.

Impact:
The generic server shows the same status as the Virtual Server.

Workaround:
NA

Fixed Versions:
21.1.0.3

2186185-4 : Apmd occasionally fails to process a request if SecurID agent is present

Links to More Info: BT2186185

Component: Access Policy Manager

Symptoms:
Apm logs reports errors similar to following:

apmd[32302]: 01490000:3: ApmD.cpp func: "process_apd_request()" line: 2101 Msg: Error 3 reading/parsing response from socket 1023. strerror: Too many open files, queue size 0, time since accept 0 apm 2025-11-10 09:12:49.000 -07:00 Error
apmd[32302]: 01490000:3: HTTPParser.cpp func: "readFromSocket()" line: 117 Msg: epoll_create() failed [Too many open files].

Conditions:
SecuridAuth agent is enabled

Impact:
APMD stops processing further traffic and users are denied access

Workaround:
Restart APMD using the following command:

bigstart restart aced
bigstart restart apmd

Fixed Versions:
21.1.0.2

2185537-4 : Application Security Administrator role cannot edit the General Settings of parent policies from the GUI

Links to More Info: BT2185537

Component: Application Security Manager

Symptoms:
When attempting to edit a parent ASM policy through the GUI, options under the General Settings tab will be greyed out or disabled.

Conditions:
A user with the Application Security Administrator role is logged in and attempting to edit the General Settings of a parent ASM policy through the GUI.

Impact:
Accounts with the Application Security Administrator role will be unable to edit the General Settings of a parent ASM policy through the GUI

Workaround:
By using REST calls instead of the GUI, Application Security Administrators can still make the necessary edits.

Fixed Versions:
21.1.0.3

2183917-4 : BIG-IP might fail to update received TCP window when tm.tcpstopblindinjection is enabled

Links to More Info: BT2183917

Component: Local Traffic Manager

Symptoms:
BIG-IP might fail to update received TCP window when tm.tcpstopblindinjection db variable is enabled (CVE-2025-58424).

Conditions:
The tm.tcpstopblindinjection db variable is enabled (CVE-2025-58424 ).

This does not always occur.

Impact:
TCP transfer might stall.

Workaround:
None

Fixed Versions:
21.1.0.3

2181777-4 : Aced crash observed during RSA SecurID Authentication failure

Links to More Info: BT2181777

Component: Access Policy Manager

Symptoms:
During RSA SecurID authentication failure, aced crash is observed due to too many open FDs

Conditions:
RSA Authentication enabled and VPN resource attached

Impact:
Aced crash is observed along with RSA SecurID failure.

Workaround:
Fail over to the standby device.

Fix:
RSA Authentication is successful and aced crash is not observed.

Fixed Versions:
21.1.0.2

2163809 : Excluded X25519 DH group from f5-cc-stip-ciphers and f5-cc-ciphers cipher-rule

Links to More Info: BT2163809

Component: Local Traffic Manager

Symptoms:
f5-cc-stip-ciphers and f5-cc-ciphers cipher-rule use the DEFAULT DH group. The DEFAULT DH group was adding X25519, which is not a Common Criteria-approved cipher

Conditions:
- Configure clientssl and serverssl with "f5-cc-stip-ciphers" or "f5-cc-ciphers"
- Configure virtual server with the same clientssl or serverssl profile

Impact:
A virtual server will accept a connection with the X25519 DH group

Workaround:
Create a custom cipher rule with the excluded X15529 DH group

Fix:
Removed X25519 DH group from "f5-cc-stip-ciphers" or "f5-cc-ciphers" cipher-rule

Fixed Versions:
21.1.0.1

2162285-3 : Swapping IP address between virtual server via cli transaction results in "EDENY" conf_status and traffic not accepted

Links to More Info: BT2162285

Component: Local Traffic Manager

Symptoms:
After a configuration change, a virtual server is not accepting traffic

Conditions:
If 2 Virtual servers destination IP are swapped via a cli transactions, no error messages are displayed leading to believe it was accepted. Although the configuration has changed, traffic is not processed.

# create cli transaction
[batch mode]# modify ltm virtual vs1 destination 20.20.20.20:80
Command added to the current transaction
[batch mode]# modify ltm virtual vs2 destination 10.10.10.10:80
Command added to the current transaction
[batch mode]# submit cli transaction

tmm logs will show these messages:

err tmm[2367]: 01010009:3: Failed to bind to address
err tmm[2367]: 01010008:3: Listener config update failed for /Common/vs2: ERR:ERR_USE

Impact:
No traffic

Workaround:
Directly swap using tmsh directly using a 3rd temporary destination address:

tmsh modify ltm virtual vs1 destination 30.30.30.30:80
tmsh modify ltm virtual vs2 destination 10.10.10.10:80
tmsh modify ltm virtual vs1 destination 20.20.20.20:80

Fixed Versions:
21.1.0.3

2154089-2 : "Test" button for monitor object is missing.

Component: TMOS

Symptoms:
Local Traffic >> Monitors >> select monitor >> fill in IP and port >> "Test" button is missing.

Conditions:
Need to test BIG-IP monitors via GUI.

Impact:
Impossible to test monitor from GUI.

Workaround:
Use tmsh instead of GUI for testing the monitor:
K60677941: Verifying monitor configurations using the tmsh utility

Fixed Versions:
21.1.0.3

2151381-1 : nShield nethsm key generation fails

Links to More Info: BT2151381

Component: Local Traffic Manager

Symptoms:
nShield nethsm key generation fails when using TMSH. Key creation is successful when using nShield utility and installing that key on BIG-IP.

Conditions:
This condition occurs when rfs-sync -c takes more than 30 seconds to sync the newly generated keys.

Impact:
Due to increase in rfs-sync -c, the key creation timeout is triggered and key creation fails.

Workaround:
None

Fixed Versions:
21.1.0.3, 17.1.3.2

2150869-7 : Incorrect information for count of failed login for a user

Links to More Info: BT2150869

Component: TMOS

Symptoms:
/var/log/secure and /var/log/audit show incorrect information for the count of failed logins for a user

Conditions:
A user fails to login either through CLI or GUI

Impact:
Incorrect information in logs can be misleading

Workaround:
None

Fixed Versions:
21.1.0.3

2143109-3 : BIG-IP VE with more CPU cores than licensed enters TMM restart loop (TMM PU (<num_cores>) >= number of PUs (<num_licensed_cores>)) after mcpd restart

Links to More Info: BT2143109

Component: TMOS

Symptoms:
Mcpd crash or restart causes TMM to enter a restart loop.
Log - notice TMM PU (7) >= number of PUs (4)
Device becomes unreachable in the data plane.

Conditions:
BIG-IP VE with more vCPUs than licensed cores.
Example: 8-core Azure instance with a 4-core VE license.

Modules: AFM (nominal) and AVR (minimum) provisioned.

Occurs after mcpd restart or crash.

Impact:
System enters a TMM restart loop and remains offline.
Traffic processing and configuration access are unavailable until manual correction.

Workaround:
Manually set the provision.tmmcount DB variable to match the licensed core count, then restart services or reboot.

For example on an 8-core instance which is licensed for only 4-cores:

  tmsh modify sys db provision.tmmcount value 4

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

2141373-3 : MCPD crash during dossier validation when /shared/vadc/.hypervisor_type contains invalid or empty (DossierValidator::get_cloud_type)

Links to More Info: BT2141373

Component: TMOS

Symptoms:
Mcpd crashes repeatedly during startup.

/shared/vadc/.hypervisor_type is empty or contains invalid data.

Conditions:
-- The BIG-IP system is deployed in GCP
-- The system is licensed via BIG-IP CM version 8.3.0

Impact:
System fails to license, mcpd crashes repeatedly. System disrupted while mcpd restars.

Workaround:
Move the file /shared/vadc/.hypervisor_type to a temp directory

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

2141297-3 : In TLSv1.3, BIG-IP enforces the use of FFDHE key share if it is preferred over other DH groups★

Links to More Info: BT2141297

Component: Local Traffic Manager

Symptoms:
The BIG-IP system sends back an FFDHE key share that forces the client to also use FFDHE, even if the client sent a key share that is still acceptable to the BIG-IP.

Conditions:
The BIG-IP system is configured to prefer an FFDHE DH group and the client sends the same FFDHE DH group as supported but sends a key share for a different DH group.

Impact:
Clients are forced to use the FFDHE group for its key share even if the client sent a key share that is still acceptable to the BIG-IP

Workaround:
Either remove the FFDHE groups, or reorder DH group preferences so that FFDHE groups are not preferred over other groups.

Fixed Versions:
21.1.0.3

2138273-7 : Named service fails to start after an upgrade due to unsupported attributes in the named.conf file★

Links to More Info: BT2138273

Component: SSL Orchestrator

Symptoms:
Named fails to start with the following error after upgrading from older versions to 17.0 or newer releases due to the dnssec-lookaside and dnssec-enable options in the named.conf configuration file, which have been deprecated and are no longer supported in the latest BIND versions.

Logs in /var/log/daemon.log :
Oct 22 14:08:00 localhost.localdomain err named[16313]: /config/named.conf:35: option 'dnssec-lookaside' no longer exists
Oct 22 14:08:00 localhost.localdomain crit named[16313]: loading configuration: failure
Oct 22 14:08:00 localhost.localdomain crit named[16313]: exiting (due to fatal error)
Oct 22 14:08:00 localhost.localdomain notice systemd[1]: named.service: main process exited, code=exited, status=1/FAILURE
Oct 22 14:08:00 localhost.localdomain notice systemd[1]: Unit named.service entered failed state.
Oct 22 14:08:00 localhost.localdomain warning systemd[1]: named.service failed.

Conditions:
-- SSL Orchestrator System Settings >> DNS settings have been specified.
-- SSL Orchestrator L3 Explicit Topology Configured using the default SSL Orchestrator DNS resolver.
-- Check the BIND Version: Use the following command:
Example:
For example :
# named -v
BIND 9.11.36 (Extended Support Version) <id:68dbd5b>

Notes:

-- Starting with BIND 9.9, the dnssec-lookaside validation (DLV) feature was deprecated. By BIND 9.11, this feature was removed entirely.
-- Beginning with BIND 9.16, the dnssec-enable option was deprecated and subsequently removed.

Impact:
SSL Orchestrator will fail to resolve hostnames for the L3 Explicit topology causing end-to-end traffic to fail.

Workaround:
- Redeploy the affected L3 Explicit topology - this will use the native DNS resolver implementation and will no longer rely on BIND or named service, ensuring that end-to-end SSL Orchestrator traffic functions properly.


To fix the named service:

-- Remove the deprecated directives dnssec-lookaside and dnssec-enable from the BIND configuration file located at:
/var/named/config/named.conf.
-- After making these changes, restart the named service to apply the updated configuration by running the following command: bigstart restart named

Fix:
Fix will ensure that deprecated BIND options are removed from the named.conf file during the upgrade, allowing the named service to start without any issues and ensuring that SSL Orchestrator L3 Explicit end-to-end traffic functions correctly.

Fixed Versions:
21.1.0.1

2077625-3 : Changes in API Protection Profile not updated in Per Request Policy

Links to More Info: BT2077625

Component: Access Policy Manager

Symptoms:
Currently there is no implementation for the update and delete operation of the Classify API Request (RCA).

Conditions:
The path modified inside an API Protection profile are not updated in the Per Request Policy

Steps to Reproduce:
-- Navigate to Access > API Protection > Profiles
-- Create a profile "Test"
-- Inside the profile, create a path to /Document and save
-- Verify Access Control tab -> Per Request Policy > Edit
-- Close the visual tab and reopen "Paths" tab
-- Edit the /Document path to /Document/test/*
-- Save

Impact:
Unable to see the changes

Workaround:
None

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.1

2053489-4 : Config Sync events may not be recorded in audit log

Links to More Info: BT2053489

Component: TMOS

Symptoms:
When a command is issued on a BIG-IP system to sync configuration to a Device Group from a given Device in the Device Group, the config sync command may not be recorded in the audit log on the device where the command was issued.
The audit log may not record this command, even though subsequent log messages in other log files may indicate successful completion of the config sync action.

Conditions:
This may occur when:
-- Issuing the command to sync configuration from a Device to a Device Group in which it is a member.
-- Issuing such a command from either the command-line interface (tmsh) or from the BIG-IP GUI (tmui).
-- Accepting the default/offered suggestion for the Device whose configuration is to be synced to the Device Group.
For example:
-- In the GUI, accepting the default selection indicated by the active radio button for which Device to sync to the Device Group, and clicking Sync.
-- In the CLI, issuing the "tmsh run cm config-sync" command with the "to-group" option from the Device which is suggested by the "tmsh show cm sync-status" command.

Impact:
When attempting to diagnose issues that occur in the context of syncing configuration across Devices in a Device Group, it may not be clear where, when, and by whom the command to initiate the config sync was issued.

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

2047145-2 : HA peer devices are not displayed by the iControl REST API

Links to More Info: BT2047145

Component: TMOS

Symptoms:
When a BIG-IP high-availability pair is properly configured and functioning as expected, the following iControl REST endpoint might return only the local device instead of both HA devices:

/mgmt/shared/resolver/device-groups/tm-shared-all-big-ips/devices

Consequently, applications or BIG-IP GUI workflows utilizing this endpoint may fail to display or recognize the HA peer. This issue has been reported to affect the SSL Orchestrator HA workflows related to the user interface

Conditions:
This issue occurs when all of the following conditions apply:

- A BIG-IP high-availability pair is configured, and the HA relationship is otherwise healthy

- The REST device-discovery endpoint is queried:

   /mgmt/shared/resolver/device-groups/tm-shared-all-big-ips/devices

- The endpoint returns only the local BIG-IP device instead of both HA members

Impact:
The high-availability (HA) pair may continue to show a healthy failover and configuration-sync status, but REST-based device discovery might provide incomplete information. As a result, management interfaces or integrations that rely on REST device discovery could mistakenly display only one device or fail to recognize the peer device

Workaround:
None

Fix:
The issue was corrected in the REST device-discovery implementation

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

2046521-2 : On webtop default description of Desktops and Apps should be "Horizon Desktop" and "Horizon Application"

Links to More Info: BT2046521

Component: Access Policy Manager

Symptoms:
When vmware VDI is used, on webtop user observe "VMware View Desktop" and "VMware View Application." as names, instead of Omnissa Desktop/App.

Conditions:
APM Vmware VDI is used with webtop

Impact:
User still see vmware even after rebranding is done.

Workaround:
None

Fix:
User should not see vmware in names.

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.5

2034733-1 : Some "log-publisher" parameters may change upon running 'load sys config current-partition' command in other partition.

Links to More Info: BT2034733

Component: TMOS

Symptoms:
If you are in a non-common partition in tmsh and run "load /sys config current-partition", "log-publisher" options under "security firewall config-change-log (AFM)" and under "net ipsec ike-daemon ikedaemon" might change to "none".

Conditions:
Load other (non "/Common") partition configuration by running "load /sys config current-partition" TMSH command.

Impact:
"log-publisher" config might be reset to "none".

Workaround:
After running into the issue, manually set log-publisher by TMSH as needed.

# tmsh modify security firewall config-change-log log-publisher local-db-publisher
# tmsh modify net ipsec ike-daemon ikedaemon log-publisher default-ipsec-log-publisher

Fixed Versions:
21.1.0.2, 17.1.3.5

2034333-3 : GetTabSet.jsp error page

Links to More Info: BT2034333

Component: TMOS

Symptoms:
When GetTabSet.jsp throws a 500 error it prints an unhelpful error page

Conditions:
GetTabSet.jsp throws a 500 error

Impact:
An unhelpful error message is displayed.

Workaround:
None

Fix:
Fixed an issue with getTabSet.jsp

Fixed Versions:
21.1.0.3

2014373-1 : Tmm SIGSEGV crash

Links to More Info: BT2014373

Component: Advanced Firewall Manager

Symptoms:
TMM core analysis suggests that spva code received an FSD from HSB with type 14 (sPVA FSD). When the code was processing the FSD, TMM crashed because the grey list flood entry was NULL. This entry was NULL on all TMM threads

Conditions:
NA

Impact:
Traffic disrupted while TMM restarts

Workaround:
None

Fix:
Fixed TMM core SIGSEGV in spva_gl_ddos_find_tuples

Fixed Versions:
21.1.0.1

2011297-3 : Apmd Core generated during apmd cleanup

Links to More Info: BT2011297

Component: Access Policy Manager

Symptoms:
Apmd Core is generated.

Conditions:
Apmd restart is triggered.

Impact:
A core file is generated during apmd shutdown.

Workaround:
None

Fixed Versions:
21.1.0.2, 17.5.1.9, 17.1.3.4

2008117-1 : The Machine Certificate check POST payload is not acknowledged by APM."

Links to More Info: BT2008117

Component: Access Policy Manager

Symptoms:
APM logins intermittently fail when the Machine Certificate check POST payload exceeds the MSS during login. The client-side connection acknowledges all POSTed data; however, the server-side gets stuck, and no connection flow is established.

Conditions:
The access policy includes a Machine Certificate Authentication agent.

Impact:
On BIG-IP APM systems configured with a Machine Certificate Authentication agent, POST requests for the machine certificate check may fail to receive an acknowledgment (ACK) or HTTP response from APM. As a result, the client waits for approximately 20 seconds before resetting the connection.

Workaround:
tmsh modify ltm profile tcp <profile_name> mss 1400

Fix:
Use the following tmsh command to modify the MSS value of a TCP profile to 1400:

"tmsh modify ltm profile tcp <profile_name> mss 1400"

Fixed Versions:
21.1.0.1, 17.1.3.4

2007425-1 : iRule accepts semicolon to comment out a line

Links to More Info: BT2007425

Component: TMOS

Symptoms:
When a semicolon is used to comment out line of code in an iRule via configuration utility, the BIG-IP system accepts this when it shouldn't.