SB2026051423 - Denial of service when handling HTTP/2 requests in F5 BIG-IP products
Published: May 14, 2026
Security Bulletin ID
SB2026051423
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) NULL pointer dereference (CVE-ID: CVE-2026-42409)
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a null pointer dereference in the Traffic Management Microkernel (TMM) process when handling undisclosed requests to a virtual server configured with an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command. A remote attacker can send a crafted request to cause a denial of service.
This is a data plane issue only, with no control plane exposure.
Remediation
Install update from vendor's website.