CVE-2025-22846
When SIP Session and Router ALG profiles are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
- EPSS probability
- 0.41%
- CWE
- CWE-404
- Published
- 2025-02-05
- Last modified
- 2026-03-13
Affected products
- F5 BIG-IP
- F5 BIG-IP
- F5 BIG-IP
- F5 BIG-IP Next SPK
- F5 BIG-IP Next SPK
Weakness type
Related vulnerabilities
- CVE-2026-41869 — Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)
- CVE-2026-86515 — vgmstream txtp txtp_parser.c add_entry resource consumption
- CVE-2026-86511 — java-json-tools jackson-coreutils JacksonUtils.java BigDecimal.toPlainString resource consumption
- CVE-2026-86319 — java-json-tools json-patch Patch Operation JsonPatch.java JsonPatch.apply resource consumption
- CVE-2026-85407 — Eleveo Quality Management Conversation events denial of service
- CVE-2026-85100 — 2FastLabs agent-squad Streaming Agent Response Workflow orchestrator.ts AgentSquad.routeRequest resource consumption
- CVE-2026-84887 — simular-ai Agent-S Model-generated GUI Action Execution Workflow grounding.py denial of service
- CVE-2026-84886 — simular-ai Agent-S OCR HTTP API ocr_server.py ImageData resource consumption