CVE Alert: CVE-2025-46706 – F5 – BIG-IP

Risk verdict

High risk of remote denial-of-service via memory resource exhaustion on BIG-IP deployments where an iRule uses HTTP::respond; currently no active exploitation detected.

Why this matters

Uncontrolled memory growth can degrade or disable services, impacting availability and user experience. Realistic attacker goals include degrading performance or triggering outages on internet-facing or internal applications, especially in environments relying on iRules for traffic shaping.

Most likely attack path

Remote, unauthenticated exploitation over the network against a virtual server containing an iRule with HTTP::respond. No user interaction required; attacker capitalises on low attack complexity and unauthenticated access to trigger resource growth. Preconditions include: an affected BIG-IP instance with the vulnerable iRule in use; unchanged scope; no privileges required.

Who is most exposed

Organizations deploying BIG-IP in public-facing or critical internal services, particularly where iRules are heavily used and older or unsupported branches are in use. Environments with large, shared virtual servers or high request rates are at higher risk.

Detection ideas

• Sudden spikes in memory/CPU usage on affected BIG-IP devices.
• Alerts for unusual HTTP::respond usage in iRules or anomalous response sizes.
• Logs showing repeated HTTP::respond hits on a virtual server.
• Performance monitoring showing degraded availability without other root causes.
• Unexpected crash dumps or failovers linked to iRule processing.

Mitigation and prioritisation

• Patch to supported versions; apply vendor-recommended updates promptly.
• Review and remove or disable non-essential iRules containing HTTP::respond; implement strict change control.
• Enable rate limiting, WAF rules, or traffic throttling around vulnerable endpoints.
• Validate configurations in non-production environments before rollout; plan a staged update.
• Monitor memory utilisation and set alerts for early signs of resource pressure. If KEV or EPSS indicators emerge, treat as priority 1.