PT-2025-42352 · F5 · Big-Ip Advanced Waf+1

Published 2025-10-15 · Updated 2025-10-23 · CVE-2025-61938

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions BIG-IP Advanced WAF or ASM (affected versions not specified)

Description When a BIG-IP Advanced WAF or ASM security policy is configured with a URL exceeding 1024 characters in length for the Data Guard Protection Enforcement setting, the bd process can terminate repeatedly. This issue occurs whether the URL is configured manually or through the automatic Policy Builder.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1284

Related Identifiers

CVE-2025-61938

Affected Products

Big-Ip Advanced Asm

Big-Ip Advanced Waf

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-61938 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61938 · Vendor Advisory
• https://my.f5.com/manage/s/article/K000156624 · Vendor Advisory
• https://t.me/aptreports/23110 · Telegram Post
• https://t.me/cveNotify/139763 · Telegram Post
• https://t.me/CVEtracker/34996 · Telegram Post
• https://twitter.com/CVEnew/status/1978545082484887661 · Twitter Post