CVE DATABASE / CVE-2021-22991

CVE-2021-22991

F5 BIG-IP Traffic Management Microkernel Buffer Overflow

CVSS 9.8 · CRITICAL ⚠ CISA KEV — ACTIVELY EXPLOITED

On the CISA KEV catalog

Confirmed exploited in the wild. Added 2022-01-18. Federal remediation due 2022-02-01.
Required action: Apply updates per vendor instructions.

Summary

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE). Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

CVSS 3.1 breakdown

Base score	9.8 (CRITICAL)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector	NETWORK
Attack complexity	LOW
Privileges required	NONE
User interaction	NONE
Scope	UNCHANGED
Confidentiality	HIGH
Integrity	HIGH
Availability	HIGH

Weakness type (CWE)

CWE-119

Affected products

F5 big-ip access policy managerF5 big-ip advanced firewall managerF5 big-ip advanced web application firewallF5 big-ip analyticsF5 big-ip application acceleration managerF5 big-ip application security managerF5 big-ip ddos hybrid defenderF5 big-ip domain name systemF5 big-ip fraud protection serviceF5 big-ip global traffic managerF5 big-ip link controllerF5 big-ip local traffic managerF5 big-ip policy enforcement managerF5 ssl orchestrator

Check this CVE live

Use our free CVE Lookup tool for the latest NVD record, or browse the full CISA KEV catalog.

References

Data: NIST NVD + CISA KEV. NVD last modified 2025-10-27. Always verify against the vendor advisory before acting.