CVE-2026-94127

Name of the Vulnerable Software and Affected Versions BIG-IP APM version 21.1.0 BIG-IP APM versions 17.5.0 through 17.5.1 BIG-IP APM versions 17.1.0 through 17.1.3

Description An unauthenticated heap-based buffer overflow exists when BIG-IP APM is configured as an OAuth Authorization Server with an access policy and an OAuth profile on a virtual server. This issue allows a remote attacker to execute arbitrary code on the data plane. The vulnerability is triggered by sending a malicious HTTP request with an overly long Authorization header to the '/f5-oauth2/v1/userinfo' endpoint, which exceeds the allocated 0x4100-byte buffer in the tmm process (Traffic Management Microkernel). This flaw has been actively exploited in the wild and affects systems in Appliance mode. Deployments using APM strictly as an OAuth Client or Resource Server are not affected.

Recommendations For BIG-IP APM version 21.1.0, apply Hotfix-BIGIP-21.1.0.2.0.30.22-ENG. For BIG-IP APM versions 17.5.0 through 17.5.1, apply Hotfix-BIGIP-17.5.1.9.0.160.12-ENG. For BIG-IP APM versions 17.1.0 through 17.1.3, apply Hotfix-BIGIP-17.1.3.5.0.41.14-ENG. As a temporary mitigation, request and apply the specific iRule from F5 Support for the affected virtual servers. Restrict access to affected virtual servers at a trusted upstream boundary to reduce exposure.