ZeroDay Findings
Sign inSign up

Findings

CVE-2021-22991

F5 BIG-IP Traffic Management Microkernel Buffer Overflow

Published Mar 31, 2021 · updated Jun 16, 2026 · f5 big-ip access policy manager

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE). Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 31, 2021 · Catalog

    Detected

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL

  2. Jan 18, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Feb 1, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL

Required action

Apply updates per vendor instructions.

CISA due date Feb 1, 2022

Affected

  • cpe f5/big-ip access policy managerversion unspecified
  • cpe f5/big-ip advanced firewall managerversion unspecified
  • vendor F5 BIG-IP Traffic Management Microkernelversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2021-22991

    The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2021-22991

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2021-22991

    30-day exploitation probability 61.1%

    first.org
  • NIST NVDVulnerability recordCVE-2021-22991

    On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which ma

    nvd.nist.gov

References