When an HTTP/2 profile is configured on a virtual server

CVE-2026-59762 is a CWE-770 resource-exhaustion flaw in the HTTP/2 request handling path of F5 BIG-IP's Traffic Management Microkernel (TMM). When a virtual server has an HTTP/2 profile attached, an unauthenticated remote attacker can send *undisclosed* request patterns that cause memory allocation without upper bounds. TMM either restarts under duress or becomes unresponsive, dropping every flow behind that VIP. Affected trains: BIG-IP 17.1.0–17.1.3.3, 17.5.0–17.5.1.7, 21.0.0–21.0.0.2, 21.1.0, plus BIG-IP Next for Kubernetes 2.0.0–2.3.1 and Next SPK/CNF. Fixed in 17.1.3.4, 17.5.1.8, 21.0.0.3, 21.1.0.1 and Next 2.2.3 / 2.3.2.

F5's HIGH (7.5) rating is *appropriate and we're leaving it there*. The vector AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H correctly captures unauth network reach with pure availability impact. It's tempting to downgrade because there's no confidentiality or integrity loss — but BIG-IP data-plane VIPs are, by design, exposed to the internet, HTTP/2 is enabled on the majority of modern web VIPs, and a TMM restart is a full data-plane outage for every app riding that appliance. That's not a nuisance; that's your public web tier going dark on demand.

Why this verdict

• Unauthenticated + network-reachable: vector AV:N/PR:N/UI:N with zero friction on prerequisites — the affected surface is the same TCP:443 the appliance is designed to expose.
• Role multiplier — network edge appliance: BIG-IP LTM/ADC canonically sits at the perimeter fronting business-critical apps. A TMM crash is not a single-host outage; it's a fleet-of-apps outage. This alone floors the verdict at HIGH.
• Blast radius ceiling — availability only: C:N/I:N/A:H means no code exec, no data theft, no persistence, no lateral movement. That is the reason the verdict does *not* climb to CRITICAL despite the edge-role multiplier.
• Exposure population is high, not niche: HTTP/2 profiles are the modern default for web VIPs; unlike management-plane bugs, this hits the data plane every BIG-IP is provisioned to serve.
• No KEV, no public PoC, low EPSS (0.3%) — for now: with Okta Red Team as the finder and F5's disclosure released, weaponization is a question of weeks, not months. Don't confuse *quiet* with *safe*.

Why not higher?

CRITICAL is reserved for chains that end in code execution, data compromise, or takeover. This is pure availability impact bounded by TMM restart — the appliance recovers, HA failover buys time, and no credentials or data leave the box. The role-multiplier floor for a network edge appliance with availability-only impact is HIGH, not CRITICAL.

Why not lower?

Downgrading to MEDIUM would require either an authentication requirement, a niche affected surface, or meaningful deployment friction — none apply. Unauth internet-reachable DoS against the perimeter appliance protecting your revenue-generating apps is not a MEDIUM in any risk framework worth using.

1. Disable HTTP/2 on non-essential virtual servers — Detach the http2 profile from any VIP that doesn't strictly require it — clients will fall back to HTTP/1.1 via ALPN. This eliminates the vulnerable code path entirely. Deploy within 30 days per noisgate mitigation SLA for HIGH.
2. Front BIG-IP VIPs with a CDN or upstream L7 proxy — Cloudflare, Akamai, Fastly, or an upstream nginx will terminate and normalize HTTP/2 before frames reach BIG-IP TMM. The malicious pattern is absorbed at the CDN edge. Feasible for public web VIPs within 30 days.
3. Apply strict connection and request-rate limits — Use BIG-IP AFM/LTM Rate Limiting profiles and connection profiles capping concurrent HTTP/2 streams per client IP. This slows exhaustion and buys detection time. Deploy within 30 days.
4. Alert aggressively on TMM memory and restart events — SNMP sysStatMemoryUsed + /var/log/ltm TMM restart syslog to your SIEM with page-out on threshold. You need to know *during* the attack, not after the outage post-mortem. Deploy within 7 days.
5. Verify HA pair health and failover behavior — Confirm active/standby is genuinely active/standby, not active/degraded. A flapping HA pair under repeated TMM crashes is worse than a single unit. Validate within 30 days.

Run on an auditor workstation with network reach to the BIG-IP management interface, or SSH directly to the BIG-IP as an admin-role user. Invoke as ./check_cve_2026_59762.sh <bigip-mgmt-host-or-localhost>. Requires either SSH key/password for the BIG-IP or local shell on the appliance.

#!/usr/bin/env bash
# CVE-2026-59762 — F5 BIG-IP HTTP/2 memory exhaustion checker
# Usage: ./check_cve_2026_59762.sh <bigip-host-or-localhost>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
set -u

TARGET="${1:-localhost}"

run() {
  if [ "$TARGET" = "localhost" ]; then
    bash -c "$1" 2>/dev/null
  else
    ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 "admin@${TARGET}" "$1" 2>/dev/null
  fi
}

VER=$(run "tmsh show sys version | grep -A1 'Main Package' | awk '/Version/ {print \$2}'")
if [ -z "$VER" ]; then
  echo "UNKNOWN: could not retrieve BIG-IP version from $TARGET"
  exit 2
fi
echo "BIG-IP version detected: $VER"

# Fixed versions per F5 K000162231
vuln=0
case "$VER" in
  17.1.*)
    # fixed in 17.1.3.4
    printf '%s\n17.1.3.4\n' "$VER" | sort -V -C && vuln=0 || vuln=1 ;;
  17.5.*)
    printf '%s\n17.5.1.8\n' "$VER" | sort -V -C && vuln=0 || vuln=1 ;;
  21.0.*)
    printf '%s\n21.0.0.3\n' "$VER" | sort -V -C && vuln=0 || vuln=1 ;;
  21.1.*)
    printf '%s\n21.1.0.1\n' "$VER" | sort -V -C && vuln=0 || vuln=1 ;;
  *)
    echo "UNKNOWN: version $VER not in known-affected trains — verify manually against K000162231"
    exit 2 ;;
esac

# Check whether any virtual server actually has an http2 profile attached
H2_VIPS=$(run "tmsh list ltm virtual one-line | grep -c 'profiles.*http2'")
H2_VIPS=${H2_VIPS:-0}
echo "Virtual servers with HTTP/2 profile: $H2_VIPS"

if [ "$vuln" -eq 1 ] && [ "$H2_VIPS" -gt 0 ]; then
  echo "VULNERABLE: version $VER is affected AND $H2_VIPS VIP(s) use http2"
  exit 1
elif [ "$vuln" -eq 1 ] && [ "$H2_VIPS" -eq 0 ]; then
  echo "VULNERABLE (code present) but no VIP currently exposes HTTP/2 — still patch"
  exit 1
else
  echo "PATCHED: version $VER is at or above the fixed release for its train"
  exit 0
fi

Sources

1. NVD — CVE-2026-59762
2. F5 K000162231 — BIG-IP HTTP/2 vulnerability CVE-2026-59762
3. F5 K000159076 — Quarterly Security Notification (July 2026)
4. CERT/CC VU#885548 — HTTP/2 stalled flow-control DoS
5. CSA Singapore — Multiple Vulnerabilities in F5 NGINX, BIG-IP and BIG-IQ
6. F5 DevCentral — HTTP/2 bomb attack analysis
7. ThreatINT — CVE-2026-59762