CVE-2025-21087
Published: 05 February 2025
Summary
CVE-2025-21087 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in F5 Big-Ip Access Policy Manager. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 38.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the software flaw in F5 BIG-IP causing uncontrolled CPU and memory consumption from undisclosed traffic when SSL profiles or DNSSEC signing are enabled.
Protects against denial-of-service resource exhaustion triggered by specific traffic to virtual servers with Client/Server SSL profiles or DNSSEC operations.
Ensures availability of CPU and memory resources against excessive utilization from the CVE's uncontrolled consumption vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote exploitation of the resource exhaustion flaw (CWE-400) in a public-facing network appliance enables Endpoint Denial of Service via Application or System Exploitation.
NVD Description
When Client or Server SSL profiles are configured on a Virtual Server, or DNSSEC signing operations are in use, undisclosed traffic can cause an increase in memory and CPU resource utilization. Note: Software versions which have reached End of Technical…
more
Support (EoTS) are not evaluated
Deeper analysisAI
CVE-2025-21087 is a denial-of-service vulnerability affecting F5 BIG-IP systems. It occurs when Client or Server SSL profiles are configured on a Virtual Server, or DNSSEC signing operations are in use, allowing undisclosed traffic to cause an increase in memory and CPU resource utilization. The issue is classified under CWE-400 (Uncontrolled Resource Consumption) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Software versions that have reached End of Technical Support (EoTS) are not evaluated for this vulnerability.
Remote, unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required. By sending the undisclosed traffic to affected configurations, attackers can trigger excessive resource consumption, leading to degraded performance or complete denial of service due to high availability impact.
The F5 security advisory, available at https://my.f5.com/manage/s/article/K000134888, provides further details on the vulnerability.
Details
- CWE(s)