F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

What happened

F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution.

Affected versions

BIG-IP APM: 21.1.0 through before Hotfix-BIGIP-21.1.0.2.0.30.22-ENG (custom); 17.5.0 through before Hotfix-BIGIP-17.5.1.9.0.160.12-ENG (custom); 17.1.0 through before Hotfix-BIGIP-17.1.3.5.0.41.14-ENG (custom) Fixed: See vendor advisory.

Why it matters

This source correlation may provide earlier visibility while structured CVE metadata is still being updated.

Detection & mitigation

• Review the original advisory and validate affected versions.
• Apply vendor-provided updates or mitigations when available.