CVE-2018-5743: F5 BIG-IP Access Policy Manager

High severity, CVSS 7.5. EPSS: 6.5% chance of exploitation in the next 30 days.

By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The number of allowed connections is a tunable parameter which, if unset, defaults to a conservative value for most servers. Unfortunately, the code which was intended to limit the number of simultaneous connections contained an error which could be exploited to grow the number of simultaneous connections beyond this limit. Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.6, 9.12.0 -> 9.12.4, 9.14.0. BIND 9 Supported Preview Edition versions 9.9.3-S1 -> 9.11.5-S3, and 9.11.5-S5. Versions 9.13.0 -> 9.13.7 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5743.

Affected products

  • F5 BIG-IP Access Policy Manager: from 11.5.2, up to and including 11.6.5; from 12.1.0, up to and including 12.1.4; from 13.1.0, up to and including 13.1.1; from 14.0.0, up to and including 14.1.0; version 15.0.0 only
  • F5 BIG-IP Advanced Firewall Manager: from 11.5.2, up to and including 11.6.5; from 12.1.0, up to and including 12.1.4; from 13.1.0, up to and including 13.1.1; from 14.0.0, up to and including 14.1.0; version 15.0.0 only
  • F5 BIG-IP Analytics: from 11.5.2, up to and including 11.6.5; from 12.1.0, up to and including 12.1.4; from 13.0.0, up to and including 13.1.1; from 14.0.0, up to and including 14.1.0; version 15.0.0 only
  • F5 BIG-IP Application Acceleration Manager: from 11.5.2, up to and including 11.6.5; from 12.1.0, up to and including 12.1.4; from 13.0.0, up to and including 13.1.1; from 14.0.0, up to and including 14.1.0; version 15.0.0 only
  • F5 BIG-IP Application Security Manager: from 11.5.2, up to and including 11.6.5; from 12.1.0, up to and including 12.1.4; from 13.0.0, up to and including 13.1.1; from 14.0.0, up to and including 14.1.1; version 15.0.0 only
  • F5 BIG-IP Domain Name System: from 11.5.2, up to and including 11.6.5; from 12.1.0, up to and including 12.1.4; from 13.1.0, up to and including 13.1.1; from 14.0.0, up to and including 14.1.0; version 15.0.0 only
  • F5 BIG-IP Edge Gateway: from 11.5.2, up to and including 11.6.5; from 12.1.0, up to and including 12.1.4; from 13.0.0, up to and including 13.1.1; from 14.0.0, up to and including 14.1.0; version 15.0.0 only
  • F5 BIG-IP Fraud Protection Service: from 11.5.2, up to and including 11.6.5; from 12.1.0, up to and including 12.1.4; from 13.0.0, up to and including 13.1.1; from 14.0.0, up to and including 14.1.0; version 15.0.0 only
  • F5 BIG-IP Global Traffic Manager: from 11.5.2, up to and including 11.6.5; from 12.1.0, up to and including 12.1.4; from 13.0.0, up to and including 13.1.1; from 14.0.0, up to and including 14.1.0; version 15.0.0 only
  • F5 BIG-IP Link Controller: from 11.5.2, up to and including 11.6.5; from 12.1.0, up to and including 12.1.4; from 13.0.0, up to and including 13.1.1; from 14.0.0, up to and including 14.1.0; version 15.0.0 only
  • F5 BIG-IP Local Traffic Manager: from 11.5.2, up to and including 11.6.5; from 12.1.0, up to and including 12.1.4; from 13.0.0, up to and including 13.1.1; from 14.0.0, up to and including 14.1.0; version 15.0.0 only
  • F5 BIG-IP Policy Enforcement Manager: from 11.5.2, up to and including 11.6.5; from 12.1.0, up to and including 12.1.4; from 13.1.0, up to and including 13.1.1; from 14.0.0, up to and including 14.1.0; version 15.0.0 only
  • F5 BIG-IP Webaccelerator: from 11.5.2, up to and including 11.6.5; from 12.1.0, up to and including 12.1.4; from 13.1.0, up to and including 13.1.1; from 14.0.0, up to and including 14.1.0; version 15.0.0 only
  • F5 BIG-IQ Centralized Management: from 5.0.0, up to and including 5.4.0; from 6.0.0, up to and including 6.1.0
  • F5 Enterprise Manager: version 3.1.1 only
  • F5 Iworkflow: version 2.3.0 only
  • ISC BIND: from 9.9.0, up to and including 9.10.8; from 9.11.0, up to and including 9.11.6; from 9.12.0, up to and including 9.12.4; from 9.13.0, up to and including 9.13.7; version 9.9.3 only; version 9.10.8 only; …

Published 2019-10-09. Last modified 2026-06-17.