CVE-2022-35272: F5 BIG-IP Access Policy Manager

Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days.

In BIG-IP Versions 17.0.x before 17.0.0.1 and 16.1.x before 16.1.3.1, when source-port preserve-strict is configured on an HTTP Message Routing Framework (MRF) virtual server, undisclosed traffic may cause the Traffic Management Microkernel (TMM) to produce a core file and the connection to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

• F5 BIG-IP Access Policy Manager: from 16.1.0, before 16.1.3.1 (fixed in 16.1.3.1); version 17.0.0 only
• F5 BIG-IP Advanced Firewall Manager: from 16.1.0, before 16.1.3.1 (fixed in 16.1.3.1); version 17.0.0 only
• F5 BIG-IP Analytics: from 16.1.0, before 16.1.3.1 (fixed in 16.1.3.1); version 17.0.0 only
• F5 BIG-IP Application Acceleration Manager: from 16.1.0, before 16.1.3.1 (fixed in 16.1.3.1); version 17.0.0 only
• F5 BIG-IP Application Security Manager: from 16.1.0, before 16.1.3.1 (fixed in 16.1.3.1); version 17.0.0 only
• F5 BIG-IP Domain Name System: from 16.1.0, before 16.1.3.1 (fixed in 16.1.3.1); version 17.0.0 only
• F5 BIG-IP Fraud Protection Service: from 16.1.0, before 16.1.3.1 (fixed in 16.1.3.1); version 17.0.0 only
• F5 BIG-IP Global Traffic Manager: from 16.1.0, before 16.1.3.1 (fixed in 16.1.3.1); version 17.0.0 only
• F5 BIG-IP Link Controller: from 16.1.0, before 16.1.3.1 (fixed in 16.1.3.1); version 17.0.0 only
• F5 BIG-IP Local Traffic Manager: from 16.1.0, before 16.1.3.1 (fixed in 16.1.3.1); version 17.0.0 only
• F5 BIG-IP Policy Enforcement Manager: from 16.1.0, before 16.1.3.1 (fixed in 16.1.3.1); version 17.0.0 only

Published 2022-08-04. Last modified 2026-06-17.