CVE-2024-21849: F5 BIG-IP Advanced Web Application Firewall

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

When an Advanced WAF/ASM security policy and a Websockets profile are configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) process to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Affected products

• F5 BIG-IP Advanced Web Application Firewall: from 16.1.0, before 16.1.4 (fixed in 16.1.4)
• F5 BIG-IP Application Security Manager: from 16.1.0, before 16.1.4 (fixed in 16.1.4)

Published 2024-02-14. Last modified 2026-06-17.