In F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, PSM software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1, 11.4.0 to 11.5.4,…

Description

In F5 BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, PSM software version 12.0.0 to 12.1.2, 11.6.0 to 11.6.1, 11.4.0 to 11.5.4, when a virtual server uses the standard configuration of HTTP/2 or SPDY profile with Client SSL profile, and the client initiates a number of concurrent streams beyond the advertised limit can cause a disruption of service. Remote client initiating stream beyond the advertised limit can cause a disruption of service. The Traffic Management Microkernel (TMM) data plane is exposed to this issue; the control plane is not exposed.

Scores

EPSS (exploitation in 30 days)

1.7% · top 23% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.9.

Weakness

• denial of service
• CWE-119 (opens in a new tab)All about CWE-119 and its CVEs

Affected products

• F5 Networks, Inc. · BIG-IP LTM, AAM, AFM, APM, ASM, Link Controller, PEM, PSM

  • affected 12.0.0 - 12.1.2
  • affected 11.6.0 &#xe2
  • affected &#x80
  • affected " 11.6.1
  • affected 11.4.0 &#xe2
  • affected " 11.5.4

References (3)

• 1039671 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• 101606 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• https://support.f5.com/csp/article/K22541983 (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2017-6163](https://trackcve.app/badge/CVE-2017-6163.svg)](https://trackcve.app/cve/CVE-2017-6163)

Record last updated 16 Sept 2024, 20:37 UTC.