CVE-2021-23042
mediumpriority · track · 30EPSS 0.009 · 61 %ileEUUSEPSS · scored 2026-10-28
On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, and 12.1.x before 12.1.6, when an HTTP profile is configured on a virtual server, undisclosed requests can cause a significant increase in system resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.3–7.5
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (71)
Products and version ranges known to be affected.
- n/a BIG-IP≤ 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, and 12.1.x before 12.1.6enisa_euvdEU
- f5 big-ip access policy manager12.1.0 → 12.1.6nvdUScpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
- f5 big-ip access policy manager13.1.0 → 13.1.4nvdUScpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
- f5 big-ip access policy manager14.1.0 → 14.1.4nvdUScpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
- f5 big-ip access policy manager15.1.0 → 15.1.3nvdUScpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
- f5 big-ip access policy manager16.0.0 → 16.0.1.2nvdUScpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*
- f5 big-ip advanced firewall manager12.1.0 → 12.1.6nvdUScpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
- f5 big-ip advanced firewall manager13.1.0 → 13.1.4nvdUScpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
- f5 big-ip advanced firewall manager14.1.0 → 14.1.4nvdUScpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
- f5 big-ip advanced firewall manager15.1.0 → 15.1.3nvdUScpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
- f5 big-ip advanced firewall manager16.0.0 → 16.0.1.2nvdUScpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*
- f5 big-ip advanced web application firewall12.1.0 → 12.1.6nvdUScpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*
- f5 big-ip advanced web application firewall13.1.0 → 13.1.4nvdUScpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*
- f5 big-ip advanced web application firewall14.1.0 → 14.1.4nvdUScpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*
- f5 big-ip advanced web application firewall15.1.0 → 15.1.3nvdUScpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*
- f5 big-ip advanced web application firewall16.0.0 → 16.0.1.2nvdUScpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (6)
External citations — patches, advisories, analysis.
- https://nvd.nist.gov/vuln/detail/CVE-2021-23042cnnvd
- https://support.f5.com/csp/article/K93231374cnnvd
- https://vigilance.fr/vulnerability/F5-BIG-IP-overload-via-HTTP-Profile-36209cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.2870cnnvd
- https://support.f5.com/csp/article/K93231374enisa_euvd
- https://support.f5.com/csp/article/K93231374Vendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan