CVE-2025-36504: BIG-IP HTTP/2 vulnerability

Q: What is the severity of CVE-2025-36504?

CVE-2025-36504 has not publicly specified its severity level, but it can lead to increased memory resource utilization in affected systems.

Q: How do I fix CVE-2025-36504?

To mitigate CVE-2025-36504, upgrade to the recommended versions of F5 BIG-IP software as per the vendor's advisory.

Q: Which versions of F5 BIG-IP are affected by CVE-2025-36504?

CVE-2025-36504 affects specific versions of F5 BIG-IP, including 20.2.0 to 20.3.0, and a range of versions for BIG-IP Next SPK and CNF.

Q: What impact does CVE-2025-36504 have on my F5 BIG-IP system?

CVE-2025-36504 can cause an increase in memory resource utilization due to undisclosed responses when the HTTP/2 httprouter profile is configured.

Q: Is there a workaround for CVE-2025-36504 if I cannot update my system?

Currently, no specific workaround for CVE-2025-36504 has been publicly disclosed, making an upgrade the recommended response.

Published May 7, 2025

Updated

When a BIG-IP HTTP/2 httprouter profile is configured on a virtual server, undisclosed responses can cause an increase in memory resource utilization.

Affected Software

54 affected componentsFixes available

F5 BIG-IP Next>=20.2.0<=20.2.1

20.3.0

F5 BIG-IP Next SPK

2.0.0

F5 BIG-IP Next SPK>=1.7.0<=1.9.2

F5 BIG-IP Next CNF

2.0.0

F5 BIG-IP Next CNF>=1.1.0<=1.4.1

F5 BIG-IP>=17.1.0<=17.1.1

17.1.2

F5 BIG-IP>=16.1.0<=16.1.5

16.1.6

F5 BIG-IP

F5 BIG-IP Access Policy Manager>=16.1.0<16.1.6

F5 BIG-IP Advanced Firewall Manager>=16.1.0<16.1.6

F5 Big-ip Advanced Web Application Firewall>=16.1.0<16.1.6

F5 BIG-IP Analytics>=16.1.0<16.1.6

F5 Big-ip Application Acceleration Manager>=16.1.0<16.1.6

F5 BIG-IP Application Security Manager>=16.1.0<16.1.6

F5 Big-ip Application Visibility And Reporting>=16.1.0<16.1.6

F5 Big-ip Automation Toolchain>=16.1.0<16.1.6

F5 Big-ip Carrier-grade Nat>=16.1.0<16.1.6

F5 Big-ip Container Ingress Services>=16.1.0<16.1.6

F5 Big-ip Ddos Hybrid Defender>=16.1.0<16.1.6

F5 Big-ip Domain Name System>=16.1.0<16.1.6

F5 BIG-IP Edge Gateway>=16.1.0<16.1.6

F5 Big-ip Fraud Protection Service>=16.1.0<16.1.6

F5 Big-ip Global Traffic Manager>=16.1.0<16.1.6

F5 Big-ip Link Controller>=16.1.0<16.1.6

F5 Big-ip Local Traffic Manager>=16.1.0<16.1.6

F5 Big-ip Policy Enforcement Manager>=16.1.0<16.1.6

F5 BIG-IP SSL Orchestrator>=16.1.0<16.1.6

F5 Big-ip Webaccelerator>=16.1.0<16.1.6

F5 Big-ip Websafe>=16.1.0<16.1.6

F5 BIG-IP Access Policy Manager>=17.1.0<17.1.2

F5 BIG-IP Advanced Firewall Manager>=17.1.0<17.1.2

F5 Big-ip Advanced Web Application Firewall>=17.1.0<17.1.2

F5 BIG-IP Analytics>=17.1.0<17.1.2

F5 Big-ip Application Acceleration Manager>=17.1.0<17.1.2

F5 BIG-IP Application Security Manager>=17.1.0<17.1.2

F5 Big-ip Application Visibility And Reporting>=17.1.0<17.1.2

F5 Big-ip Automation Toolchain>=17.1.0<17.1.2

F5 Big-ip Carrier-grade Nat>=17.1.0<17.1.2

F5 Big-ip Container Ingress Services>=17.1.0<17.1.2

F5 Big-ip Ddos Hybrid Defender>=17.1.0<17.1.2

F5 Big-ip Domain Name System>=17.1.0<17.1.2

F5 BIG-IP Edge Gateway>=17.1.0<17.1.2

F5 Big-ip Fraud Protection Service>=17.1.0<17.1.2

F5 Big-ip Global Traffic Manager>=17.1.0<17.1.2

F5 Big-ip Link Controller>=17.1.0<17.1.2

F5 Big-ip Local Traffic Manager>=17.1.0<17.1.2

F5 Big-ip Policy Enforcement Manager>=17.1.0<17.1.2

F5 BIG-IP SSL Orchestrator>=17.1.0<17.1.2

F5 Big-ip Webaccelerator>=17.1.0<17.1.2

F5 Big-ip Websafe>=17.1.0<17.1.2

F5 BIG-IP Next Central Manager=20.2.0

F5 BIG-IP Next Central Manager=20.2.1

F5 Big-ip Next Cloud-native Network Functions>=1.1.0<=1.4.1

F5 Big-ip Next Service Proxy For Kubernetes>=1.7.0<=1.9.2

Event History

May 7, 2025

Advisory Published

via F5·01:01 PM

CVE Published

via MITRE·10:04 PM

Data Sourced

via MITRE·10:04 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-36504?

CVE-2025-36504 has not publicly specified its severity level, but it can lead to increased memory resource utilization in affected systems.

How do I fix CVE-2025-36504?

To mitigate CVE-2025-36504, upgrade to the recommended versions of F5 BIG-IP software as per the vendor's advisory.

Which versions of F5 BIG-IP are affected by CVE-2025-36504?

CVE-2025-36504 affects specific versions of F5 BIG-IP, including 20.2.0 to 20.3.0, and a range of versions for BIG-IP Next SPK and CNF.

What impact does CVE-2025-36504 have on my F5 BIG-IP system?

CVE-2025-36504 can cause an increase in memory resource utilization due to undisclosed responses when the HTTP/2 httprouter profile is configured.

Is there a workaround for CVE-2025-36504 if I cannot update my system?