CVE-2025-61951: BIG-IP DTLS 1.2 Vulnerability
Undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. This issue may occur when a Datagram Transport Layer Security (DTLS) 1.2 virtual server is enabled with a Server SSL profile that is configured with a certificate, key, and the SSL Sign Hash set to ANY, and the backend server is enabled with DTLS 1.2 and client authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.5.117.1.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.1.6.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61951?
CVE-2025-61951 has a critical severity rating due to the potential for service disruption in affected systems.
How do I fix CVE-2025-61951?
To fix CVE-2025-61951, upgrade to the recommended F5 BIG-IP versions as specified in the advisory.
What versions of F5 BIG-IP are affected by CVE-2025-61951?
F5 BIG-IP versions 17.5.0, 17.1.0 to 17.1.2, and 16.1.0 to 16.1.6 are affected by CVE-2025-61951.
What is the main issue with CVE-2025-61951?
The main issue with CVE-2025-61951 is that it can cause the Traffic Management Microkernel (TMM) to terminate unexpectedly.
Is there a workaround for CVE-2025-61951?
Currently, no specific workaround is documented for CVE-2025-61951; upgrading to safe versions is recommended.