Uncontrolled resource consumption in BIG-IP Advanced WAF and BIG-IP ASM
Priority LOW 26CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-400.
Summary
On version 15.1.x before 15.1.3, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6, when the brute force protection feature of BIG-IP Advanced WAF or BIG-IP ASM is enabled on a virtual server and the virtual server is under brute force attack, the MySQL database may run out of disk space due to lack of row limit on undisclosed tables in the MYSQL database. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Why it matters now
EPSS 0.00919 60th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | BIG-IP Advanced WAF and BIG-IP ASM | 15.1.x before 15.1.3, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6 | — | No fix listed | CNA |
- BIG-IP Advanced WAF and BIG-IP ASM Vendor— Affected 15.1.x before 15.1.3, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* | 13.1.0 to before 13.1.3.6; 14.1.0 to before 14.1.3.1; 15.1.0 to before 15.1.3 | Vulnerable | F5 |
| cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* | 13.1.0 to before 13.1.3.6; 14.1.0 to before 14.1.3.1; 15.1.0 to before 15.1.3 | Vulnerable | F5 |
- cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:* Versions 13.1.0 to before 13.1.3.6; 14.1.0 to before 14.1.3.1; 15.1.0 to before 15.1.3 Vulnerable ·F5
- cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* Versions 13.1.0 to before 13.1.3.6; 14.1.0 to before 14.1.3.1; 15.1.0 to before 15.1.3 Vulnerable ·F5
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-23053
- 2026-10-03 Alias added: GHSA-6ccx-cmhg-89c5
References
More F5 Big-ip Advanced Web Application Firewall vulnerabilities
- TI-2023-25230 BIG-IP Configuration utility unauthenticated remote code execution vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2021-05850 Memory corruption in BIG-IP KEVCVSS 3.1CRITICAL 9.8
- TI-2021-05845 Server-side request forgery in BIG-IP; BIG-IQ KEVCVSS 3.1CRITICAL 9.8
- TI-2020-04820 Path traversal in BIG-IP KEVCVSS 3.1CRITICAL 9.8
- TI-2023-25231 BIG-IP Configuration utility authenticated SQL injection vulnerability KEVCVSS 3.1HIGH 8.8
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
Sources
- CVE-2021-23053 · CVE Program
- CVE-2021-23053 · NVD
- FIRST EPSS
- GHSA-6ccx-cmhg-89c5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences