F5 · BIG-IP Traffic Management Microkernel
CVE-2021-22991
F5 BIG-IP Traffic Management Microkernel Buffer Overflow
What it is
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE). Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CISA: The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: February 1, 2022
- Added to the CISA list
- January 18, 2022
- Published
- March 31, 2021
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 62% in the top 0.8% of all known vulnerabilities
- Weakness
- CWE-119
- More details
- NVD · CVE.org · CISA
All references (1)
More exploited flaws from F5
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Sep 22, 2026 | Heap-based Buffer Overflow | BIG-IP APM | Critical 9.3 | 25% |
| Mar 27, 2026 | Stack-Based Buffer Overflow | BIG-IP | Critical 9.3 | 2.3% |
| Oct 31, 2023 | Authentication Bypass | BIG-IP Configuration Utility | Critical 9.8 | 97% |
| Oct 31, 2023 | SQL Injection | BIG-IP Configuration Utility | High 8.8 | 4.2% |
| May 10, 2022 | Missing Authentication | BIG-IP | Critical 9.8 | >99.9% |
| Nov 3, 2021 | Traffic Management User Interface (TMUI) Remote Code Execution | BIG-IP | Critical 9.8 | >99.9% |
| Nov 3, 2021 | iControl REST Remote Code Execution | BIG-IP and BIG-IQ Centralized Management | Critical 9.8 | 99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.