CVE-2025-54479
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
When a classification profile is configured on a virtual server without an HTTP or HTTP/2 profile, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Software versions that have reached End of Technical Support (EoTS) are not evaluated.
Risk Assessment
An attacker can cause TMM to terminate via crafted requests, resulting in a denial of service.
Recommendation
Update the software to a version containing the fix; EoTS versions are unsupported and should be replaced.
Other vulnerabilities in Traffic Management Microkernel (TMM)
See all- CVE-2026-42920High
When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.
- CVE-2026-42409High
CVE-2026-42409 affects the configuration of an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond commands on a virtual server. Undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate.
- CVE-2026-34019Medium
A vulnerability in BFD (Bidirectional Forwarding Detection) configured in static and dynamic routing protocols causes undisclosed traffic to stop BFD packet processing by the Traffic Management Microkernel (TMM). This leads to a failover of the configured routing protocol.
- CVE-2025-61990High
When using a multi-bladed platform with more than one blade, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Software versions that have reached End of Technical Support (EoTS) are not evaluated.
- CVE-2025-58120High
When HTTP/2 Ingress is configured, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Software versions that have reached End of Technical Support (EoTS) are not evaluated.
- CVE-2025-48008High
When a TCP profile with Multipath TCP (MPTCP) enabled is configured on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel (TMM) to terminate. Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Original NVD description (English source)
When a classification profile is configured on a virtual server without an HTTP or HTTP/2 profile, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS