CVE-2025-61938
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters for Data Guard Protection Enforcement, either manually or via Policy Builder, the bd process can terminate repeatedly. Note: EoTS versions not evaluated.
Risk Assessment
Repeated bd process crashes can lead to unavailability of WAF/ASM protections, increasing the risk of attacks on applications.
Recommendation
Update BIG-IP to a patched version and avoid configuring URLs longer than 1024 characters in Data Guard settings.
Other vulnerabilities in BIG-IP Advanced WAF
See all- CVE-2025-61935High
When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- CVE-2025-58474Medium
When BIG-IP Advanced WAF is configured with SSRF protection or NGINX with App Protect Bot Defense, undisclosed requests can disrupt new client requests. Software versions that have reached End of Technical Support (EoTS) are not evaluated.
Original NVD description (English source)
When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters in length for the Data Guard Protection Enforcement setting, either manually or through the automatic Policy Builder, the bd process can terminate repeatedly. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS