Traffic Management Microkernel (TMM) vulnerabilities

When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.

CVE-2026-42409 affects the configuration of an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond commands on a virtual server. Undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate.

A vulnerability in BFD (Bidirectional Forwarding Detection) configured in static and dynamic routing protocols causes undisclosed traffic to stop BFD packet processing by the Traffic Management Microkernel (TMM). This leads to a failover of the configured routing protocol.

When using a multi-bladed platform with more than one blade, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Software versions that have reached End of Technical Support (EoTS) are not evaluated.

When HTTP/2 Ingress is configured, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Software versions that have reached End of Technical Support (EoTS) are not evaluated.

When a classification profile is configured on a virtual server without an HTTP or HTTP/2 profile, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Software versions that have reached End of Technical Support (EoTS) are not evaluated.

When a TCP profile with Multipath TCP (MPTCP) enabled is configured on a virtual server, undisclosed traffic along with conditions beyond the attacker's control can cause the Traffic Management Microkernel (TMM) to terminate. Software versions which have reached End of Technical Support (EoTS) are not evaluated.