F5 BIG-IP TMM URI Normalization Buffer Overflow Vulnerability (CVE-2021-22991) Technical Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTF5 BIG-IP versions 16.0.x, 15.1.x, 14.1.x, 13.1.x, and 12.1.x prior to patched releases
Unauthenticated remote attackers can trigger a buffer overflow via crafted URI requests, leading to TMM Denial of Service (DoS), URL-based access control bypass, or potential Remote Code Execution (RCE)
Immediately upgrade to the designated hotfix/patched versions recommended by F5, or apply temporary traffic filtering workarounds
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Administrators must upgrade BIG-IP to a non-vulnerable version as specified in the F5 security advisory. Use the following TMSH commands to perform the upgrade:
# Verify current software status and active volumes
tmsh show sys software
# Install the patched ISO image (e.g., BIGIP-16.0.1.1.iso) to an inactive volume
tmsh install sys software image BIGIP-16.0.1.1.iso volume HD1.2
# Monitor the installation progress
watch tmsh show sys software status
# Reboot into the newly patched volume
tmsh reboot volume HD1.22. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, you can deploy an iRule to restrict or drop requests with excessively long or anomalous URIs to mitigate the attack vector.
# Create an iRule to reject requests with suspicious URI lengths
tmsh create ltm rule block_malicious_uri_rule {
when HTTP_REQUEST {
if { [string length [HTTP::uri]] > 2048 } {
reject
}
}
}
# Bind the mitigation iRule to the vulnerable virtual server
tmsh modify ltm virtual <VIRTUAL_SERVER_NAME> rules { block_malicious_uri_rule }3. Log Audit & IoC Verification Commands
Inspect the system logs and core dump directories to identify potential exploitation attempts or TMM crashes.
# Check for TMM core dumps indicating a crash
ls -la /var/core/ | grep tmm
# Search LTM logs for TMM segmentation faults or unexpected restarts
grep -Ei 'tmm.*segfault|tmm.*assertion|panic' /var/log/ltmStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2021-22991) is a critical buffer overflow (CWE-119) residing in the URI normalization component of the Traffic Management Microkernel (TMM) in F5 BIG-IP. When processing incoming HTTP requests directed to a virtual server, TMM fails to properly validate the length of the URI during normalization, leading to memory corruption.
2. Exploitation Mechanics & Attack Scenario
An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing an anomalous or overly long URI to an exposed virtual server. When TMM attempts to parse and normalize this URI, it triggers a buffer overflow. This corruption typically causes the TMM process to crash, resulting in a Denial of Service (DoS). Under specific conditions, highly sophisticated payloads could manipulate memory structures to bypass URL-based access controls (such as WAF policies) or theoretically achieve arbitrary remote code execution (RCE) with system privileges.
3. Infrastructure & Business Impact
Because F5 BIG-IP appliances serve as critical entry points and load balancers for enterprise networks, a successful exploit can disrupt entire application delivery pipelines. This vulnerability is actively tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog with a high EPSS score, indicating active exploitation in the wild. A compromise could lead to severe service downtime, data exposure, or lateral movement within the internal network.
Official Vendor Advisories & References
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE). Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
Frequently Asked SecOps Questions (CVE-2021-22991)
FAQQ1. How critical is CVE-2021-22991 and is it actively exploited in the wild?
CVE-2021-22991 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 62.4%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-22991?
Primary impacted vendors include f5 across big-ip, traffic_management_microkernel. Scope summary: F5 BIG-IP 16.0.x (before 16.0.1.1), 15.1.x (before 15.1.2.1), 14.1.x (before 14.1.4), 13.1.x (before 13.1.3.6), and 12.1.x (before 12.1.5.3)
Q3. What temporary mitigations or workarounds exist for CVE-2021-22991 before patching?
[Mitigation] Immediately upgrade to the designated hotfix/patched versions recommended by F5, or apply temporary traffic filtering workarounds Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-22991
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (f5)
View Category →F5 BIG-IP APM OAuth Authorization Server Remote Code Execution (RCE) Vulnerability (CVE-2026-94127)
[Affected Scope] F5 BIG-IP APM virtual servers configured with an OAuth Authorization Server profile.
Citrix NetScaler ADC and Gateway Memory Overflow Vulnerability (CVE-2026-8452) Critical Security Advisory
[Affected Scope] Citrix NetScaler ADC and NetScaler Gateway appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server
Citrix NetScaler ADC and Gateway Remote Code Execution (RCE) and DoS Vulnerability (CVE-2026-88772)
[Affected Scope] Citrix NetScaler ADC and Gateway versions prior to 14.1-73.37 and 13.1-64.23, including FIPS/NDcPP editions.
Security Advisory for NetScaler ADC and Gateway Denial of Service (DoS) Vulnerability (CVE-2026-88779)
[Affected Scope] NetScaler ADC and Gateway versions prior to 14.1-73.41 and 13.1-64.28.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.