Introduction
Unexpected traffic can bring down critical F5 BIG-IP infrastructure when ePVA hardware acceleration is enabled. Organizations relying on these devices for application delivery and security may experience service outages if the Traffic Management Microkernel (TMM) terminates under attack.
F5 Networks is a leading vendor in the application delivery and security space, with BIG-IP products deployed globally across enterprises, telecoms, and government. Their solutions are foundational for high-performance load balancing, SSL offload, and application security in demanding environments.
Technical Information
CVE-2025-53856 is a denial of service vulnerability in F5 BIG-IP systems equipped with embedded Packet Velocity Acceleration (ePVA) hardware. When ePVA is enabled on virtual servers, network address translation (NAT) objects, or secure network address translation (SNAT) objects, undisclosed traffic patterns can cause the Traffic Management Microkernel (TMM) process to terminate. This results in a loss of all traffic processing until TMM restarts.
The vulnerability is classified under CWE-705 (Incorrect Control Flow Scoping). This suggests a logic flaw in how TMM handles certain traffic when offloaded to ePVA hardware. The specific root cause, exploit vector, and triggering traffic are not publicly disclosed. No code snippets or technical diagrams have been published by F5 or in public advisories.
Only BIG-IP hardware platforms with ePVA chips are affected. F5 directs customers to K12837 for a list of affected models. The vulnerability does not impact software-only or non-ePVA hardware platforms.
Affected Systems and Versions
- F5 BIG-IP platforms with embedded Packet Velocity Acceleration (ePVA) hardware
- Vulnerable when ePVA is enabled on virtual servers, NAT objects, or SNAT objects
- Only hardware models listed in K12837 are affected
- Software versions that have reached End of Technical Support (EoTS) are not evaluated
Vendor Security History
F5 has previously disclosed vulnerabilities in the TMM and hardware acceleration features. The vendor issues quarterly security advisories and has a history of timely patching for supported products. In October 2025, F5 disclosed a separate nation-state compromise of its internal development systems, including theft of source code and vulnerability data. No evidence links this incident to CVE-2025-53856.