CVE-2016-9245 describes a denial-of-service vulnerability in F5 BIG-IP systems (versions 12.1.0 - 12.1.2) where malicious requests to virtual servers with an HTTP profile can cause the Traffic Management Microkernel (TMM) to restart. This issue specifically impacts BIG-IP APM profiles and configurations utilizing "Normalize URI" options in iRules or LTM policies. The vulnerability carries a CVSSv3 score of 5.9 (MEDIUM), indicating a network-based attack with high complexity, requiring no user interaction, and primarily leading to high availability impact. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
12.1.0CPE matchmatch criteria | cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.0:*:*:*:*:*:*:* | ||
12.1.1CPE matchmatch criteria | cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.1:*:*:*:*:*:*:* | ||
12.1.2CPE matchmatch criteria | cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.2:*:*:*:*:*:*:* | ||
12.1.0CPE matchmatch criteria | cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.0:*:*:*:*:*:*:* | ||
12.1.1CPE matchmatch criteria | cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.1:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.