CVE-2025-22891

HIGH

F5 Big-ip Policy Enforcement Manager - Resource Leak

Title source: rule

Description

When BIG-IP PEM Control Plane listener Virtual Server is configured with Diameter Endpoint profile, undisclosed traffic can cause the Virtual Server to stop processing new client connections and an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

References (1)

[Vendor Advisory] https://my.f5.com/manage/s/article/K000139778

Scores

CVSS v3 7.5

EPSS 0.0041

EPSS Percentile 61.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-772

Status published

Products (1)

f5/big-ip_policy_enforcement_manager 15.1.0 - 15.1.10.6.0.11.6

Published Feb 05, 2025

Tracked Since Feb 18, 2026