{"id":"CVE-2026-34019","state":"PUBLISHED","title":"BIG-IP BFD vulnerability","description":"When Bidirectional Forwarding Detection (BFD) is configured in Static and Dynamic routing protocols, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to stop processing BFD packets and cause the configured routing protocol to fail over.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","publishedAt":"2026-05-13T14:12:29.552Z","updatedAt":"2026-05-13T16:16:34.572Z","severity":{"score":6.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","source":"f5"},"assigner":"f5","products":["F5 BIG-IP"],"affected":[{"vendor":"F5","product":"BIG-IP","defaultStatus":"unknown","versions":[{"version":"21.0.0","status":"unaffected","lessThan":"*","versionType":"custom"},{"version":"17.5.0","status":"affected","lessThan":"17.5.1","versionType":"custom"},{"version":"17.1.0","status":"affected","lessThan":"17.1.3","versionType":"custom"},{"version":"16.1.0","status":"affected","lessThan":"*","versionType":"custom"}],"modules":["All Modules"]}],"references":["https://my.f5.com/manage/s/article/K000150508"],"weaknesses":["CWE-410"],"ingestedAt":"2026-10-29T20:11:40.391Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/34xxx/CVE-2026-34019.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-34019","state":"PUBLISHED","datePublished":"2026-05-13T14:12:29.552Z","dateUpdated":"2026-05-13T16:16:34.572Z","assignerShortName":"f5","assignerOrgId":"9dacffd4-cb11-413f-8451-fbbfd4ddc0ab","dateReserved":"2026-04-30T23:02:33.933Z"},"containers":{"cna":{"title":"BIG-IP BFD vulnerability","descriptions":[{"lang":"en","value":"When Bidirectional Forwarding Detection (BFD) is configured in Static and Dynamic routing protocols, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to stop processing BFD packets and cause the configured routing protocol to fail over.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."}],"affected":[{"vendor":"F5","product":"BIG-IP","defaultStatus":"unknown","versions":[{"version":"21.0.0","status":"unaffected","lessThan":"*","versionType":"custom"},{"version":"17.5.0","status":"affected","lessThan":"17.5.1","versionType":"custom"},{"version":"17.1.0","status":"affected","lessThan":"17.1.3","versionType":"custom"},{"version":"16.1.0","status":"affected","lessThan":"*","versionType":"custom"}],"modules":["All Modules"]}],"references":[{"url":"https://my.f5.com/manage/s/article/K000150508","tags":["vendor-advisory","patch"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":6.3,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-410","description":"CWE-410: Insufficient Resource Pool","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"f5","orgId":"9dacffd4-cb11-413f-8451-fbbfd4ddc0ab","dateUpdated":"2026-05-13T14:12:29.552Z"},"credits":[{"lang":"en","type":"finder","value":"F5"}],"datePublic":"2026-05-13T14:00:00.000Z","source":{"discovery":"INTERNAL"},"x_generator":{"engine":"F5 SIRTBot v1.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-13T16:00:14.700470Z","id":"CVE-2026-34019","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-13T16:16:34.572Z"}}]}}}