CVE-2025-61938

HighCVSS 7.5

Published: 15/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

26th percentile - higher than 26% of all known CVEs

Summary

When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters for Data Guard Protection Enforcement, either manually or via Policy Builder, the bd process can terminate repeatedly. Note: EoTS versions not evaluated.

Risk Assessment

Repeated bd process crashes can lead to unavailability of WAF/ASM protections, increasing the risk of attacks on applications.

Recommendation

Update BIG-IP to a patched version and avoid configuring URLs longer than 1024 characters in Data Guard settings.

Other vulnerabilities in BIG-IP Advanced WAF

CVE-2025-61935High
When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Original NVD description (English source)

When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters in length for the Data Guard Protection Enforcement setting, either manually or through the automatic Policy Builder, the bd process can terminate repeatedly. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS