CVE-2026-42409
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
CVE-2026-42409 affects the configuration of an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond commands on a virtual server. Undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate.
Risk Assessment
The termination of the TMM process can lead to service availability interruptions, impacting the organization's operational continuity. Potential attacks may exploit this vulnerability to disrupt server functionality.
Recommendation
It is recommended to avoid using the HTTP/2 profile in conjunction with iRules containing the mentioned commands, as well as to monitor and update the software to versions that have not reached End of Technical Support.
Other vulnerabilities in Traffic Management Microkernel (TMM)
See all- CVE-2026-42920High
When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.
- CVE-2026-34019Medium
A vulnerability in BFD (Bidirectional Forwarding Detection) configured in static and dynamic routing protocols causes undisclosed traffic to stop BFD packet processing by the Traffic Management Microkernel (TMM). This leads to a failover of the configured routing protocol.
Original NVD description (English source)
When an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond command are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.