CVE-2025-54500

No fix known EPSS <1%CVSS 5.3

An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit (HTTP/2 MadeYouReset Attack).  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Published 2025-08-13 · CVE record · OSV

Products: F5 BIG-IP, F5 BIG-IP Next, F5 BIG-IP Next SPK, F5 BIG-IP Next CNF, F5 BIG-IP Next for Kubernetes