CVE Vulnerabilities

CVE-2025-47148

Improper Resource Shutdown or Release

Published: Oct 15, 2025 | Modified: Oct 21, 2025
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

When the BIG-IP system is configured as both a Security Assertion Markup Language (SAML) service provider (SP) and Identity Provider (IdP), with single logout (SLO) enabled on an access policy, undisclosed requests can cause an increase in memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Weakness

The product does not release or incorrectly releases a resource before it is made available for re-use.

Affected Software

Name Vendor Start Version End Version
Big-ip_access_policy_manager F5 15.1.0 (including) 15.1.10.8 (excluding)
Big-ip_access_policy_manager F5 16.1.0 (including) 16.1.6.1 (excluding)
Big-ip_access_policy_manager F5 17.1.0 (including) 17.1.3 (excluding)
Big-ip_access_policy_manager F5 17.5.0 (including) 17.5.0 (including)
Big-ip_ssl_orchestrator F5 15.1.0 (including) 15.1.10.8 (excluding)
Big-ip_ssl_orchestrator F5 16.1.0 (including) 16.1.6.1 (excluding)
Big-ip_ssl_orchestrator F5 17.1.0 (including) 17.1.3 (excluding)
Big-ip_ssl_orchestrator F5 17.5.0 (including) 17.5.0 (including)

Potential Mitigations

  • Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.

References