CVE-2024-21789: 
F5 BIG-IP Virtual Edition (tier - best) vulnerability analysis and mitigation

A vulnerability (CVE-2024-21789) has been identified in BIG-IP ASM/Advanced WAF security policy when configured on a virtual server. The vulnerability was discovered and disclosed on February 14, 2024, affecting BIG-IP Advanced WAF and BIG-IP ASM versions 17.1.0 up to (excluding) 17.1.1 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. It is classified under CWE-772 (Missing Release of Resource after Effective Lifetime). The vulnerability manifests when undisclosed requests cause an increase in memory resource utilization (NVD).

When exploited, this vulnerability leads to increased memory resource utilization in the affected systems, potentially resulting in denial of service conditions. The vulnerability specifically impacts the system's availability while not affecting confidentiality or integrity (ASEC).

The vulnerability is network-accessible (AV:N) with low attack complexity (AC:L), requires no privileges (PR:N), and no user interaction (UI:N). The scope is unchanged (S:U), indicating the impact is limited to the vulnerable component (NVD).

F5 has released security updates to address this vulnerability. Users are advised to upgrade to version 17.1.1 for affected systems. Note that software versions which have reached End of Technical Support (EoTS) are not evaluated (ASEC).