CVE-2025-36504: 
F5 BIG-IP Advanced Firewall Manager vulnerability analysis and mitigation

CVE-2025-36504 is a vulnerability affecting BIG-IP systems when an HTTP/2 httprouter profile is configured on a virtual server. The vulnerability was disclosed on May 7, 2025, and impacts F5 BIG-IP Virtual Edition systems. This vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) (NVD, Wiz).

The vulnerability has been assigned a CVSS v4.0 base score of 8.7 (High) by F5 Networks with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L. Additionally, it received a CVSS v3.1 base score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD, Wiz).

When exploited, this vulnerability can cause an increase in memory resource utilization on affected BIG-IP systems that have HTTP/2 httprouter profiles configured on virtual servers. The vulnerability specifically affects systems where an HTTP/2 httprouter profile is configured on a virtual server, leading to potential resource exhaustion (NVD).

The vulnerability has a network attack vector (AV:N) with low attack complexity (AC:L) and requires no privileges (PR:N) or user interaction (UI:N). The exploitation probability according to EPSS is 0.1, placing it in the 28.6 percentile of known vulnerabilities. No public exploits have been reported at this time (Wiz).

Software versions which have reached End of Technical Support (EoTS) are not evaluated for this vulnerability. For specific mitigation steps, users should refer to F5's official security advisory (F5 Article).