CVE-2025-47148

CWE-4044 documents4 sources
Severity
7.1HIGH
EPSS
0.1%
top 75.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
F5 Big-ipF5 Big-ip Access Policy ManagerF5 Big-ip SSL Orchestrator
Timeline
PublishedOct 15

Description

When the BIG-IP system is configured as both a Security Assertion Markup Language (SAML) service provider (SP) and Identity Provider (IdP), with single logout (SLO) enabled on an access policy, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

Affected Packages3 packages

▶NVDf5/big-ip_access_policy_manager15.1.0 — 15.1.10.8+3
▶CVEListV5f5/big-ip17.5.0 — 17.5.1+3
▶NVDf5/big-ip_ssl_orchestrator15.1.0 — 15.1.10.8+3

🔴Vulnerability Details

2
CVEList
BIG-IP APM and SSL Orchestrator vulnerability↗2025-10-15
▶
GHSA
GHSA-94mj-cc39-hffh: When the BIG-IP system is configured as both a Security Assertion Markup Language (SAML) service provider (SP) and Identity Provider (IdP), with singl↗2025-10-15
▶

📋Vendor Advisories

1
F5
CVE-2025-47148: When the BIG-IP system is configured as both a Security Assertion Markup Language (SAML) service provider (SP) and Id...↗2025-10-15
▶