BIG-IP
CVE-2025-61938: BIG-IP Advanced WAF and ASM bd process vulnerability
When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters in length for the Data Guard Protection Enforcement setting, either manually or through the automatic Policy Builder, the bd process can terminate repeatedly.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| BIG-IP 17.5 | 17.5.1 or later |
| BIG-IP 17.1 | 17.1.3 or later |
| BIG-IP 15.1, 16.1 | Not affected |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters in length for the Data Guard Protection Enforcement setting, either manually or through the automatic Policy Builder, the bd process can terminate repeatedly. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 12 Oct 2026.