# CVE-2026-40629: F5 BIG-IP denial of service in SSL-enabled virtual servers

Source: https://junglewise.ai/threats/cve-2026-40629-f5-big-ip-denial-of-service-in-ssl-enabled-virtual-servers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2026-40629 · Severity: high · CVSS 7.5 · Published 2026-05-13

A vulnerability in F5 BIG-IP systems can allow an attacker to crash the service responsible for handling web traffic. When specific SSL settings are enabled, specially crafted network traffic can cause the virtual server to stop accepting new connections from legitimate users. This results in a denial-of-service, potentially disrupting business operations and customer access to hosted applications.

Technologies: [F5 BIG-IP](https://junglewise.ai/threats/technologies/big-ip), [F5 Big-Ip Access Policy Manager](https://junglewise.ai/threats/technologies/big-ip-access-policy-manager), [F5 Big-Ip Advanced Firewall Manager](https://junglewise.ai/threats/technologies/big-ip-advanced-firewall-manager), [F5 Big-Ip Local Traffic Manager](https://junglewise.ai/threats/technologies/big-ip-local-traffic-manager). Vendors: [F5](https://junglewise.ai/threats/vendors/f5).

## Quick answers

**Is CVE-2026-40629 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40629 being exploited in the wild.

**How severe is CVE-2026-40629?** High severity, with a CVSS score of 7.5, published 13 May 2026.

**Which products and versions are affected?** F5 BIG-IP Not evaluated for EoTS versions; F5 Big-Ip Access Policy Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1; F5 Big-Ip Advanced Firewall Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1; F5 Big-Ip Local Traffic Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1; and 2 more.

**Is there a fix for CVE-2026-40629?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-40629 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-40629?** Check whether you run F5 BIG-IP, F5 Big-Ip Access Policy Manager, F5 Big-Ip Advanced Firewall Manager or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A resource management vulnerability (CWE-770) exists in F5 BIG-IP when SSL profiles are configured on a virtual server. An unauthenticated remote attacker can send undisclosed network traffic that triggers a failure in the virtual server's ability to process new client connections. The issue affects multiple BIG-IP modules including LTM, APM, and AFM, as well as BIG-IP Next products. F5 has released a vendor advisory (K000158978) detailing the affected versions and potential mitigations, though specific technical root causes of the 'undisclosed traffic' are not public.

## Affected products

- F5 BIG-IP Access Policy Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1
- F5 BIG-IP Advanced Firewall Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1
- F5 BIG-IP Local Traffic Manager 16.1.0 - 16.1.6, 17.5.0 - 17.5.1
- F5 BIG-IP Next Cloud-Native Network Functions 1.4.0, 2.0.0 - 2.0.2
- F5 BIG-IP Next Service Proxy for Kubernetes 1.7.0 - 1.7.15, 2.0.0 - 2.0.2

## Timeline

- 2026-05-13: disclosed
- 2026-05-13: advisory

## References

- [https://my.f5.com/manage/s/article/K000158978](https://my.f5.com/manage/s/article/K000158978)

## Related threats

- [F5 BIG-IP privilege escalation in TMUI](https://junglewise.ai/threats/cve-2026-66842-f5-big-ip-privilege-escalation-in-tmui)
- [F5 BIG-IP Configuration utility error message spoofing](https://junglewise.ai/threats/cve-2026-63020-f5-big-ip-configuration-utility-error-message-spoofing)
- [F5 BIG-IP denial of service in HTTP/2 profile memory management](https://junglewise.ai/threats/cve-2026-59762-f5-big-ip-denial-of-service-in-http-2-profile-memory-management)
- [F5 BIG-IP and BIG-IQ incorrect permission assignment in tmsh and iControl REST](https://junglewise.ai/threats/cve-2026-42937-f5-big-ip-and-big-iq-incorrect-permission-assignment-in-tmsh-and)
- [F5 BIG-IP Appliance mode restriction bypass via path traversal](https://junglewise.ai/threats/cve-2026-42930-f5-big-ip-appliance-mode-restriction-bypass-via-path-traversal)