CVE-2016-9244: F5 BIG-IP TLS session ticket handling leaks uninitialized memory

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 7.5 with network reachability, no authentication, and high confidentiality impact, plus very high EPSS and public exploit code, make this a serious exposure despite no KEV listing.

What it is

A BIG-IP virtual server using a Client SSL profile with the non-default Session Tickets option enabled can return up to 31 bytes of uninitialized memory. This is the Ticketbleed flaw, and it matters because the leaked memory can contain SSL session IDs and possibly other data from other sessions.

Impact

A remote attacker can read memory contents from the BIG-IP device, including SSL session IDs belonging to other users, which can enable session hijacking or further data exposure.

Attack surface

Reachable over the network by sending crafted TLS requests to a virtual server with the Session Tickets option enabled; no authentication or user interaction is required per the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.74, 99.4th percentile) and public exploit code and write-ups are referenced, indicating active interest and likely exploitation.

What to do

• Apply the F5 vendor fix referenced in support article K05121675 for affected BIG-IP versions.
• If patching is not immediately possible, disable the Session Tickets option on Client SSL profiles as a workaround.
• Audit all BIG-IP virtual servers with Client SSL profiles to identify those with Session Tickets enabled.
• Restrict management and data-plane access to BIG-IP virtual servers to trusted networks where feasible.
• Monitor F5 advisories for updated guidance and affected version details.

Detection

• Inspect TLS traffic to BIG-IP virtual servers for abnormal session ticket lengths or repeated malformed ticket requests.
• Review BIG-IP logs for TLS handshake anomalies or errors associated with session ticket processing.
• Use network monitoring to detect scanning or exploitation attempts matching public Ticketbleed proof-of-concept behavior.
• Correlate unexpected session reuse or session ID anomalies in application logs with BIG-IP TLS activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.