← Vulnerability feed

Vulnerability record · CVE-2023-22839 · published 1 February 2023

CVE-2023-22839: F5 big-ip domain name system null pointer dereference vulnerability

F5 · Big Ip Domain Name System

On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all version of 13.1.x, when a DNS profile with the Rapid Response Mode setting enabled is configured on a virtual server with hardware SYN cookies enabled, undisclosed requests cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

7.5 CVSS 3.1 High EPSS 0.63% · top 51.9% CWE-476 · NULL pointer dereference
7.5CVSS 3.1 base score
0.63%EPSS exploitation probability, 30 days
NoNot in CISA KEV
34Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all version of 13.1.x, when a DNS profile with the Rapid Response Mode setting enabled is configured on a virtual server with hardware SYN cookies enabled, undisclosed requests cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

34 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://my.f5.com/manage/s/article/K37708118 Vendor Advisory
https://my.f5.com/manage/s/article/K37708118 Vendor Advisory

Track CVE-2023-22839 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

4.4CVE-2019-11109Intel server platform services firmware vulnerabilityLogic issue in the subsystem for Intel(R) SPS before versions SPS_E5_04.01.04.275.0, SPS_SoC-X_04.00.04.100.0 and SPS_SoC-A_04.00.04.191.0 may allow …EPSS 0.33%6.2CVE-2026-21525Windows Remote Access Connection Manager null pointer dereference DoSWindows Remote Access Connection Manager contains a null pointer dereference (CWE-476) that lets an unauthorized attacker deny service locally. The f…KEVEPSS 4.8%analysed

Source: NIST National Vulnerability Database (record CVE-2023-22839), CISA KEV, FIRST EPSS (scores of 2026-10-01). This page is refreshed as NVD updates the record.