Last Modified: Nov 04, 2026
Affected Product(s):
F5OS F5OS-A, F5OS-C
Known Affected Versions:
F5OS v2.0.0, F5OS v2.0.0-HR1, F5OS v2.0.0-HR2, F5OS v2.0.0-HR3
Opened: May 27, 2026 Severity: 3-Major
When remote LDAP authentication is configured and LDAP bind attempts fail, user_manager leaks memory handles on each failed attempt. Symptoms include: - Host platform memory steadily depletes over time. - Repeated error messages in system logs (authentication-mgr / var/log/messages): Trying SASL bind with bindDN <DN> SASL bind error: -1 'Can't contact LDAP server' - Eventually, host memory becomes fully exhausted, triggering the Linux kernel Out-Of-Memory (OOM) killer. - Host management interfaces (SSH, WebUI, and serial console) become inaccessible, and running tenant instances become unresponsive or freeze.
Available host platform memory is exhausted over time, leading to kernel Out-Of-Memory (OOM) conditions, total loss of host management access, tenant disruption, and requiring a hard power cycle/reboot of the appliance.
- Remote LDAP authentication is configured (system aaa authentication config authentication-method includes LDAP_ALL). - The configured LDAP server is unreachable, rejects bind credentials, or encounters a protocol/port misconfiguration (e.g., global "ssl on" configured against plaintext port 389). - Background polling (AAA_Poller) repeatedly attempts to bind to the LDAP server to synchronize role mappings.
To halt the memory leak, eliminate the failed bind attempts using either of the following methods: 1. Correct the LDAP configuration or network reachability so binds succeed: - Ensure the server is reachable and credentials are valid. - Resolve any protocol conflicts (e.g., if using SSL, use port 636 with "ssl on"; if using port 389, configure "ssl start_tls" or "ssl off"). - Remove any duplicate or conflicting server-groups: config no system aaa server-groups server-group <duplicate_group> commit 2. Temporarily switch authentication back to local accounts until LDAP service is restored: config system aaa authentication config authentication-method [ LOCAL ] commit
None