Last Modified: Oct 09, 2026
Affected Product(s):
BIG-IP APM
Known Affected Versions:
17.5.1.6, 17.5.1.8
Fixed In:
21.1.0.2, 17.5.1.9, 17.1.3.4
Opened: Jun 29, 2026 Severity: 3-Major
- After upgrading to BIG-IP 17.5.1.6, HTTP requests containing unencoded double quotes (") in the URI query string are rejected by APM (access.c framework) - This behavior results from stricter RFC 3986 enforcement - Applications that previously functioned now fail if requests include URIs that are non-compliant with RFC 3986
- Existing applications (e.g., Oracle WebLogic) fail to function after the upgrade - Requests are rejected before reaching backend servers - This issue prevents upgrading to version 17.5.1.6 - Results in production outages or degraded functionality - Workarounds lead to performance degradation
- BIG-IP version: 17.5.1.6 - APM enabled: Access Policy Manager is active - Request characteristics: Contains unencoded special characters (e.g., " in query strings) - Traffic flow: Processed through the APM access policy (access.c) Example Trigger: /test?option2="method"&option3="POST"
Apply an iRule to encode unsupported characters (e.g., double quotes) before APM processing: when HTTP_REQUEST priority 100 { set my_uri [HTTP::uri] if { $my_uri contains "\"" } { HTTP::uri [string map { "\"" "%22" } $my_uri] } }
None