Last Modified: Oct 01, 2026
Affected Product(s):
BIG-IP ASM
Known Affected Versions:
17.1.3, 17.1.3.1, 17.1.3.2, 17.1.3.4, 17.1.3.5, 17.5.1, 17.5.1.2, 17.5.1.3, 17.5.1.4, 17.5.1.5, 17.5.1.6, 17.5.1.8, 17.5.1.9, 21.1.0, 21.1.0.1, 21.1.0.2
Opened: Jul 02, 2026 Severity: 3-Major
TMM crashes with a core dump (SIGSEGV) when Advanced WAF / ASM is active on a virtual server that also has iRules referencing HTTP response headers (e.g., X-Blocking-Template)
TMM process crashes and restarts. Active connections are dropped during restart. In standalone deployments, this causes a brief traffic outage; in HA pairs, a failover may occur
All of the following must align: - BIG-IP with Advanced WAF / ASM enabled (TrafficShield BD enforcer active) - An iRule inspects HTTP response header(s) on the server-side connection - The server returns a response (e.g., 403 Forbidden) that triggers an ASM response violation - A specific timing window occurs: BD releases the response hold before raising the ASM_RESPONSE_VIOLATION event, allowing the client-side connection to close while the server-side iRule still attempts to access the now-cleared HTTP data This is a race condition — reproducibility is extremely timing-sensitive and not consistently repeatable
No reliable workaround due to the timing-sensitive nature of the race. Disabling ASM response violation inspection or removing iRules that read HTTP response headers on affected virtual servers may reduce exposure, but is not guaranteed to prevent the crash. A permanent fix requires a BD code change to prevent iRule event dispatch when the response hold has already been released
None