Last Modified: Jul 10, 2026
Affected Product(s):
BIG-IP AFM
Known Affected Versions:
17.1.0, 17.1.0.1, 17.1.0.2, 17.1.0.3, 17.1.1, 17.1.1.1, 17.1.1.2, 17.1.1.3, 17.1.1.4, 17.1.2, 17.1.2.1, 17.1.2.2, 17.1.3, 17.1.3.1, 17.1.3.2, 17.5.0, 17.5.1, 17.5.1.2, 17.5.1.3, 17.5.1.4, 17.5.1.5, 17.5.1.6, 21.0.0, 21.0.0.1
Opened: Jul 02, 2026 Severity: 3-Major
This issue has been observed with bot-defense signatures, resulting in log lines that appear as follows: Notice MCP message handling failed in 0xacdf00 (16973843): Jun 24 19:34:45 on 1 - MCP Message: notice create { notice bot_defense_compiled_signatures { notice bot_defense_compiled_signatures_parent_profile "/Common/a_profile_name" notice bot_defense_compiled_signatures_name "/Common/a_signature_name" ... The 16973843 error number is a fingerprint for this.\
Config settings aren't honored by tmm. In the case of signatures, this can result in traffic that should be blocked but is not
This typically requires thousands of the same config objects (e.g., bot-defense signatures), but it can rarely happen with many fewer
The root cause is that DOS L7 config object names are hashed into a 32-bit number. This can cause collisions, which lead to the bug. So changing names can prevent the collisions, e.g., by appending a random number to the name But note that this is a probabilistic fix and is not guaranteed to work with the first random number
None