Last Modified: Oct 16, 2026
Affected Product(s):
BIG-IP APM
Fixed In:
17.5.1.10, 17.1.3.6
Opened: Aug 01, 2026 Severity: 2-Critical
After upgrading to BIG-IP 17.5.1.8, users experience failures with certain requests when an Access Profile is applied to the virtual server. A request containing curly braces ^ triggers the error: 'Access encountered an error (Operation not supported)
- The HTTP connection is immediately reset (TCP RST) by the BIG-IP, and no APM session is established - The client cannot access the requested application resource, and an APM session is not established. This can cause application search or other URI-based requests to fail
- Upgrade BIG-IP to v17.5.1.8 - Send an HTTP GET request to an APM-enabled Virtual Server with an unencoded unsafe character in the query string
iRule: when HTTP_REQUEST priority 100 { set my_query [HTTP::query] if { ($my_query contains "{") or ($my_query contains "}") or ($my_query contains "|") or ($my_query contains "\"") } { HTTP::query [string map {"\\" "%5C" "^" "%5E"} $my_query] } } This iRule checks for specific characters in the query and replaces them with their encoded equivalents
None