Last Modified: Sep 02, 2026
Affected Product(s):
BIG-IP DNS
Known Affected Versions:
17.1.3.4, 17.1.3.5, 17.5.1.8, 17.5.1.9, 21.1.0.1, 21.1.0.2
Opened: Aug 31, 2026 Severity: 3-Major
Queries forwarded to DNS pool members contain two EDNS0 OPT records — the client's original record plus a second one inserted by the BIG-IP system for the client subnet option. Only one OPT record is allowed per DNS message, so the pool member returns FORMERR and the client's query fails
Recursive DNS queries that carry EDNS0 fail. The pool member returns FORMERR, no answer reaches the client, and name resolution fails
A DNS virtual server with edns0-client-subnet-insert enabled and process-rd disabled receives a recursive query (RD bit set) that already contains an EDNS0 OPT record
None
None