Last Modified: Oct 12, 2026
Affected Product(s):
BIG-IP LTM
Known Affected Versions:
17.1.0, 17.1.0.1, 17.1.0.2, 17.1.0.3, 17.1.1, 17.1.1.1, 17.1.1.2, 17.1.1.3, 17.1.1.4, 17.1.2, 17.1.2.1, 17.1.2.2, 17.1.3, 17.1.3.1, 17.1.3.2, 17.1.3.4, 17.1.3.5, 17.5.0, 17.5.1, 17.5.1.2, 17.5.1.3, 17.5.1.4, 17.5.1.5, 17.5.1.6, 17.5.1.8, 17.5.1.9, 21.0.0, 21.0.0.1, 21.0.0.2, 21.0.0.3, 21.1.0, 21.1.0.1, 21.1.0.2
Opened: Sep 08, 2026 Severity: 3-Major
HTTP/1.1 allows chunked encoding where the last chunk must be empty, and its header carries the hexadecimal value of 0. In case there is no hexadecimal value in the chunk header, BIG-IP incorrectly treats it as the value of zero
BIGIP allows a chunk header with no hexadecimal number, violating the RFC
- The virtual server has an HTTP profile - HTTP/1.1 traffic is being sent through the virtual server with chunked encoding
None
None