Last Modified: Sep 29, 2026
Affected Product(s):
BIG-IP TMOS
Known Affected Versions:
17.1.0, 17.1.0.1, 17.1.0.2, 17.1.0.3, 17.1.1, 17.1.1.1, 17.1.1.2, 17.1.1.3, 17.1.1.4, 17.1.2, 17.1.2.1, 17.1.2.2, 17.1.3, 17.1.3.1, 17.1.3.2, 17.1.3.4, 17.1.3.5, 17.5.0, 17.5.1, 17.5.1.2, 17.5.1.3, 17.5.1.4, 17.5.1.5, 17.5.1.6, 17.5.1.8, 17.5.1.9, 21.1.0, 21.1.0.1, 21.1.0.2
Opened: Sep 18, 2026 Severity: 3-Major
With SSL mirroring enabled and TLS1.3 enabled client side, Client Hellos from the BIG-IP may be delayed by 8 seconds before being sent to the pool member. On the standby BIG-IP device, logs similar to those below may be seen in /var/log/ltm Sep 11 00:07:28 <HOSTNAME> warning tmm1[10882]: 01260009:4: (null connflow): Connection error: ssl_basic_crypto_cb:703: alert(20) Decryption error Sep 11 00:07:28 <HOSTNAME> warning tmm1[10882]: 01260009:4: <IP>:<PORT> -> <IP>:<PORT>: Connection error: hud_ssl_handler:2194: alert(20) codec alert Sep 11 00:08:22 <HOSTNAME> warning tmm1[10882]: 01260013:4: SSL Handshake failed for TCP <IP>:<PORT> -> <IP>:<PORT> The associated client-ssl profile on the standby unit will also show the bad record stats counter incrementing.
SSL connections may rarely stall, before the Client Hello gets sent to the pool member.
- Mirroring enabled on a virtual server with client and server SSL profiles attached - TLS1.3 enabled client side
Disable TLSv1.3 on client-ssl profile if it is not absolutely needed. Else, disable mirroring from the virtual server.
None