Bug ID 1109953: TMM may crash if a data-group is used when an SSL Forward Proxy Bypass/Intercept list contains extremely long entry

Last Modified: Feb 07, 2024

Affected Product(s):
BIG-IP LTM, SSLO(all modules)

Known Affected Versions:
13.1.0,,,,,,,,, 13.1.1,,,,, 13.1.3,,,,,,, 13.1.4,, 13.1.5,, 14.1.0,,,,,, 14.1.2,,,,,,,,, 14.1.3,, 14.1.4,,,,,,, 14.1.5,,,,,, 15.1.0,,,,,, 15.1.1, 15.1.2,, 15.1.3,, 15.1.4,, 15.1.5,, 15.1.6,, 15.1.7, 15.1.8,,, 16.1.0, 16.1.1, 16.1.2,,, 16.1.3,,,,,, 17.0.0,,

Fixed In:
17.1.0, 16.1.4, 15.1.9

Opened: May 26, 2022

Severity: 3-Major


A very long entry (exceeding the maximum length allowed by internet stndards) in a data-group used for SSL Forward Proxy Bypass/Intercept hostname list may cause TMM to crash.


Traffic disrupted while tmm restarts.


All of the below conditions have to be met: -- A virtual server uses SSL profile -- This SSL profile has Forward Proxy enabled. -- The SSL profile has Forward Proxy Bypass enabled. -- The SSL profile uses Hostname Bypass and/or Hostname Intercept data-group. -- Anny to the data-groups contains entries which are longer than 255 characters.


Make sure all entries in the data-group used for intercept/bypass hostnanme list do not exceed 255 characters. According to RFC 1035 section 2.3.4, longer hostnames are not valid.

Fix Information

TMM no longer crashes when hostname data-group entries are too long. Instead there is an error message logged: 01260000:2: Profile <affected SSL profile name>: could not load hostname bypass/intercept list However, incorrect entries need to be fixed as they are not valid anyway and make the data-group to be ignored.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips