Last Modified: Jun 28, 2025
Affected Product(s):
BIG-IP LTM
Known Affected Versions:
16.1.3, 16.1.3.1, 16.1.3.2, 16.1.3.3, 16.1.3.4, 16.1.3.5, 16.1.4, 16.1.4.1, 16.1.4.2, 16.1.4.3, 16.1.5, 16.1.5.1, 16.1.5.2, 16.1.6
Opened: Oct 13, 2022 Severity: 3-Major
For the http/1.x -> http/2 virtual server the server-side :scheme pseudo-header is always set to 'https', even for unencrypted connections. When HTTP/2 is used on both client-side and server-side it works fine.
The impact of this issue varies based on how the application reacts at the server-side.
-- Use http/1.x in client side -- Use http/2 virtual server on BIG-IP. -- The server-side connection is unencrypted.
None
None