Last Modified: Nov 20, 2023
Affected Product(s):
BIG-IP DNS, GTM, LTM
Known Affected Versions:
15.1.2.1, 15.1.3, 15.1.3.1, 15.1.4, 15.1.4.1, 15.1.5, 15.1.5.1, 15.1.6, 15.1.6.1, 15.1.7, 15.1.8, 15.1.8.1, 15.1.8.2, 15.1.9, 15.1.9.1
Fixed In:
17.1.1, 15.1.10
Opened: Feb 22, 2023 Severity: 3-Major
TMM leaks memory for Domain Name System Security Extensions (DNSSEC) requests.
TMM memory utilization increases over time and could crash due to Out of Memory (OOM) issue.
DNSSEC signing process is unable keep pace with the incoming DNSSEC requests.
None
A new DB variable dnssec.signwaitqueuecap is introduced to configure the limit for the software based crypto operations for DNSSEC. You can throttle the incoming DNSSEC requests based on the count of outstanding DNSSEC requests on crypto software queue. tmsh modify sys db dnssec.signwaitqueuecap value <value> this value sets the capacity per TMM process.