Bug ID 2187385: Brute force set to CAPTCHA also raises a violation and blocks traffic

Last Modified: Dec 20, 2025

Affected Product(s):
BIG-IP ASM(all modules)

Known Affected Versions:
17.1.2, 17.1.2.1, 17.1.2.2, 17.1.3

Opened: Dec 19, 2025

Severity: 3-Major

Symptoms

Brute force is raised, but the config is set to CAPTCHA. Brute force contributes to the violation rating, and traffic is blocked by the violation rating, instead of triggering a CAPTCHA.

Impact

CAPTCHA does not occur as expected.

Conditions

Brute force and violation Rating threat detected are both enabled.

Workaround

None

Fix Information

None

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips