Last Modified: Jan 20, 2026
Affected Product(s):
BIG-IP APM
Known Affected Versions:
17.5.1, 17.5.1.2, 17.5.1.3
Opened: Jan 06, 2026 Severity: 4-Minor
If you try to use a request variable value in an existing branch expression of a "Classify API Request (RCA)" agent of an API protection Per-Request-Policy, the ".value" will be stripped once validated. Entered expression: expr {[mcget {perflow.request_classification.path_id}] == 1 && [mcget {request.cookies.at.1.value}] == "cookie_example_value"} Saved expression: expr {[mcget {perflow.request_classification.path_id}] == 1 && [mcget {request.cookies.at.1}] == "cookie_example_value"}
As the ".value" will be stripped, the expression will use the name of the request variable instead of its value, which will prevent the expression from working and may result in a different Per Request Policy result for a request matching that branch.
1. Paths defined inside an API profile 2. Adding conditions using a request variable value in a branch of a "Classify API Request (RCA)" agent in the API profile associated Per Request Policy
None
None