Last Modified: Jul 28, 2026
Affected Product(s):
BIG-IP APM
Fixed In:
21.1.0.1, 21.0.0.3, 17.5.1.8, 17.1.3.4
Opened: Mar 29, 2026 Severity: 3-Major
The CRLDP authentication agent in APM extracts CRL Distribution Point URLs from client certificate X.509 extensions and connects to the specified host without validating the destination IP address. This could allow a crafted client certificate to cause BIG-IP to initiate outbound connections to loopback or link-local addresses
An attacker presenting a valid client certificate with a crafted CRL Distribution Point URL could cause APMD to make outbound HTTP or LDAP connections to loopback or link-local addresses, potentially accessing local services or cloud metadata endpoints
-- BIG-IP APM is configured with client certificate authentication and CRLDP validation enabled -- A client presents a certificate containing a CRL Distribution Point extension with a URL pointing to a loopback (127.x.x.x) or link-local (169.254.x.x) address -- The certificate chains to a CA trusted by BIG-IP
None
The CRLDP agent now validates CRL Distribution Point URLs before initiating connections. URLs that resolve to loopback, link-local addresses are rejected. When a URL is blocked, the CRL is treated as unavailable, and existing APM CRLDP policies for CRL unavailability apply. The localhost hostname is also explicitly rejected