Last Modified: Oct 17, 2026
Affected Product(s):
BIG-IP ASM
Known Affected Versions:
21.1.0, 21.1.0.1, 21.1.0.2, 21.1.0.3
Opened: Apr 16, 2026 Severity: 4-Minor
URL detection for auto detect parameter might not correctly work for SSRF host
Parameter is not auto-detected as URL; "Server-side access to disallowed host" violation not triggered.
- "Server-side access to disallowed host" violation is configured to block; - Parameter is configured as auto detect; - Request contains a SSRF host value with additional characters.
Explicitly configure the parameter as URL type.
None