Last Modified: Oct 17, 2026
Affected Product(s):
BIG-IP ASM
Known Affected Versions:
21.1.0, 21.1.0.1, 21.1.0.2, 21.1.0.3
Opened: Apr 16, 2026 Severity: 4-Minor
URL parameter enforcement might not correctly work for SSRF host
Parameter is not detected as URL; "Server-side access to disallowed host" violation not triggered.
- "Server-side access to disallowed host" violation is configured to block; - "Illegal parameter data type" violation is disabled; - Parameter is configured either as auto-detect or as URL; - Request contains a SSRF host value with additional characters.
None
None