Last Modified: Jul 28, 2026
Affected Product(s):
BIG-IP ASM
Fixed In:
21.0.0.3, 17.5.1.8
Opened: Apr 23, 2026 Severity: 4-Minor
VIOL_REQUEST_MAX_LENGTH is not triggered when the size of a login request exceeds the max_login_request_body_buffer_size
Violation VIOL_REQUEST_MAX_LENGTH not triggered
A policy with a login page configured with authentication_type=request-body is set, and max_login_request_body_buffer_size is configured to a smaller value than the size of the incoming request.
Modify the logic so that if auth_headers_count == 0 and auth_type includes authentication headers, set auth_type to FORM; otherwise, retain the original auth_type.
Reset auth_type to FORM only for authentication types that rely on authorization headers. Otherwise, retain the original auth_type and detect it as a login request.