Last Modified: Oct 16, 2026
Affected Product(s):
BIG-IP TMOS
Known Affected Versions:
17.1.0, 17.1.0.1, 17.1.0.2, 17.1.0.3, 17.1.1, 17.1.1.1, 17.1.1.2, 17.1.1.3, 17.1.1.4, 17.1.2, 17.1.2.1, 17.1.2.2, 17.1.3, 17.1.3.1, 17.1.3.2, 17.1.3.4, 17.1.3.5, 17.1.3.6, 17.5.0, 17.5.1, 17.5.1.2, 17.5.1.3, 17.5.1.4, 17.5.1.5, 17.5.1.6, 17.5.1.8, 17.5.1.9, 17.5.1.10, 21.0.0, 21.0.0.1, 21.0.0.2, 21.0.0.3, 21.1.0, 21.1.0.1, 21.1.0.2, 21.1.0.3
Opened: May 07, 2026 Severity: 3-Major
Unintended TCP connections are created to pool members after a client resets an incomplete or idle connection. The virtual server syncookies.hw_accepts and sc_curr_valid statistics increment without SYN cookie mode being activated.
The BIG-IP creates a new server-side connection from a stale client ACK after the original connection was torn down by a reset. This results in unintended connections to pool members.
- connection.syncookies.algorithm set to hardware - pvasyncookies.enabled set to true - HSB-capable hardware (i-series, R-series tenant, VIPRION) - TCP profile virtual server - Client sends a TCP RST followed by a TCP ACK on the same connection within approximately 15 seconds
Set connection.syncookies.algorithm to software
None