Bug ID 2296473: SSRF violation in alarm mode is not counted in Violation Rating

Last Modified: Jul 28, 2026

Affected Product(s):
BIG-IP ASM(all modules)

Fixed In:
21.1.0.1, 17.5.1.8, 17.1.3.4

Opened: May 18, 2026

Severity: 3-Major

Symptoms

Blocking for Violation Rating happens on response, instead of request

Impact

The request that has a flag alarm for SSRF is forwarded to the server-side

Conditions

When you have the configuration below - Server-side access to disallowed host (Alarm) - Violation Rating Need Examination detected (Block)

Workaround

Set Block on Server-side access to disallowed host violation

Fix Information

None

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips