Last Modified: Jul 28, 2026
Affected Product(s):
BIG-IP ASM
Fixed In:
21.1.0.1, 21.0.0.3, 17.5.1.8, 17.1.3.4
Opened: May 20, 2026 Severity: 3-Major
When creating an ASM policy from an OpenAPI file containing a requestBody with a schema defined as type: string and format: base64, a header-based content profile on the URL is configured with "base64 decoding" set to "disabled" while it must be "required"
Base64 Decoding disabled in GUI
An OpenAPI file is imported to create a policy, and the file contains a URL with a request body content type image/png, and the schema is defined with type: string and format: base64.
Base64 Decoding enabled in GUI
In handle_request_body, extract from the schema format or contentEncoding instead of just contentEncoding