Last Modified: Oct 16, 2026
Affected Product(s):
BIG-IP ASM
Known Affected Versions:
17.5.1, 17.5.1.2, 17.5.1.3, 17.5.1.4, 17.5.1.5, 17.5.1.6, 17.5.1.8, 17.5.1.9, 17.5.1.10
Opened: Oct 12, 2026 Severity: 3-Major
When a connection to the ICAP server becomes unresponsive but is not closed by the server, the BIG-IP ASM system does not detect the failure and continues to reuse that connection for subsequent requests. Each request assigned to the connection stalls until the ICAP send timeout expires and is then passed through without being scanned
Requests assigned to the affected connection are delayed by the configured ICAP send timeout (25 seconds by default) and are then forwarded without antivirus inspection
Anti-Virus Protection is configured and enabled. An ICAP server is configured for request modification (REQMOD) or response modification (RESPMOD). A TCP connection to the ICAP server stops accepting data without being closed by the server. This can occur if the ICAP server hangs, stops reading from the socket, or if a network device silently drops traffic for that connection. The ICAP server does not send a FIN or RST on the affected connection.
None
None