Bug ID 489865: Multiple cookie encryption in iRules on virtual servers can cause core

Last Modified: Apr 28, 2025

Affected Product(s):
BIG-IP LTM(all modules)

Known Affected Versions:
11.3.0, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.1 HF1, 11.5.1 HF2, 11.5.1 HF3, 11.5.1 HF4, 11.5.1 HF5, 11.5.1 HF6, 11.5.1 HF7, 11.5.1 HF8, 11.5.1 HF9, 11.5.1 HF10, 11.5.1 HF11, 11.5.2, 11.5.2 HF1, 11.5.3, 11.5.3 HF1, 11.5.3 HF2, 11.5.4, 11.5.4 HF1, 11.5.4 HF2, 11.5.4 HF3, 11.5.4 HF4, 11.5.5, 11.5.6, 11.5.7, 11.5.8, 11.5.9, 11.5.10, 11.6.0, 11.6.0 HF1, 11.6.0 HF2, 11.6.0 HF3, 11.6.0 HF4, 11.6.0 HF5, 11.6.0 HF6, 11.6.0 HF7, 11.6.0 HF8, 11.6.1, 11.6.1 HF1, 11.6.1 HF2, 11.6.2, 11.6.2 HF1, 11.6.3, 11.6.3.1, 11.6.3.2, 11.6.3.3, 11.6.3.4, 11.6.4, 11.6.5, 11.6.5.1, 11.6.5.2, 11.6.5.3

Fixed In:
12.0.0

Opened: Nov 11, 2014

Severity: 3-Major

Related Article: K98402486

Symptoms

The bd process on standalone ASM configuration cores frequently. This is an LTM issue, related to the encryption of multiple cookies.

Impact

The bd cores result in frequent traffic disruptions. Note: The HTTP filter infrastructure only supports headers up to 64k size.

Conditions

The crash occurs when sending a request when using multiple cookie encryption value lengths larger than 350k. This is a memory corruption issue.

Workaround

Depending on your configuration, you can potentially effectively stabilize the unit by deleting iRules (/Common/iRULE-ENCRYPT-HTTP-COOKIES) so there is only one cookie encryption in iRules associated with multiple virtual servers.

Fix Information

The 64 KB header value limit for ASM has been raised.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips