CVE-2023-22422

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

On BIG-IP versions 17.0.x before 17.0.0.2 and 16.1.x before 16.1.3.3, when a HTTP profile with the non-default Enforcement options of Enforce HTTP Compliance and Unknown Methods: Reject are configured on a virtual server, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
F5	BIG-IP	>= 17.0.0, < 17.0.0.2; >= 16.1.0, < 16.1.3.3

References

https://my.f5.com/manage/s/article/K43881487Vendor Advisory
https://my.f5.com/manage/s/article/K43881487Vendor Advisory

Timeline

Published: Feb 1, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-224247.8Use-after-free vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.9.0 and earl CVE-2023-224255.4Stored cross-site scripting vulnerability in Schedule function of SHIRASAGI v1.16.2 and earlier versions allows a remote authenticated attac CVE-2023-224274.8Stored cross-site scripting vulnerability in Theme switching function of SHIRASAGI v1.16.2 and earlier versions allows a remote attacker wit CVE-2023-224286.5Improper privilege validation in Command Centre Server allows authenticated operators to modify Division lineage. This issue affects Comman CVE-2023-224297.8Android App 'Wolt Delivery: Food and more' version 4.27.2 and earlier uses hard-coded credentials (API key for an external service), which m CVE-2023-22438.8A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as critical. Affected by this issue is some unkno CVE-2023-224326.1Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary CVE-2023-224357.5Experion server may experience a DoS due to a stack overflow when handling a specially crafted message.CVE-2023-224367.8The kernel subsystem function check_permission_for_set_tokenid within OpenHarmony-v3.1.5 and prior versions has an UAF vulnerability which CVE-2023-224385.4Cross-site scripting vulnerability in Contents Management of EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CVE-2023-224394.3Improper input validation of a large HTTP request in the Controller 6000 and Controller 7000 optional diagnostic web interface (Port 80) can CVE-2023-22449.8A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been classified as critical. This affects an unknown part of the