CVE-2019-6631
Estado: ModificadaAlta (7.5)—
On BIG-IP 11.5.1-11.6.4, iRules performing HTTP header manipulation may cause an interruption to service when processing traffic handled by a Virtual Server with an associated HTTP profile, in specific circumstances, when the requests do not strictly conform to RFCs.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 7.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 2.53%
- Percentil entre todas las CVEs puntuadas: 84
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (13)
F5 — Big-ip Access Policy ManagerF5 — Big-ip Advanced Firewall ManagerF5 — Big-ip AnalyticsF5 — Big-ip Application Acceleration ManagerF5 — Big-ip Application Security ManagerF5 — Big-ip Domain Name SystemF5 — Big-ip Edge GatewayF5 — Big-ip Global Traffic ManagerF5 — Big-ip Link ControllerF5 — Big-ip Local Traffic ManagerF5 — Big-ip Policy Enforcement ManagerF5 — Big-ip WebacceleratorF5 — Big-ip Websafe
CWE
- NVD-CWE-noinfo
Referencias
- http://www.securityfocus.com/bid/109119
- https://support.f5.com/csp/article/K19501795
- https://support.f5.com/csp/article/K19501795?utm_source=f5support&%3Butm_medium=RSS
- http://www.securityfocus.com/bid/109119
- https://support.f5.com/csp/article/K19501795
- https://support.f5.com/csp/article/K19501795?utm_source=f5support&%3Butm_medium=RSS
JSON original (NVD)
Mostrar
{
"id": "CVE-2019-6631",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "f5sirt@f5.com",
"affectedData": [
{
"vendor": "F5",
"product": "BIG-IP",
"versions": [
{
"status": "affected",
"version": "BIG-IP 11.5.1-11.6.4"
}
]
}
]
}
],
"published": "2019-07-03T18:15:10.977",
"references": [
{
"url": "http://www.securityfocus.com/bid/109119",
"tags": [
"Broken Link",
"Third Party Advisory",
"VDB Entry"
],
"source": "f5sirt@f5.com"
},
{
"url": "https://support.f5.com/csp/article/K19501795",
"tags": [
"Vendor Advisory"
],
"source": "f5sirt@f5.com"
},
{
"url": "https://support.f5.com/csp/article/K19501795?utm_source=f5support&%3Butm_medium=RSS",
"source": "f5sirt@f5.com"
},
{
"url": "http://www.securityfocus.com/bid/109119",
"tags": [
"Broken Link",
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://support.f5.com/csp/article/K19501795",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://support.f5.com/csp/article/K19501795?utm_source=f5support&%3Butm_medium=RSS",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "On BIG-IP 11.5.1-11.6.4, iRules performing HTTP header manipulation may cause an interruption to service when processing traffic handled by a Virtual Server with an associated HTTP profile, in specific circumstances, when the requests do not strictly conform to RFCs."
},
{
"lang": "es",
"value": "En BIG-IP 11.5.1-11.6.4, los iRules que realizan la manipulación del encabezado HTTP pueden causar una interrupción en el servicio cuando se procesa el tráfico manejado por un servidor virtual con un perfil HTTP asociado, en circunstancias específicas, cuando las solicitudes no se ajustan estrictamente a los RFC ."
}
],
"lastModified": "2026-06-17T02:39:24.050",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1DA668DC-EFB6-44C3-8521-47BB9F474DD1",
"versionEndIncluding": "11.6.4",
"versionStartIncluding": "11.5.2"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "66FC8C37-629D-4FBA-9C79-615BDDCF7837",
"versionEndIncluding": "11.6.4",
"versionStartIncluding": "11.5.2"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "33AF102E-2851-45B5-8C71-B393F34D4591",
"versionEndIncluding": "11.6.4",
"versionStartIncluding": "11.5.2"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7865E258-CDA0-43A5-9945-81E07BF11A82",
"versionEndIncluding": "11.6.4",
"versionStartIncluding": "11.5.2"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A057B236-8B7C-430D-B107-8FF96D132E73",
"versionEndIncluding": "11.6.4",
"versionStartIncluding": "11.5.2"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8E4A258E-4F20-4C3C-8269-CD7554539EC6",
"versionEndIncluding": "11.6.4",
"versionStartIncluding": "11.5.2"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "19428E8B-18C2-413A-A3C0-AC6AB9F952F2",
"versionEndIncluding": "11.6.4",
"versionStartIncluding": "11.5.2"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B572C267-AF06-4270-8FDC-18EBDDED7879",
"versionEndIncluding": "11.6.4",
"versionStartIncluding": "11.5.2"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DB112ABE-C07E-480F-8042-6321E602183D",
"versionEndIncluding": "11.6.4",
"versionStartIncluding": "11.5.2"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "42EBAE78-C03E-42C9-AC2D-D654A8DF8516",
"versionEndIncluding": "11.6.4",
"versionStartIncluding": "11.5.2"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "255D11E3-F502-45CD-8958-5989F179574E",
"versionEndIncluding": "11.6.4",
"versionStartIncluding": "11.5.2"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "10A57948-C53A-4CD0-801B-7E801D08E112",
"versionEndIncluding": "11.6.4",
"versionStartIncluding": "11.5.2"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E1ABDB09-3F6E-4D9C-9FBC-FB24DFF12F70",
"versionEndIncluding": "11.6.4",
"versionStartIncluding": "11.5.2"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "f5sirt@f5.com"
}