CVE-2023-22839: On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.

This month

HIGH 7.5REMOTEUPGRADEUPGRADEMITIGATE

CVE-2023-22839 is a high-severity flaw (CVSS 7.5) affecting big-ip domain name system, big-ip local traffic manager, big-ip 10000s firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all version of 13.1.x, when a DNS profile with the Rapid Response Mode setting enabled is configured on a virtual server with hardware SYN cookies enabled, undisclosed requests cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

Why this priority

High severity
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	7.5 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.6% (top 50%)
CISA exploited list	No
Weakness	CWE-476
Published	2023-02-01
Last modified	2026-10-28

Publisher (CNA): F5 Networks · Vendor: f5

Last updated 2026-10-28 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2023-02-01 18:15 UTCPublished CVE record published
2026-10-28 19:10 UTCUpdated Record last modified

f5 big-ip domain name system UPGRADE

Affected: >= 13.1.0 and <= 13.1.5 · >= 14.1.0 and < 14.1.5.3 · >= 15.1.0 and < 15.1.7 · >= 16.1.0 and < 16.1.3.3 · >= 17.0.0 and < 17.0.0.2

Fixed in: 14.1.5.3, 15.1.7, 16.1.3.3, 17.0.0.2

Safe to downgrade to: a release before 13.1.0

1. Check installed version

apt-cache policy big-ip-domain-name-system || rpm -q big-ip-domain-name-system || big-ip-domain-name-system --version

2. UPGRADE to 14.1.5.3 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade big-ip-domain-name-system

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade big-ip-domain-name-system

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 13.1.0 (Debian / Ubuntu)

apt-cache madison big-ip-domain-name-system sudo apt install big-ip-domain-name-system=<VERSION_BEFORE_13.1.0> sudo apt-mark hold big-ip-domain-name-system

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list big-ip-domain-name-system sudo dnf downgrade big-ip-domain-name-system-<VERSION_BEFORE_13.1.0> sudo dnf versionlock add big-ip-domain-name-system

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

f5 big-ip local traffic manager UPGRADE

Affected: >= 13.1.0 and <= 13.1.5 · >= 14.1.0 and < 14.1.5.3 · >= 15.1.0 and < 15.1.7 · >= 16.1.0 and < 16.1.3.3 · >= 17.0.0 and < 17.0.0.2

Fixed in: 14.1.5.3, 15.1.7, 16.1.3.3, 17.0.0.2

Safe to downgrade to: a release before 13.1.0

1. Check installed version

apt-cache policy big-ip-local-traffic-manager || rpm -q big-ip-local-traffic-manager || big-ip-local-traffic-manager --version

2. UPGRADE to 14.1.5.3 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade big-ip-local-traffic-manager

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade big-ip-local-traffic-manager

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 13.1.0 (Debian / Ubuntu)

apt-cache madison big-ip-local-traffic-manager sudo apt install big-ip-local-traffic-manager=<VERSION_BEFORE_13.1.0> sudo apt-mark hold big-ip-local-traffic-manager

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list big-ip-local-traffic-manager sudo dnf downgrade big-ip-local-traffic-manager-<VERSION_BEFORE_13.1.0> sudo dnf versionlock add big-ip-local-traffic-manager

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

f5 big-ip 10000s firmware MITIGATE

Affected: all versions

Fixed in: no fixed release known

Safe to downgrade to: no unaffected older release

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

f5 big-ip 10200v firmware MITIGATE

Affected: all versions

Fixed in: no fixed release known

Safe to downgrade to: no unaffected older release

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

f5 big-ip 10200v-ssl firmware MITIGATE

Affected: all versions

Fixed in: no fixed release known

Safe to downgrade to: no unaffected older release

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

f5 big-ip 12000 firmware MITIGATE

Affected: all versions

Fixed in: no fixed release known

Safe to downgrade to: no unaffected older release

Check your OS release

cat /etc/os-release; uname -r

Debian / Ubuntu

sudo apt update && sudo apt full-upgrade

RHEL / Amazon Linux / Fedora

sudo dnf upgrade --refresh

Windows

Install the latest cumulative update from Windows Update

If no patch exists yet

OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2023-22839?

big-ip domain name system: upgrade to 14.1.5.3, 15.1.7, 16.1.3.3, 17.0.0.2; big-ip local traffic manager: upgrade to 14.1.5.3, 15.1.7, 16.1.3.3, 17.0.0.2; big-ip 10000s firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2023-22839 being exploited?

CVE-2023-22839 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2023-22839 affect?

CVE-2023-22839 affects big-ip domain name system, big-ip local traffic manager, big-ip 10000s firmware. Severity is high (CVSS 7.5). On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all version of 13.1.x, when a DNS profile with the Rapid Response Mode setting enabled is configured on a virtual server

How urgent is CVE-2023-22839?

Priority 44/100. High severity; Remotely exploitable, no login, no user action

Software pages

F5 BIG-IP vulnerabilities

Related CVEs

CVE-2026-40061 HIGH 8.7 UPGRADE When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed iControl REST and BIG-IP TMOS Shell (
CVE-2026-28758 MEDIUM 4.4 UPGRADE When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST commands tha
CVE-2025-41431 HIGH 7.5 DOWNGRADE DOWNGRADE When connection mirroring is configured on a virtual server, undisclosed requests can cause the Traffic Manage
CVE-2025-36557 HIGH 7.5 UPGRADE UPGRADE When an HTTP profile with the Enforce RFC Compliance option is configured on a virtual server, undisclosed req
CVE-2025-23239 HIGH 8.7 DOWNGRADE DOWNGRADE When running in Appliance mode, and logged into a highly-privileged role, an authenticated remote command inje

References

← Back to latest CVEs