BIG-IP Next for Kubernetes 2.4.0 release notes

About this release

Introduction

These release notes describe the differences between BIG-IP Next for Kubernetes (DPU and Host) 2.3.3 and 2.4.0.

Supported container-orchestration platforms

This release is officially supported on these container-orchestration platforms and versions:

Type	Platform	Version	Recommended Helm version
BNK (DPU)	Vanilla Kubernetes	1.35	4.1
		1.30	3.18
BNK (Host)	OpenShift	4.22	4.1
		4.18	3.19
		4.16	3.17
	Vanilla Kubernetes	1.35	4.1

Breaking changes

In previous BNK versions, legacy F5 infrastructure CRDs were used alongside Gateway API CRDs. To enhance alignment with Gateway API model, introduce role-based infrastructure CRDs, and provide a more simplified user-friendly experience, this release introduces the following CRDs and API group changes:

• Infra CRD: A composite infrastructure CRD that consolidates F5SPKVlan, F5SPKStaticRoute, VRF, and VxLAN CRDs into a single CRD.

• EgressGateway: A new Gateway API-based CRD to support egress functionality, designed to replace F5SPKEgress.

• GatewaySettings: An extension to Gateway and EgressGateway CRDs, serving as an upgraded replacement for F5BnkGateway (Note: F5BnkGateway will no longer be valid).

• BNKSecPolicy and BNKNetPolicy have been renamed to SecPolicy and NetPolicy to align better with the CRD set they belong to.

• The API group gateway.k8s.f5net.com has changed to gateway.k8s.f5.com.

Security updates

List of other CVEs

> Click to view table

CVE Number	Bug IDs	Image Names	Package Name
CVE-2020-14040	2323429	f5dr-img	golang.org/x/text
CVE-2021-31525	2323433	f5dr-img	golang.org/x/net
CVE-2021-33194	2323365	f5dr-img	golang.org/x/net
CVE-2021-38561	2323369	f5dr-img	golang.org/x/text
CVE-2021-44716	2363753	f5-debug-sidecar	golang.org/x/net
CVE-2022-27664	2323373, 2324697	f5-debug-sidecar, f5dr-img	golang.org/x/net
CVE-2022-29526	2324825
CVE-2022-32149	2323377, 2324701	f5-debug-sidecar, f5dr-img	golang.org/x/text
CVE-2022-41717	2323437, 2324829	f5-debug-sidecar	golang.org/x/net
CVE-2022-41723	2323381, 2324705	f5-debug-sidecar	golang.org/x/net
CVE-2023-39325	1821969, 2323385, 2324709	f5-debug-sidecar	golang.org/x/net
CVE-2023-3978	2323441, 2324833	f5dr-img	golang.org/x/net
CVE-2023-42366	2325837, 2325921
CVE-2023-44487	1821969, 1821981, 2323385, 2323445, 2324837	f5-debug-sidecar, f5dr-img	golang.org/x/net
CVE-2023-45142	1821985
CVE-2023-45283	1821989
CVE-2023-45288	1821997, 2323449, 2324841
CVE-2023-45290	1822005, 1846389
CVE-2024-2236	1822741, 1823117, 1823337, 1845929, 1846153, 1847557, 2335741, 2335897, 2336053, 2336209, 2336365, 2336549, 2336705, 2336861, 2337025, 2337181	f5-bnk-cis, f5-fqdn-resolver, f5-ipam-controller, f5-urlcat	libgcrypt20
CVE-2024-24783	1822013
CVE-2024-24786	2323453, 2324845	f5dr-img	google.golang.org/protobuf
CVE-2024-28180	1846477
CVE-2024-45337	2427553	f5-cert-manager-extension	golang.org/x/crypto
CVE-2024-45338	2363757, 2427557	f5-cert-manager-extension, f5-debug-sidecar	golang.org/x/net
CVE-2024-56433	1816629, 1817121
CVE-2024-58251	2325841, 2325925	gslb-engine, gslb-probe-agent	busybox
CVE-2025-13462	2325701, 2325713, 2325725, 2325861, 2325929, 2325969, 2325985	dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, spk-csrc	libpython3.12-minimal
CVE-2025-14017	2324101	vault-init	curl
CVE-2025-14524	2324133	vault-init	curl
CVE-2025-14819	2324137	vault-init	curl
CVE-2025-22868	2427561	f5-cert-manager-extension	golang.org/x/oauth2
CVE-2025-22869	2427565	f5-cert-manager-extension	golang.org/x/crypto
CVE-2025-22870	2323457, 2324849, 2427637	f5-cert-manager-extension, f5-debug-sidecar	golang.org/x/net
CVE-2025-22872	2323461, 2324853, 2427641	f5-cert-manager-extension	golang.org/x/net
CVE-2025-45582	2326069	BaseOS	tar
CVE-2025-46394	2325845, 2325933	gslb-engine, gslb-probe-agent	busybox
CVE-2025-47911	2363257, 2363921, 2364533, 2427645	f5-cert-manager-extension, f5-debug-sidecar, f5-node-labeler, init-certmgr	golang.org/x/net
CVE-2025-47913	2427569	f5-cert-manager-extension	golang.org/x/crypto
CVE-2025-47914	2427649	f5-cert-manager-extension	golang.org/x/crypto
CVE-2025-55198	2427373	f5-toda-assistant	helm.sh/helm/v3
CVE-2025-55199	2427377	f5-toda-assistant	helm.sh/helm/v3
CVE-2025-58181	2427653	f5-cert-manager-extension	golang.org/x/crypto
CVE-2025-58190	2363261, 2363925, 2364537, 2427657	f5-cert-manager-extension, f5-debug-sidecar, f5-node-labeler, init-certmgr	golang.org/x/net
CVE-2025-60876	2325849, 2325937, 2428229, 2428369	gslb-engine, gslb-probe-agent	busybox
CVE-2025-69534	2428257, 2428309	f5-bnk-cis, spk-csrc	libpython3.12-minimal
CVE-2025-69720	2325053, 2428225, 2428461	baseos, f5dr-img, postgresql	libncurses6, libncursesw6, ncurses
CVE-2026-0994	2227677	f5-l4p-engine	libprotobuf32t64
CVE-2026-10536	2364845, 2364881, 2364917, 2364953, 2365009, 2365045	crd-installer, f5-access-apmd, f5-debug-sidecar, f5-fluentbit, f5ingress, ocnos-img	curl, libcurl4t64
CVE-2026-11822	2428313, 2428433	f5-bnk-cis, rabbit	libsqlite3-0
CVE-2026-11824	2428317, 2428437	f5-bnk-cis, rabbit	libsqlite3-0
CVE-2026-11856	2364837, 2364873, 2364909, 2364945, 2364981, 2365037	crd-installer, f5-access-apmd, f5-debug-sidecar, f5-fluentbit, f5ingress, ocnos-img	curl, libcurl4t64
CVE-2026-12064	2364849, 2364885, 2364921, 2364957, 2365013, 2365049	crd-installer, f5-access-apmd, f5-debug-sidecar, f5-fluentbit, f5ingress, ocnos-img	curl, libcurl4t64
CVE-2026-1299	2428261, 2428321	f5-bnk-cis, spk-csrc	libpython3.12-minimal
CVE-2026-1484	2227669	postgresql	glib
CVE-2026-1485	2227673	postgresql	glib
CVE-2026-1502	2428265, 2428325	f5-bnk-cis, spk-csrc	libpython3.12-minimal
CVE-2026-1965	2324105	vault-init	curl
CVE-2026-2219	2326073, 2335649, 2335805, 2335961, 2336117, 2336273, 2336457, 2336613, 2336769, 2336933, 2337093	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img	dpkg
CVE-2026-2297	2325709, 2325721, 2325733, 2325869, 2325945, 2325977, 2325993	dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, spk-csrc	libpython3.12-minimal, python-unversioned-command
CVE-2026-2303	2363645	opentelemetry-collector-contri	go.mongodb.org/mongo-driver/v2
CVE-2026-24051	2427573	f5-cert-manager-extension	go.opentelemetry.io/otel/sdk
CVE-2026-25679	2323473, 2323709	f5-dssm-upgrader, f5-lifecycle-operator-catalog	stdlib
CVE-2026-25680	2363205, 2363233, 2363269, 2363301, 2363329, 2363357, 2363385, 2363537, 2363617, 2363649, 2363761, 2363765, 2363769, 2363773, 2363777, 2363953, 2364033, 2364061, 2364229, 2364257, 2364285, 2364313, 2364401, 2364429, 2364509, 2364545, 2364629, 2364721, 2364749, 2364777, 2427121, 2427661, 2427761	crd-conversion, crd-installer, crdupdater, f5-analyzer, f5-bdosd, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-dwbld, f5-env-discovery, f5-epp, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, init-certmgr, ocnos-img, spk-csrc, spk-cwc	golang.org/x/net
CVE-2026-25681	2363209, 2363237, 2363273, 2363305, 2363333, 2363361, 2363389, 2363541, 2363621, 2363653, 2363781, 2363785, 2363789, 2363793, 2363797, 2363957, 2364037, 2364065, 2364233, 2364261, 2364289, 2364317, 2364405, 2364433, 2364513, 2364549, 2364633, 2364725, 2364753, 2364781, 2427061, 2427577, 2427709	crd-conversion, crd-installer, crdupdater, f5-analyzer, f5-bdosd, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-dwbld, f5-env-discovery, f5-epp, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, init-certmgr, ocnos-img, spk-csrc, spk-cwc	golang.org/x/net
CVE-2026-25934	2323533	f5-lifecycle-operator-catalog	github.com/go-git/go-git/v5
CVE-2026-2673	2325673	vault	libcrypto3
CVE-2026-27135	2325761	f5-fluentbit	libnghttp2-14
CVE-2026-27136	2363213, 2363241, 2363277, 2363309, 2363337, 2363365, 2363393, 2363545, 2363625, 2363657, 2363801, 2363805, 2363809, 2363813, 2363817, 2363961, 2364041, 2364069, 2364237, 2364265, 2364293, 2364321, 2364409, 2364437, 2364517, 2364553, 2364637, 2364729, 2364757, 2364785, 2427065, 2427581, 2427713	crd-conversion, crd-installer, crdupdater, f5-analyzer, f5-bdosd, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-dwbld, f5-env-discovery, f5-epp, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, init-certmgr, ocnos-img, spk-csrc, spk-cwc	golang.org/x/net
CVE-2026-27139	2323581, 2323793	f5-dssm-upgrader, f5-lifecycle-operator-catalog	stdlib
CVE-2026-27142	2323537, 2323769	f5-dssm-upgrader, f5-lifecycle-operator-catalog	stdlib
CVE-2026-27145	2322881, 2322929, 2322973, 2323025, 2323073, 2323117, 2323177, 2323237, 2323281, 2323341, 2323465, 2323629, 2323689, 2323773, 2323833, 2323893, 2323965, 2324037, 2324109, 2324181, 2324225, 2324273, 2324337, 2324393, 2324409, 2324453, 2324501, 2324549, 2324593, 2324641, 2324685, 2324857, 2324861, 2324933, 2324953, 2325001, 2325245, 2325301, 2325361, 2325417, 2325477, 2325537, 2325589, 2325677, 2326049, 2335189, 2335361, 2335457, 2335501, 2335621, 2427337	baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmm-img, tmrouted-img, vault, vault-init	stdlib
CVE-2026-28387	2325609, 2326189, 2335745, 2335901, 2336057, 2336213, 2336369, 2336553, 2336709, 2336865, 2337029, 2337185	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault	libcrypto3, libssl3t64
CVE-2026-28388	2325613, 2326193, 2335749, 2335905, 2336061, 2336217, 2336373, 2336557, 2336713, 2336869, 2337033, 2337189	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault	libcrypto3, libssl3t64
CVE-2026-28389	2325617, 2326197, 2335753, 2335909, 2336065, 2336221, 2336377, 2336561, 2336717, 2336873, 2337037, 2337193	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault	libcrypto3, libssl3t64
CVE-2026-28390	2325621, 2326201, 2335757, 2335913, 2336069, 2336225, 2336381, 2336565, 2336721, 2336877, 2337041, 2337197	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault	libcrypto3, libssl3t64, openssl
CVE-2026-29111	2326081, 2335653, 2335809, 2335965, 2336121, 2336277, 2336461, 2336617, 2336773, 2336937, 2337097	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img	libsystemd0, systemd-libs
CVE-2026-29181	2323713	f5-dssm-upgrader	go.opentelemetry.io/otel
CVE-2026-31789	2325605, 2326205, 2335761, 2335917, 2336073, 2336229, 2336385, 2336569, 2336725, 2336881, 2337045, 2337201	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault	libcrypto3, libssl3t64
CVE-2026-31790	2325681, 2326085, 2335657, 2335813, 2335969, 2336125, 2336281, 2336465, 2336621, 2336777, 2336941, 2337101	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault	libcrypto3, libssl3t64, openssl
CVE-2026-32280	2323125, 2323477, 2323637, 2323717, 2323841, 2323913, 2323985, 2324285, 2324713, 2324717, 2325193, 2325309, 2325425, 2325997, 2334977, 2335049, 2335077, 2335109, 2335141, 2335273, 2335397, 2335573	baseos, crdupdater, f5-access-renderer, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fqdn-resolver, f5-ipam-controller, f5-lifecycle-operator-catalog, f5-node-labeler, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, ocnos-img, tmrouted-img	stdlib
CVE-2026-32281	2323129, 2323481, 2323641, 2323721, 2323845, 2323917, 2323989, 2324289, 2324721, 2324725, 2325197, 2325313, 2325429, 2326001, 2334981, 2335053, 2335081, 2335113, 2335145, 2335277, 2335401, 2335577	baseos, crdupdater, f5-access-renderer, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fqdn-resolver, f5-ipam-controller, f5-lifecycle-operator-catalog, f5-node-labeler, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, ocnos-img, tmrouted-img	stdlib
CVE-2026-32282	2323181, 2323545, 2323693, 2323777, 2323897, 2323969, 2324041, 2324341, 2324865, 2324869, 2325249, 2325365, 2325481, 2326053, 2334993, 2335065, 2335093, 2335125, 2335193, 2335289, 2335413, 2335625	baseos, crdupdater, f5-access-renderer, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fqdn-resolver, f5-ipam-controller, f5-lifecycle-operator-catalog, f5-node-labeler, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, ocnos-img, tmrouted-img	stdlib
CVE-2026-32283	2323133, 2323485, 2323645, 2323725, 2323849, 2323921, 2323993, 2324293, 2324729, 2324733, 2325201, 2325317, 2325433, 2326005, 2334985, 2335057, 2335085, 2335117, 2335149, 2335281, 2335405, 2335581	baseos, crdupdater, f5-access-renderer, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fqdn-resolver, f5-ipam-controller, f5-lifecycle-operator-catalog, f5-node-labeler, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, ocnos-img, tmrouted-img	stdlib
CVE-2026-32288	2323185, 2323549, 2323697, 2323781, 2323901, 2323973, 2324045, 2324345, 2324873, 2324877, 2325253, 2325369, 2325485, 2326057, 2334997, 2335069, 2335097, 2335129, 2335197, 2335293, 2335417, 2335629	baseos, crdupdater, f5-access-renderer, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fqdn-resolver, f5-ipam-controller, f5-lifecycle-operator-catalog, f5-node-labeler, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, ocnos-img, tmrouted-img	stdlib
CVE-2026-32289	2323189, 2323553, 2323701, 2323785, 2323905, 2323977, 2324049, 2324349, 2324881, 2324885, 2325257, 2325373, 2325489, 2326061, 2335001, 2335073, 2335101, 2335133, 2335201, 2335297, 2335421, 2335633	baseos, crdupdater, f5-access-renderer, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fqdn-resolver, f5-ipam-controller, f5-lifecycle-operator-catalog, f5-node-labeler, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, ocnos-img, tmrouted-img	stdlib
CVE-2026-3276	2428269, 2428329	f5-bnk-cis, spk-csrc	libpython3.12-minimal
CVE-2026-32952	2324113, 2324229, 2324277, 2324397, 2324457, 2325685	cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, vault, vault-init	github.com/Azure/go-ntlmssp
CVE-2026-33186	2323361, 2324509, 2324693, 2427549	f5-cert-manager-extension, f5-debug-sidecar, f5-urlcat, f5dr-img	google.golang.org/grpc
CVE-2026-33762	2323585	f5-lifecycle-operator-catalog	github.com/go-git/go-git/v5
CVE-2026-33810	2323649, 2323853, 2323925, 2323997, 2324297, 2324737, 2324741, 2325205, 2325321, 2325437, 2326009, 2334989, 2335061, 2335089, 2335121, 2335137, 2335153, 2335285, 2335409, 2335585	baseos, crdupdater, f5-access-renderer, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fqdn-resolver, f5-ipam-controller, f5-node-labeler, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, ocnos-img, tmrouted-img	stdlib
CVE-2026-33811	2322845, 2322889, 2322937, 2322981, 2323037, 2323081, 2323137, 2323197, 2323245, 2323289, 2323389, 2323489, 2323593, 2323653, 2323729, 2323797, 2323857, 2323929, 2324001, 2324057, 2324145, 2324189, 2324237, 2324301, 2324357, 2324417, 2324465, 2324513, 2324557, 2324601, 2324649, 2324745, 2324749, 2324897, 2324965, 2325209, 2325265, 2325325, 2325381, 2325441, 2325497, 2325545, 2325625, 2326013, 2335157, 2335309, 2335425, 2335469, 2335589, 2427341	baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator-catalog, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmm-img, tmrouted-img, vault, vault-init	stdlib
CVE-2026-33814	2322849, 2322893, 2322941, 2322985, 2323041, 2323085, 2323141, 2323201, 2323249, 2323293, 2323393, 2323493, 2323597, 2323657, 2323801, 2323861, 2323933, 2324005, 2324061, 2324149, 2324193, 2324241, 2324305, 2324361, 2324421, 2324469, 2324517, 2324561, 2324605, 2324653, 2324753, 2324757, 2324901, 2324969, 2325213, 2325269, 2325329, 2325385, 2325445, 2325501, 2325549, 2325629, 2326017, 2335161, 2335313, 2335429, 2335473, 2335593, 2364641, 2364789, 2427345, 2427585	baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator, f5-lifecycle-operator-catalog, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmm-img, tmrouted-img, vault, vault-init	golang.org/x/net, stdlib
CVE-2026-33845	2325017, 2326089, 2335661, 2335817, 2335973, 2336129, 2336285, 2336469, 2336625, 2336781, 2336945, 2337105	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, postgresql, tmrouted-img	gnutls, libgnutls30t64
CVE-2026-33846	2325057, 2326093, 2335665, 2335821, 2335977, 2336133, 2336289, 2336473, 2336629, 2336785, 2336949, 2337109	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, postgresql, tmrouted-img	gnutls, libgnutls30t64
CVE-2026-34165	2323557	f5-lifecycle-operator-catalog	github.com/go-git/go-git/v5
CVE-2026-34180	2335233, 2335533, 2335765, 2335921, 2336077, 2336233, 2336389, 2336573, 2336729, 2336885, 2337049, 2337205, 2337257	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault, vault-init	libcrypto3, libssl3t64
CVE-2026-34181	2335237, 2335537	vault, vault-init	libcrypto3
CVE-2026-34182	2335217, 2335517, 2335669, 2335825, 2335981, 2336137, 2336293, 2336477, 2336633, 2336789, 2336953, 2337113, 2337245	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault, vault-init	libcrypto3, libssl3t64
CVE-2026-34183	2335221, 2335521	vault, vault-init	libcrypto3
CVE-2026-34743	2325913, 2326209, 2335769, 2335925, 2336081, 2336237, 2336393, 2336577, 2336733, 2336889, 2337053, 2337209	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, rabbit, tmrouted-img	liblzma5, xz-libs, xz-utils
CVE-2026-34986	2323145	f5-blobd	github.com/go-jose/go-jose/v4
CVE-2026-35206	2324957, 2427381	f5-lifecycle-operator, f5-toda-assistant	helm.sh/helm/v3
CVE-2026-35469	2322897, 2323205, 2323737, 2324609, 2324761, 2324941, 2325505, 2427349	crd-conversion, f5-debug-sidecar, f5-dssm-upgrader, f5-license-helper, f5-lifecycle-operator, f5-toda-assistant, spk-csrc, spk-cwc	github.com/moby/spdystream
CVE-2026-3644	2428273, 2428333	f5-bnk-cis, spk-csrc	libpython3.12-minimal, python-unversioned-command
CVE-2026-3783	2324117	vault-init	curl
CVE-2026-3784	2324121	vault-init	curl
CVE-2026-3805	2324125	vault-init	curl
CVE-2026-3832	2326097, 2335673, 2335829, 2335985, 2336141, 2336297, 2336481, 2336637, 2336793, 2336957, 2337117	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img	libgnutls30t64
CVE-2026-3833	2325061, 2326101, 2335677, 2335833, 2335989, 2336145, 2336301, 2336485, 2336641, 2336797, 2336961, 2337121	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, postgresql, tmrouted-img	gnutls, libgnutls30t64
CVE-2026-39820	2322853, 2322901, 2322945, 2322989, 2323045, 2323089, 2323149, 2323209, 2323253, 2323297, 2323397, 2323497, 2323601, 2323661, 2323741, 2323805, 2323865, 2323937, 2324009, 2324065, 2324153, 2324197, 2324245, 2324309, 2324365, 2324425, 2324473, 2324521, 2324565, 2324613, 2324657, 2324765, 2324769, 2324905, 2324973, 2325217, 2325273, 2325333, 2325389, 2325449, 2325509, 2325553, 2325633, 2326021, 2335165, 2335317, 2335433, 2335477, 2335597, 2427353	baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator-catalog, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmm-img, tmrouted-img, vault, vault-init	stdlib
CVE-2026-39821	2363217, 2363245, 2363281, 2363313, 2363341, 2363369, 2363397, 2363549, 2363629, 2363661, 2363821, 2363825, 2363829, 2363833, 2363837, 2363965, 2364045, 2364073, 2364241, 2364269, 2364297, 2364325, 2364413, 2364441, 2364521, 2364557, 2364645, 2364733, 2364761, 2364793, 2427069, 2427589, 2427717	crd-conversion, crd-installer, crdupdater, f5-analyzer, f5-bdosd, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-dwbld, f5-env-discovery, f5-epp, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, init-certmgr, ocnos-img, spk-csrc, spk-cwc	golang.org/x/net
CVE-2026-39822	2426949, 2426965, 2426985, 2427005, 2427013, 2427029, 2427045, 2427073, 2427177, 2427185, 2427201, 2427221, 2427253, 2427277, 2427293, 2427329, 2427357, 2427413, 2427425, 2427437, 2427457, 2427473, 2427477, 2427533, 2427593, 2427721, 2427813, 2427897, 2427905, 2427917, 2427957, 2427973, 2427989, 2428041, 2428057, 2428073, 2428089, 2428101, 2428117, 2428137, 2428145, 2428161, 2428177, 2428193, 2428213, 2428441, 2430577	baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-bnk-cis, f5-cert-client, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-epp, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, strongswan, tmrouted-img	stdlib
CVE-2026-39823	2322857, 2322905, 2322949, 2322993, 2323049, 2323093, 2323153, 2323213, 2323257, 2323301, 2323401, 2323501, 2323605, 2323665, 2323745, 2323809, 2323869, 2323941, 2324013, 2324069, 2324157, 2324201, 2324249, 2324313, 2324369, 2324429, 2324477, 2324525, 2324569, 2324617, 2324661, 2324773, 2324777, 2324909, 2324977, 2325221, 2325277, 2325337, 2325393, 2325453, 2325513, 2325557, 2325637, 2326025, 2335169, 2335321, 2335437, 2335481, 2335601, 2427385	baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator-catalog, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmm-img, tmrouted-img, vault, vault-init	stdlib
CVE-2026-39824	2363229, 2363265, 2363293, 2363297, 2363325, 2363353, 2363381, 2363409, 2363613, 2363641, 2363745, 2363749, 2363945, 2363949, 2364029, 2364057, 2364085, 2364253, 2364281, 2364309, 2364337, 2364425, 2364505, 2364541, 2364621, 2364625, 2364717, 2364745, 2364773, 2364805, 2427161, 2427693, 2427793, 2427881	crd-conversion, crd-installer, crdupdater, f5-analyzer, f5-bdosd, f5-bnk-cis, f5-cert-client, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-dwbld, f5-env-discovery, f5-epp, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, init-certmgr, ocnos-img, spk-csrc, spk-cwc, tmrouted-img	golang.org/x/sys
CVE-2026-39825	2322861, 2322909, 2322953, 2322997, 2323053, 2323097, 2323157, 2323217, 2323261, 2323305, 2323405, 2323505, 2323609, 2323669, 2323749, 2323813, 2323873, 2323945, 2324017, 2324073, 2324161, 2324205, 2324253, 2324317, 2324373, 2324433, 2324481, 2324529, 2324573, 2324621, 2324665, 2324781, 2324785, 2324913, 2324981, 2325225, 2325281, 2325341, 2325397, 2325457, 2325517, 2325561, 2325641, 2326029, 2335173, 2335325, 2335441, 2335485, 2335605, 2427389	baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator-catalog, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmm-img, tmrouted-img, vault, vault-init	stdlib
CVE-2026-39826	2322865, 2322913, 2322957, 2323001, 2323057, 2323101, 2323161, 2323221, 2323265, 2323309, 2323409, 2323509, 2323613, 2323673, 2323753, 2323817, 2323877, 2323949, 2324021, 2324077, 2324165, 2324209, 2324257, 2324321, 2324377, 2324437, 2324485, 2324533, 2324577, 2324625, 2324669, 2324789, 2324793, 2324917, 2324985, 2325229, 2325285, 2325345, 2325401, 2325461, 2325521, 2325565, 2325645, 2326033, 2335205, 2335365, 2335461, 2335505, 2335637, 2427393	baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator-catalog, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmm-img, tmrouted-img, vault, vault-init	stdlib
CVE-2026-39827	2363553, 2363665, 2363841, 2363969, 2364341, 2364445, 2364561, 2364649, 2427125, 2427665, 2427765	crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, f5-lifecycle-operator-catalog, spk-cwc	golang.org/x/crypto
CVE-2026-39828	2363557, 2363669, 2363845, 2363973, 2364345, 2364449, 2364565, 2364653, 2427077, 2427597, 2427725	crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, f5-lifecycle-operator-catalog, spk-cwc	golang.org/x/crypto
CVE-2026-39829	2363561, 2363673, 2363849, 2363977, 2364349, 2364453, 2364569, 2364657, 2427081, 2427601, 2427729	crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, f5-lifecycle-operator-catalog, spk-cwc	golang.org/x/crypto
CVE-2026-39830	2363565, 2363677, 2363853, 2363981, 2364353, 2364457, 2364573, 2364661, 2427085, 2427605, 2427733	crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, f5-lifecycle-operator-catalog, spk-cwc	golang.org/x/crypto
CVE-2026-39831	2363597, 2363713, 2363929, 2364013, 2364381, 2364489, 2364605, 2364697, 2427089, 2427609, 2427737	crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, f5-lifecycle-operator-catalog, spk-cwc	golang.org/x/crypto
CVE-2026-39832	2363569, 2363681, 2363857, 2363985, 2364357, 2364461, 2364577, 2364665, 2427093, 2427613, 2427741	crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, f5-lifecycle-operator-catalog, spk-cwc	golang.org/x/crypto
CVE-2026-39833	2363601, 2363717, 2363933, 2364017, 2364385, 2364493, 2364609, 2364701, 2427129, 2427669, 2427769	crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, f5-lifecycle-operator-catalog, spk-cwc	golang.org/x/crypto
CVE-2026-39834	2363605, 2363721, 2363937, 2364021, 2364389, 2364497, 2364613, 2364705, 2427133, 2427673, 2427773	crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, f5-lifecycle-operator-catalog, spk-cwc	golang.org/x/crypto
CVE-2026-39835	2363573, 2363685, 2363861, 2363989, 2364361, 2364465, 2364581, 2364669, 2427097, 2427617, 2427745	crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, f5-lifecycle-operator-catalog, spk-cwc	golang.org/x/crypto
CVE-2026-39836	2322869, 2322917, 2322961, 2323005, 2323061, 2323105, 2323165, 2323225, 2323269, 2323313, 2323413, 2323513, 2323617, 2323677, 2323757, 2323821, 2323881, 2323953, 2324025, 2324081, 2324169, 2324213, 2324261, 2324325, 2324381, 2324441, 2324489, 2324537, 2324581, 2324629, 2324673, 2324797, 2324801, 2324921, 2324989, 2325233, 2325289, 2325349, 2325405, 2325465, 2325525, 2325569, 2325649, 2326037, 2335177, 2335329, 2335445, 2335489, 2335609, 2427361	baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator-catalog, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmm-img, tmrouted-img, vault, vault-init	stdlib
CVE-2026-39883	2427621	f5-cert-manager-extension	go.opentelemetry.io/otel/sdk
CVE-2026-40179	2323345, 2325593, 2427137	f5-epp, f5-toda-observer, opentelemetry-collector-contri	github.com/prometheus/prometheus
CVE-2026-40200	2325653	vault	musl
CVE-2026-40225	2326105, 2335681, 2335837, 2335993, 2336149, 2336305, 2336489, 2336645, 2336801, 2336965, 2337125	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img	libsystemd0
CVE-2026-40226	2335685, 2335841, 2335997, 2336153, 2336309, 2336493, 2336649, 2336805, 2336969, 2337129, 2337249	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img	libsystemd0
CVE-2026-40228	2325757, 2335773, 2335929, 2336085, 2336241, 2336397, 2336581, 2336737, 2336893, 2337057, 2337213	f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmm-img, tmrouted-img	libsystemd0
CVE-2026-41080	2325065	postgresql	expat-libs
CVE-2026-41218	2259649
CVE-2026-41316	2335333	f5-fluentd	erb
CVE-2026-41506	2323561	f5-lifecycle-operator-catalog	github.com/go-git/go-git/v5
CVE-2026-41602	2323317, 2324085, 2325657	opentelemetry-collector-contri, vault, vault-init	github.com/apache/thrift
CVE-2026-41889	2323357, 2324141, 2325697	opentelemetry-collector-contri, vault, vault-init	github.com/jackc/pgx/v5
CVE-2026-41989	2326113, 2335689, 2335845, 2336001, 2336157, 2336313, 2336497, 2336653, 2336809, 2336973, 2337133	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img	libgcrypt20
CVE-2026-41991	2428453	baseos	gzip
CVE-2026-41992	2428457	baseos	gzip
CVE-2026-42009	2326117, 2335693, 2335849, 2336005, 2336161, 2336317, 2336501, 2336657, 2336813, 2336977, 2337137	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img	libgnutls30t64
CVE-2026-42010	2325021, 2326121, 2335697, 2335853, 2336009, 2336165, 2336321, 2336505, 2336661, 2336817, 2336981, 2337141	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, postgresql, tmrouted-img	gnutls, libgnutls30t64
CVE-2026-42011	2325069, 2326125, 2335701, 2335857, 2336013, 2336169, 2336325, 2336509, 2336665, 2336821, 2336985, 2337145	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, postgresql, tmrouted-img	gnutls, libgnutls30t64
CVE-2026-42012	2326129, 2335705, 2335861, 2336017, 2336173, 2336329, 2336513, 2336669, 2336825, 2336989, 2337149	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img	libgnutls30t64
CVE-2026-42013	2326133, 2335709, 2335865, 2336021, 2336177, 2336333, 2336517, 2336673, 2336829, 2336993, 2337153	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img	libgnutls30t64
CVE-2026-42014	2326137, 2335713, 2335869, 2336025, 2336181, 2336337, 2336521, 2336677, 2336833, 2336997, 2337157	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img	libgnutls30t64
CVE-2026-42015	2326141, 2335717, 2335873, 2336029, 2336185, 2336341, 2336525, 2336681, 2336837, 2337001, 2337161	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img	libgnutls30t64
CVE-2026-42151	2323321, 2325573, 2335337, 2427101	f5-epp, f5-fluentd, f5-toda-observer, opentelemetry-collector-contri	github.com/prometheus/prometheus
CVE-2026-42154	2323325, 2325577, 2335341, 2427105	f5-epp, f5-fluentd, f5-toda-observer, opentelemetry-collector-contri	github.com/prometheus/prometheus
CVE-2026-4224	2335345, 2335349, 2428277, 2428337	f5-bnk-cis, f5-fluentd, spk-csrc	libpython3.12-minimal, net-imap, python-unversioned-command
CVE-2026-42245	2335345	f5-fluentd	net-imap
CVE-2026-42246	2335349	f5-fluentd	net-imap
CVE-2026-42256	2335369	f5-fluentd	net-imap
CVE-2026-42257	2335301	f5-fluentd	net-imap
CVE-2026-42258	2335305	f5-fluentd	net-imap
CVE-2026-42496	2365073	baseos	perl-base
CVE-2026-42499	2322873, 2322921, 2322965, 2323009, 2323065, 2323109, 2323169, 2323229, 2323273, 2323329, 2323417, 2323517, 2323621, 2323681, 2323761, 2323825, 2323885, 2323957, 2324029, 2324089, 2324173, 2324217, 2324265, 2324329, 2324385, 2324445, 2324493, 2324541, 2324585, 2324633, 2324677, 2324805, 2324809, 2324925, 2324993, 2325237, 2325293, 2325353, 2325409, 2325469, 2325529, 2325581, 2325661, 2326041, 2335181, 2335353, 2335449, 2335493, 2335613, 2427365	baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator-catalog, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmm-img, tmrouted-img, vault, vault-init	stdlib
CVE-2026-42502	2363221, 2363249, 2363285, 2363317, 2363345, 2363373, 2363401, 2363577, 2363633, 2363689, 2363865, 2363869, 2363873, 2363877, 2363881, 2363993, 2364049, 2364077, 2364245, 2364273, 2364301, 2364329, 2364417, 2364469, 2364525, 2364585, 2364673, 2364737, 2364765, 2364797, 2427141, 2427677, 2427777	crd-conversion, crd-installer, crdupdater, f5-analyzer, f5-bdosd, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-dwbld, f5-env-discovery, f5-epp, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, init-certmgr, ocnos-img, spk-csrc, spk-cwc	golang.org/x/net
CVE-2026-42504	2322877, 2322925, 2322969, 2323013, 2323069, 2323113, 2323173, 2323233, 2323277, 2323333, 2323421, 2323625, 2323685, 2323765, 2323829, 2323889, 2323961, 2324033, 2324093, 2324177, 2324221, 2324269, 2324333, 2324389, 2324405, 2324449, 2324497, 2324545, 2324589, 2324637, 2324681, 2324813, 2324817, 2324929, 2324945, 2324997, 2325241, 2325297, 2325357, 2325413, 2325473, 2325533, 2325585, 2325665, 2326045, 2335185, 2335357, 2335453, 2335497, 2335617, 2427369	baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmm-img, tmrouted-img, vault, vault-init	stdlib
CVE-2026-42505	2426953, 2426969, 2426989, 2427009, 2427017, 2427033, 2427049, 2427145, 2427181, 2427189, 2427205, 2427225, 2427261, 2427281, 2427297, 2427333, 2427397, 2427417, 2427429, 2427441, 2427461, 2427481, 2427485, 2427537, 2427681, 2427781, 2427849, 2427901, 2427909, 2427929, 2427961, 2427977, 2427993, 2428045, 2428061, 2428077, 2428093, 2428105, 2428121, 2428141, 2428149, 2428165, 2428181, 2428197, 2428217, 2428445, 2430581	baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-bnk-cis, f5-cert-client, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-epp, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, strongswan, tmrouted-img	stdlib
CVE-2026-42506	2363225, 2363253, 2363289, 2363321, 2363349, 2363377, 2363405, 2363581, 2363637, 2363693, 2363885, 2363889, 2363893, 2363897, 2363901, 2363997, 2364053, 2364081, 2364249, 2364277, 2364305, 2364333, 2364421, 2364473, 2364529, 2364589, 2364677, 2364741, 2364769, 2364801, 2427149, 2427685, 2427785	crd-conversion, crd-installer, crdupdater, f5-analyzer, f5-bdosd, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-dwbld, f5-env-discovery, f5-epp, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, init-certmgr, ocnos-img, spk-csrc, spk-cwc	golang.org/x/net
CVE-2026-42507	2322885, 2322933, 2322977, 2323029, 2323077, 2323121, 2323193, 2323241, 2323285, 2323349, 2323469, 2323633, 2323705, 2323789, 2323837, 2323909, 2323981, 2324053, 2324129, 2324185, 2324233, 2324281, 2324353, 2324401, 2324413, 2324461, 2324505, 2324553, 2324597, 2324645, 2324689, 2324889, 2324893, 2324937, 2324961, 2325005, 2325261, 2325305, 2325377, 2325421, 2325493, 2325541, 2325597, 2325689, 2326065, 2335209, 2335373, 2335465, 2335509, 2335641, 2427401	baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmm-img, tmrouted-img, vault, vault-init	stdlib
CVE-2026-42508	2363585, 2363697, 2363905, 2364001, 2364365, 2364477, 2364593, 2364681, 2427109, 2427625, 2427749	crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, f5-lifecycle-operator-catalog, spk-cwc	golang.org/x/crypto
CVE-2026-42602	2323337	opentelemetry-collector-contri
CVE-2026-42764	2335225, 2335525	vault, vault-init	libcrypto3
CVE-2026-42766	2335241, 2335541, 2335777, 2335933, 2336089, 2336245, 2336401, 2336585, 2336741, 2336897, 2337061, 2337217, 2337261	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault, vault-init	libcrypto3, libssl3t64
CVE-2026-42767	2335245, 2335545, 2335781, 2335937, 2336093, 2336249, 2336405, 2336589, 2336745, 2336901, 2337065, 2337221, 2337265	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault, vault-init	libcrypto3, libssl3t64
CVE-2026-42768	2335249, 2335549	vault, vault-init	libcrypto3
CVE-2026-42769	2335253, 2335553	vault, vault-init	libcrypto3
CVE-2026-42770	2335257, 2335557, 2335785, 2335941, 2336097, 2336253, 2336409, 2336593, 2336749, 2336905, 2337069, 2337225, 2337269	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault, vault-init	libcrypto3, libssl3t64
CVE-2026-42790	2354529
CVE-2026-44024	2427809	f5-fluentd	fluentd
CVE-2026-44025	2427817	f5-fluentd	fluentd
CVE-2026-44160	2427821	f5-fluentd	fluentd
CVE-2026-44161	2427825	f5-fluentd	fluentd
CVE-2026-44503	2324097, 2325669	vault, vault-init	github.com/microsoft/kiota-http-go
CVE-2026-44740	2323569	f5-lifecycle-operator-catalog	github.com/go-git/go-billy/v5
CVE-2026-44903	2323353, 2325601, 2335377, 2427153	f5-epp, f5-fluentd, f5-toda-observer, opentelemetry-collector-contri	github.com/prometheus/prometheus
CVE-2026-44973	2323525	f5-lifecycle-operator-catalog	github.com/go-git/go-billy/v5
CVE-2026-45022	2323529	f5-lifecycle-operator-catalog	github.com/go-git/go-git/v5
CVE-2026-45186	2325073	postgresql	expat-libs
CVE-2026-4519	2428281, 2428341	f5-bnk-cis, spk-csrc	libpython3.12-minimal, python-unversioned-command
CVE-2026-45445	2335229, 2335529, 2335721, 2335877, 2336033, 2336189, 2336345, 2336529, 2336685, 2336841, 2337005, 2337165, 2337253	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault, vault-init	libcrypto3, libssl3t64
CVE-2026-45446	2335261, 2335561, 2335789, 2335945, 2336101, 2336257, 2336413, 2336597, 2336753, 2336909, 2337073, 2337229, 2337273	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault, vault-init	libcrypto3, libssl3t64
CVE-2026-45447	2335213, 2335513, 2335645, 2335801, 2335957, 2336113, 2336269, 2336453, 2336609, 2336765, 2336929, 2337089, 2337241	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault, vault-init	libcrypto3, libssl3t64
CVE-2026-45570	2323589	f5-lifecycle-operator-catalog	github.com/go-git/go-git/v5
CVE-2026-45571	2323573	f5-lifecycle-operator-catalog	github.com/go-git/go-git/v5
CVE-2026-46595	2363589, 2363701, 2363909, 2364005, 2364369, 2364481, 2364597, 2364685, 2427113, 2427629, 2427753	crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, f5-lifecycle-operator-catalog, spk-cwc	golang.org/x/crypto
CVE-2026-46597	2363593, 2363705, 2363913, 2364009, 2364373, 2364485, 2364601, 2364689, 2427117, 2427633, 2427757	crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, f5-lifecycle-operator-catalog, spk-cwc	golang.org/x/crypto
CVE-2026-46598	2363609, 2363725, 2363941, 2364025, 2364393, 2364501, 2364617, 2364709, 2427157, 2427689, 2427789	crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, f5-lifecycle-operator-catalog, spk-cwc	golang.org/x/crypto
CVE-2026-46600	2426957, 2426973, 2426993, 2427021, 2427037, 2427053, 2427165, 2427209, 2427229, 2427265, 2427285, 2427301, 2427405, 2427445, 2427465, 2427489, 2427493, 2427497, 2427501, 2427505, 2427541, 2427697, 2427797, 2427885, 2427945, 2427965, 2427981, 2427997, 2428005, 2428049, 2428065, 2428081, 2428125, 2428153, 2428169, 2428185, 2428201	crd-conversion, crd-installer, crdupdater, f5-analyzer, f5-bdosd, f5-bnk-cis, f5-cert-manager-extension, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-dwbld, f5-env-discovery, f5-epp, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, spk-csrc, spk-cwc, strongswan	golang.org/x/net
CVE-2026-46680	2324949	f5-lifecycle-operator	github.com/containerd/containerd
CVE-2026-47240	2335381	f5-fluentd	net-imap
CVE-2026-47241	2335389	f5-fluentd	net-imap
CVE-2026-47242	2335385	f5-fluentd	net-imap
CVE-2026-47262	2364397, 2364713	f5-lifecycle-operator, f5-lifecycle-operator-catalog	github.com/containerd/containerd
CVE-2026-4786	2428285, 2428345	f5-bnk-cis, spk-csrc	libpython3.12-minimal
CVE-2026-4873	2325129, 2325825	f5-fluentbit, postgresql	curl, libcurl4t64
CVE-2026-4878	2326153, 2335725, 2335881, 2336037, 2336193, 2336349, 2336533, 2336689, 2336845, 2337009	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, tmrouted-img	libcap2
CVE-2026-48978	2427941	f5-lifecycle-operator	oras.land/oras-go/v2
CVE-2026-49014	2325077	postgresql	gdal
CVE-2026-50151	2427921	f5-lifecycle-operator	oras.land/oras-go/v2
CVE-2026-50162	2427933	f5-lifecycle-operator	oras.land/oras-go/v2
CVE-2026-50163	2428021	f5-lifecycle-operator-catalog	oras.land/oras-go/v2
CVE-2026-5260	2326157, 2335729, 2335885, 2336041, 2336197, 2336353, 2336537, 2336693, 2336849, 2337013, 2337169	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img	libgnutls30t64
CVE-2026-53488	2364377, 2364693	f5-lifecycle-operator, f5-lifecycle-operator-catalog	github.com/containerd/containerd
CVE-2026-5419	2326161, 2335733, 2335889, 2336045, 2336201, 2336357, 2336541, 2336697, 2336853, 2337017, 2337173	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img	libgnutls30t64
CVE-2026-5450	2325025, 2427853, 2427857	f5-fluentd, postgresql	glibc, oj
CVE-2026-54500	2427853	f5-fluentd	oj
CVE-2026-54502	2427857	f5-fluentd	oj
CVE-2026-54592	2427829	f5-fluentd	oj
CVE-2026-54896	2427833	f5-fluentd	oj
CVE-2026-54897	2427837	f5-fluentd	oj
CVE-2026-54898	2427861	f5-fluentd	oj
CVE-2026-54899	2427865	f5-fluentd	oj
CVE-2026-54900	2427841	f5-fluentd	oj
CVE-2026-54901	2427869	f5-fluentd	oj
CVE-2026-54902	2427873	f5-fluentd	oj
CVE-2026-54903	2427845	f5-fluentd	oj
CVE-2026-5545	2325133, 2325765	f5-fluentbit, postgresql	curl, libcurl4t64
CVE-2026-56852	2426961, 2426977, 2426997, 2427025, 2427041, 2427057, 2427169, 2427213, 2427233, 2427269, 2427289, 2427305, 2427409, 2427449, 2427469, 2427509, 2427513, 2427517, 2427521, 2427525, 2427545, 2427701, 2427801, 2427889, 2427949, 2427969, 2427985, 2428001, 2428009, 2428053, 2428069, 2428085, 2428129, 2428157, 2428173, 2428189, 2428205	crd-conversion, crd-installer, crdupdater, f5-analyzer, f5-bdosd, f5-bnk-cis, f5-cert-manager-extension, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-dwbld, f5-env-discovery, f5-epp, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, spk-csrc, spk-cwc, strongswan	golang.org/x/text
CVE-2026-5773	2325081, 2325829	f5-fluentbit, postgresql	curl, libcurl4t64
CVE-2026-58055	2428425	f5-fluentbit	libnghttp2-14
CVE-2026-58469	2428373, 2428389, 2428409	f5-downloader, f5-urlcat, f5ing-tmm-pod-manager	wget
CVE-2026-58470	2428377, 2428393, 2428413	f5-downloader, f5-urlcat, f5ing-tmm-pod-manager	wget
CVE-2026-58471	2428381, 2428397, 2428417	f5-downloader, f5-urlcat, f5ing-tmm-pod-manager	wget
CVE-2026-58472	2428385, 2428401, 2428421	f5-downloader, f5-urlcat, f5ing-tmm-pod-manager	wget
CVE-2026-5928	2325085	postgresql	glibc
CVE-2026-5958	2326173, 2335737, 2335893, 2336049, 2336205, 2336361, 2336545, 2336701, 2336857, 2337021, 2337177	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img	sed
CVE-2026-59762	2310861
CVE-2026-6019	2428289, 2428349	f5-bnk-cis, spk-csrc	libpython3.12-minimal
CVE-2026-6042	2325693	vault	musl
CVE-2026-6100	2428293, 2428353	f5-bnk-cis, spk-csrc	libpython3.12-minimal
CVE-2026-6253	2325137, 2325769	f5-fluentbit, postgresql	curl, libcurl4t64
CVE-2026-6276	2325089, 2325833	f5-fluentbit, postgresql	curl, libcurl4t64
CVE-2026-6429	2325141, 2325773	f5-fluentbit, postgresql	curl, libcurl4t64
CVE-2026-6472	2325145, 2325777	f5-fluentbit, postgresql	libpq5, postgresql
CVE-2026-6473	2325093, 2325781	f5-fluentbit, postgresql	libpq5, postgresql
CVE-2026-6474	2325149, 2325785	f5-fluentbit, postgresql	libpq5, postgresql
CVE-2026-6475	2325097, 2325789	f5-fluentbit, postgresql	libpq5, postgresql
CVE-2026-6476	2325101, 2325793	f5-fluentbit, postgresql	libpq5, postgresql
CVE-2026-6477	2325105, 2325797	f5-fluentbit, postgresql	libpq5, postgresql
CVE-2026-6478	2325153, 2325801	f5-fluentbit, postgresql	libpq5, postgresql
CVE-2026-6479	2325109, 2325805	f5-fluentbit, postgresql	libpq5, postgresql
CVE-2026-6575	2325157, 2325809	f5-fluentbit, postgresql	libpq5, postgresql
CVE-2026-6637	2325113, 2325813	f5-fluentbit, postgresql	libpq5, postgresql
CVE-2026-6638	2325117, 2325817	f5-fluentbit, postgresql	libpq5, postgresql
CVE-2026-7168	2325161, 2325821	f5-fluentbit, postgresql	curl, libcurl4t64
CVE-2026-7383	2335265, 2335565, 2335793, 2335949, 2336105, 2336261, 2336417, 2336601, 2336757, 2336913, 2337077, 2337233, 2337277	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault, vault-init	libcrypto3, libssl3t64
CVE-2026-7774	2428297, 2428357	f5-bnk-cis, spk-csrc	libpython3.12-minimal
CVE-2026-8084	2325169	postgresql	gdal
CVE-2026-8086	2325173	postgresql	gdal
CVE-2026-8087	2325177	postgresql	gdal
CVE-2026-8088	2325181	postgresql	gdal
CVE-2026-8212	2325185	postgresql	gdal
CVE-2026-8213	2325189	postgresql	gdal
CVE-2026-8286	2364853, 2364889, 2364925, 2364961, 2365017, 2365053	crd-installer, f5-access-apmd, f5-debug-sidecar, f5-fluentbit, f5ingress, ocnos-img	curl, libcurl4t64
CVE-2026-8328	2428301, 2428361	f5-bnk-cis, spk-csrc	libpython3.12-minimal
CVE-2026-8376	2365077	baseos	perl-base
CVE-2026-8458	2364857, 2364893, 2364929, 2364965, 2365021, 2365057	crd-installer, f5-access-apmd, f5-debug-sidecar, f5-fluentbit, f5ingress, ocnos-img	curl, libcurl4t64
CVE-2026-8924	2364861, 2364897, 2364933, 2364969, 2365025, 2365061	crd-installer, f5-access-apmd, f5-debug-sidecar, f5-fluentbit, f5ingress, ocnos-img	curl, libcurl4t64
CVE-2026-8925	2428429	f5-fluentbit	libcurl4t64
CVE-2026-8927	2364841, 2364877, 2364913, 2364949, 2365005, 2365041	crd-installer, f5-access-apmd, f5-debug-sidecar, f5-fluentbit, f5ingress, ocnos-img	curl, libcurl4t64
CVE-2026-8932	2364865, 2364901, 2364937, 2364973, 2365029, 2365065	crd-installer, f5-access-apmd, f5-debug-sidecar, f5-fluentbit, f5ingress, ocnos-img	curl, libcurl4t64
CVE-2026-9076	2335269, 2335569, 2335797, 2335953, 2336109, 2336265, 2336421, 2336605, 2336761, 2336917, 2337081, 2337237, 2337281	baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault, vault-init	libcrypto3, libssl3t64
CVE-2026-9547	2364869, 2364905, 2364941, 2364977, 2365033, 2365069	crd-installer, f5-access-apmd, f5-debug-sidecar, f5-fluentbit, f5ingress, ocnos-img	curl, libcurl4t64
CVE-2026-9669	2428305, 2428365	f5-bnk-cis, spk-csrc	libpython3.12-minimal

New features

Intelligent AI load balancing enhancements

BNK 2.4.0 expands intelligent AI load balancing to include:

• Prefix-aware caching: BNK identifies reusable prompt prefixes and accounts for existing KV-cache state when it routes new inference requests. BNK directs requests that share a prefix to endpoints that already hold the relevant cache state. This avoids repeated prompt processing.

• Proprietary endpoint picker: BNK 2.4 adds its own host-based endpoint picker. The endpoint picker makes AI-specific endpoint-selection decisions without an external component. It combines prefix-cache affinity, endpoint load, queue conditions, GPU telemetry, KV-cache state, and endpoint health to select the best available inference endpoint for each request.

• Prefill-decode disaggregation: BNK 2.4 routes the prefill and decode phases of LLM inference to separate worker pools optimized for each. Prefill is compute-intensive and processes the input prompt to establish KV-cache state. Decode generates output tokens and has different compute and memory needs. Separate phases let you optimize infrastructure per phase instead of requiring every endpoint to do both.

These enhancements let BNK fulfill requests based on prompt similarity, available KV-cache state, and the different resource needs of prefill and decode processing. Earlier versions of this feature relied on real-time system conditions alone, which could generate unnecessary computation. The 2.4 enhancements improve workload placement, GPU efficiency, and key inference metrics. These metrics include time to first token (TTFT), token throughput, and overall request throughput.

These capabilities aren’t tied to a specific inference runtime or model server.

For more information, see AI Inference Routing with the F5 Endpoint Picker.

NVIDIA Dynamo integration

This release adds an integration with NVIDIA Dynamo, an open source, low-latency, modular inference framework. You can now use BNK as the enterprise traffic-control layer in front of Dynamo-backed inference deployments. This integration applies your ingress and traffic policies, security controls, observability tooling, and intelligent AI workload placement to Dynamo’s scale-out inference architecture.

The integration works at two points. BNK selects a specific Dynamo worker and targets it with an x-worker-id header. The endpoint decision reaches a pool member instead of the inference fabric. The F5 Analyzer forms that decision from KV-cache and worker events that Dynamo workers publish over NATS. BNK 2.4 adds ZMQ as a transport. The Analyzer core combines those events with GPU metrics exported to Prometheus. These metrics include DCGM, NIM, and vLLM data for temperature, power, memory, and utilization.

Gateway API Inference Extension (GAIE) support

Gateway API Inference Extension support aligns BNK with Kubernetes-native inference traffic management. You describe inference traffic targets in Kubernetes-native configuration. BNK provides the data-plane enforcement, AI-aware routing, policy, and observability that production requires. This feature removes the need for custom routing models when you expose self-hosted generative AI services.

BNK 2.4.0 implements GAIE through a controller that watches three resource types: InferencePool (selector, endpointPickerRef), InferenceModelRewrite (rules, match, targets, weights), and Gateway. An infrastructure annotation on the Gateway references F5’s endpoint picker (EPP) service. The F5 Analyzer CRD manages EPP-specific configuration. The endpoint picker is F5’s own implementation, added in 2.4.0 as part of the intelligent AI load balancing enhancements. The F5 Analyzer hosts the EPP as an ext_proc server with its own tokenizer and scoring algorithms. TMM calls the EPP over gRPC from the data plane. BNK 2.4.0 raises the limit from one EPP per namespace to multiple EPPs per namespace. Each inference pool in a namespace can have its own picker.

For more information, see AI Inference Routing with the F5 Endpoint Picker.

MCP and A2A persistence profiles with OIDC and JWT validation

BNK adds support for MCP and A2A persistence profiles. These profiles provide protocol-aware traffic persistence for stateful agentic workloads. MCP and A2A interactions can include sessions, streams, task state, or long-running workflows whose follow-up requests must reach the same backend. As MCP servers, A2A agents, and tool services scale horizontally, persistence profiles preserve continuity across requests.

BNK 2.4.0 also adds OIDC and JWT validation for agentic workload delivery. BNK validates identity claims at the traffic layer before traffic reaches MCP servers, A2A agents, tools, or sensitive enterprise services. This gives you an IAM enforcement point at ingress. Together, protocol-aware persistence and identity validation make BNK a secure delivery layer for MCP and A2A workloads instead of a generic L7 proxy in front of agentic applications. OAuth-based flows are planned for a later release.

For more information, see NetPolicy.

Egress traffic through the Gateway API

You can now route outbound traffic from application pods through TMM with the new EgressGateway custom resource. Select which pods use an egress gateway by namespace, by pod label, or by both. Each egress gateway creates IPv4 and IPv6 wildcard virtual servers that use the selected pod IP addresses as source addresses.

In a multi-tenant environment, you can deploy a separate EgressGateway for each tenant. Each one binds to a distinct egress configuration with its own network, SNAT pool, and VRF. This keeps each tenant’s egress traffic isolated. The SecPolicy custom resource can now target an EgressGateway to apply firewall policies to egress virtual servers.

This release also adds two supporting CRDs for the Gateway API network model:

• Infra: The Infra custom resource centralizes underlay network configuration in a single, singleton resource. It defines IPAM pools, network attachments, VRF instances, VLAN and VXLAN networks, and static routes. This consolidates configuration that previously required multiple CRDs and a ConfigMap.

• GatewaySettings: The GatewaySettings custom resource configures tenant-specific traffic settings, including SNAT pools, ingress listener networks, and named egress paths. You can deploy it for ingress, egress, or both. It references infrastructure elements from the Infra CR. This keeps infrastructure and tenant configuration separate.

For details, see Configure an egress gateway for outbound pod traffic, Configure network infrastructure with the Infra CRD, and Configure tenant traffic settings with GatewaySettings.

Configurable TLS ciphers and minimum TLS version

You can now set the cipher suites and the minimum TLS version for Gateway API listeners and for BackendTLSPolicy. Add the f5.com/ciphers and f5.com/minTLSVersion keys to the options map on a listener’s TLS configuration or on a BackendTLSPolicy. The f5.com/ciphers key takes an OpenSSL-format cipher list, and f5.com/minTLSVersion accepts 1.2 or 1.3. Use these keys to enforce stronger client-side and server-side TLS settings per listener and per backend.

For more information, see Gateway.

Virtual Routing and Forwarding (VRF) with API-based dynamic routing

This release makes full VRF support generally available, along with API-driven dynamic routing per tenant. VRF supports per-tenant ACL-based ingress and egress policy enforcement. It offers isolated, programmable L3 segmentation and traffic control in multi-tenant environments.

For more information, see Border Gateway Protocol (BGP) routing with Kubernetes CRDs.

VXLAN-based EVPN over BGP

This release makes VXLAN-based EVPN over BGP generally available. It supports scalable L3 overlays with built-in endpoint mobility and micro-segmentation. This feature supports multi-tenant AI workloads in complex environments. It also supports dynamic endpoint mobility and tenant isolation, and it works with existing data center fabrics.

For more information, see Border Gateway Protocol (BGP) routing with Kubernetes CRDs.

Observer CRD for custom statistics in multi-tenant environments

This release makes the Observer CRD generally available. In shared environments, performance metrics across multiple tenants are hard to manage because each tenant has unique monitoring needs. To solve this, BNK 2.4.0 adds the Observer custom resource definition (CRD). The Observer CRD lets you define custom statistics, scraping parameters, and metric aggregations for each tenant without affecting other tenants on the same infrastructure.

The Observer CR supports the following use cases:

• Isolated performance monitoring: Tenants gain full autonomy to define what they scrape and at what intervals, with no metric overlap.

• Resource and bandwidth efficiency: Tenants export only the telemetry they need, which optimizes CPU and storage overhead. Tenants can also relabel and extract specific labels from existing metrics to integrate with customized downstream Prometheus systems.

• Flexible aggregations: The Observer CR supports multiple telemetry profiles based on each tenant’s diagnostic needs. For example, a tenant that needs to troubleshoot a transient network issue can switch to Diagnostic mode. After you fix the issue, the tenant reverts to standard Aggregated mode, with no impact on the profiles of other tenants in the cluster.

You can still customize metrics at the cluster level.

For more information, see Manage statistics with tenant-aware configuration.

Limited availability and early access

Note

F5 provides early access feature documentation on request. Contact your F5 account team.

Additional Fluent support for external log servers

This release adds early access support for more external log server integrations. You can now forward logs to Kafka and Syslog.

Enhancements

• Improved the Debug API. A system administrator can now use the API to pull a full Qkview or change the system log level dynamically. For more information, see /troubleshooting/debug-apis/spk-debug-apis.md.

• Improved Gateway API conformance. For more information, see Gateway API Conformance tests report and TLSRoute.

• You can now use a single SecPolicy to target Gateway and EgressGateway resources in other namespaces. Set the target namespace in the targetRefs[].namespace field. Then label the target resource or its namespace to allow the cross-namespace reference. Before this release, a SecPolicy could target only resources in its own namespace, so you had to duplicate policies in each namespace. Now you can centralize one logging or security configuration and reuse it across namespaces.

For more information, see SecPolicy.

Helm-chart and custom-resource schema changes

• The BNKNetPolicy is renamed to NetPolicy.

• The BNKSecPolicy is renamed to SecPolicy.

• The API group gateway.k8s.f5net.com changed to gateway.k8s.f5.com.

• Added the Infra CRD (gateway.k8s.f5.com/v1alpha1, kind Infra, short name infra). A singleton resource that defines ipams, networkAttachments, vrfs, networks, and staticRoutes.

• Added the GatewaySettings CRD (gateway.k8s.f5.com/v1alpha1, kind GatewaySettings, short name gws). Defines sourceNATPools, ingressConfig, and egressConfigs.

• Added the EgressGateway CRD (gateway.k8s.f5.com/v1alpha1, kind EgressGateway, short name egw). Defines gatewayClassName, infrastructure, and sourceSelector.

• The sourceNATConfig.type field supports the SNAT modes Automap, None, Pool, and UseIngressAddress (egress only).

• Added the targetRefs[].namespace field to the SecPolicy CRD. Sets the namespace of the target Gateway or EgressGateway. Defaults to the SecPolicy namespace when omitted.

• Removed the legacy BNKGateway CRD and its GatewayClass parameters reference.

• Added the listeners.tls.options field to the Gateway API Gateway resource. Supports the f5.com/ciphers key (OpenSSL cipher list) and the f5.com/minTLSVersion key (1.2 or 1.3) for client-side TLS.

• Added the spec.options field to the BackendTLSPolicy resource. Supports the f5.com/ciphers key (OpenSSL cipher list) and the f5.com/minTLSVersion key (1.2 or 1.3) for server-side TLS.

Fixed issues

> List of fixed issues.

2349797-5

Custom analyzer plugin fails with “Invalid request schema” when dynamicCapacityReduction is configured in F5BigAnalyzer CR

Component: analyzer

Symptoms: When using a custom Python analyzer plugin with BNK v2.3.x, every analyzer cycle fails with "status": "error", "message": "Invalid request schema". The analyzer pod logs show the payload is rejected before the plugin logic executes. As a result, weight annotations are removed from L4Route and HTTPRoute CRs on every cycle, and traffic reverts to default round-robin instead of the intended weighted distribution.

Conditions: Occurs when:

1. BNK v2.3.x is deployed with Intelligent AI Load Balancing enabled (intelligentLB: enabled: true in CNEInstance CR).

2. An F5BigAnalyzer CR of type “custom” is configured referencing ConfigMap-based Python plugin.

3. dynamicCapacityReduction is present in the F5BigAnalyzer CR spec (the issue occurs regardless of enabled: true or enabled: false).

4. The custom plugin uses PLUGIN_REQUEST_SCHEMA with “additionalProperties”: False — as shown in the official reference implementation (custom_plugins/custom_plugin.py) and in CloudDocs.

Impact: Custom analyzer plugin execution fails on every cycle. Weight calculation logic never runs. L4Route and HTTPRoute weight annotations are removed, reverting traffic to default round-robin. Dynamic AI load balancing is completely non-functional for all custom plugin deployments on BNK v2.3.x when dynamicCapacityReduction is present in the CR.

Workaround: In the custom plugin ConfigMap, change "additionalProperties": False to "additionalProperties": Truein PLUGIN_REQUEST_SCHEMA. This allows the plugin to accept unknown fields without failing validation. The dynamic_capacity_reduction field will be silently ignored if the plugin does not use it. After updating the ConfigMap, restart the analyzer pod:

kubectl rollout restart deployment/f5-analyzer -n f5-bnk

2449625-3

On restart, TMM reserves NAT IP ranges used by another active TMM

Component: CGNAT

Symptoms: After restart, the newly started TMM Pod may reserve NAT IP ranges already owned by another active TMM Pod, causing duplicate NAT IP range assignments across Pods.

Conditions: Occurs when:

1. Deployment consists of more than 10 TMM Pods.

2. Deployment is configured with source translation (NAT) objects.

3. A TMM Pod with a higher-indexed device name (e.g., DP-1) is restarted.

Impact: Traffic disruption caused by two TMM pods holding overlapping NAT IP ranges.

Fix Text: Fixed the NAT IP reservation logic to assign each TMM Pod a unique, non-overlapping NAT IP range after restarts or scale-ups.

2318785-1

Missing log fields in NAT transaction event logs

Component: cnf_future

Symptoms: The logs generated for NAT translation events do not include bigip_hostname and management_ip_address fields.

Conditions: Occurs when:

• Configure AFM NAT policy, Log profile and attach it to secure context.

• Send traffic to match AFM NAT policy rules and execute NAT translations.

Impact: There is no functional impact. Logs generated to track NAT translations does not have the fields - bigip_hostname & management_ip_address

Fix Text: Fixed NAT translation event logs to generate ‘bigip_hostname’ and ‘management_ip_address’ fields.

2345657-1

DNS virtual server unresponsive after VLAN is delete and recreate in F5BigDnsApp

Component: dns

Symptoms: Deleting and recreating the F5BigNetVlan CR referenced by F5BigDnsApp causes the DNS virtual server to stop forwarding traffic.

Conditions: Occurs when:

1. F5BigDnsApp CR is configured with a VLAN referenced in spec.vlans.vlanList

2. The referenced F5BigNetVlan CR is deleted

3. The same F5BigNetVlan CR is recreated

Impact: The DNS virtual server stops forwarding traffic until you manually reapply the F5BigDnsApp CR.

Workaround: After you recreate the VLAN, delete and reapply the F5BigDnsApp CR.

Fix Text: Fixed the F5BigDnsApp reconciliation logic for changes to a referenced F5BigNetVlan CR. Now the DNS Virtual Server automatically resumes forwarding traffic when you delete and recreate the referenced VLAN, without requiring you to reapply the F5BigDnsApp CR.

2433669-3

DNS cache is not created when a local zone record contains double quotes

Component: dns-cache

Symptoms: The DNS cache is not created when a local zone record contains a value with double quotes, such as a TXT record.

Conditions: A local zone contains a record whose data includes double quotes.

Impact: The DNS cache creation fails, and the affected local zone records are not available through the DNS cache.

Workaround: Until the system is upgraded, avoid using double quotes in local zone record data.

Fix Text: The system now correctly escapes double quotes in local zone record data when creating the DNS cache.

2338109-5

Upgrade unbound to version 1.25.1

Component: dns-cache

Symptoms: Upgrade unbound to version 1.25.1 to include latest fixes.

Condition: BNK/CNF was using unbound version 1.23.1

Impact: Upgrade unbound to version 1.25.1 to include the latest fixes

Fix Text: Upgrade to version 1.25.1 to include latest fixes.

2289817-4

Erroneous TXQ Full Health Check Marks Interface Down, Causing TMM Pod Connectivity Loss

Component: Drivers

Symptoms: TMM fails with errors:

• “Error: Set unhealthy status flag because txq has been full for <####> seconds”

• “Error: Marking down interface because unhealthy flag set to true.”

Conditions: Occurs when:

• TMM handles traffic but one or more dataplane interfaces expose fewer device queues than available threads.

• Multiple TMM threads share a single device queue, increasing the likelihood the NIC struggles to handle traffic on the TX path.

• Temporary rise in blocked counters can trigger the internal TXQ health check.

Impact: Loss of data-plane connectivity as interfaces are marked down.

Workaround: You can:

• Disable txq healthcheck by setting the timeout to 0.

• In your TMM deployment, add a new configmap or a host file with the following content: ndal tx_dq_timeout_sec 0

• This configmap or host-file should appear within the TMM container as “/opt/lib/tmm/tmm_init.tcl.pre”.

Fix Text: Update the health check to correctly handle wrap-arounds of the “sent” counter.

2295357-4

Generalized driver override support through the TMM Helm chart

Component: Drivers

Symptoms: To override a network driver, you must manually create a ConfigMap for xnet_init.tcl and modify the TMM deployment with the appropriate volumeMounts to mount this ConfigMap as the /config/xnet_init.tcl file in the TMM container.

Conditions: The deployment requires network driver overrides that you specify through the xnet_init.tcl ConfigMap.

Impact: This request for enhancement (RFE) improves an existing feature to simplify usage and provide generalized support.

Fix Text: Set the xnetInit property in your values.yaml file to enable TMM network driver overrides:

tmm:
    xnetInit:
      enabled: true
      content: |
        # Intel E810
        device driver vendor_dev 8086:1889 dpdk
        # Intel X710/XXV710/XL710
        device driver vendor_dev 8086:154c iavf

2456133-1

DPDK: ndal_dev_status does not reflect status if the virtual function is not bound to the driver

Component: Drivers

Symptoms: After you remove a DPDK Virtual Function (VF) from its driver, the ndal_dev_status table still reports if_up and link_up as y, even though the device is no longer operational.

Conditions: The virtual function is removed from its PCI driver while the TMM pod is running, using a DPDK Mellanox network device.

Impact: The ndal_dev_status table reports stale link status (if_up: y, link_up: y) for a virtual function that is no longer bound to its driver, preventing accurate monitoring and diagnostics of network device state.

Fix Text: Added asynchronous device-removal monitoring in the DPDK xnet layer. Registered ports are periodically checked via DPDK alarm callbacks outside the dpdk_get_link_state() path, setting a per-port removed flag when removal is detected. dpdk_get_link_state() checks that flag before returning cached link information, so ndal_dev_status reports the VF as down after driver unbind without placing the removal check on the hot status path.

2460469-1

BGP/BFD fails when SR-IOV VF is in host namespace due to mlx5_core driver bind race

Component: Drivers

Symptoms: BGP/BFD sessions never established caused because bonded interface was not created. The bonded interface is not created because the 2nd virtual function is suddenly unbound by CNI plugin.

Conditions: The virtual function is unbound from its PCI driver while the TMM pod is running, using a DPDK Mellanox network device.

Impact: BGP and BFD sessions fail to establish because the TMM data plane interface backed by the affected VF is not operational. ndal_dev_status may continue reporting the interface as up, masking the underlying failure.

Workaround: Restarting the TMM pod may resolve the issue if the VF bind race does not recur.

Fix Text: Added asynchronous device-removal monitoring in the DPDK xnet driver. Registered ports are periodically checked via DPDK alarm callbacks outside the dpdk_get_link_state() path, setting a per-port removed flag when removal is detected. dpdk_get_link_state() checks that flag before returning cached link information, so ndal_dev_status correctly reports the VF as down.

2368565-5

TMM connects to read-only DB causing NAT operation failures

Component: dssm

Symptoms: After restart, TMM re-established its connection to the DSSM database pod but connected to the replica instead of the primary. This misconnection caused session APIs to fail, which in turn caused configured NAT operations to fail.

Conditions: TMM should be connected to sentinel-based Redis connection with NAT traffic enabled.

Impact: Because the TMM is connected to READONLY DB, the data sent to Redis DB will not be saved.

Fix Text: Fixed code to perform a Redis DB role check after establishing the connection.

2447705-1

Crashagent or Qkview-Collect exit causes F5-DSSM container to terminate and enter CrashLoopBackOff

Component: dssm

Symptoms: The DSSM container terminates whenever the crashagent or qkview-collect process exits because the s6 service finish scripts configured for these processes trigger a full container shutdown upon their exit.

Conditions: DSSM container with s6 service enabled for crashagent and qkview collector.

Impact: The DSSM pod goes into CrashLoopBackOff and will restart.

Fix Text: Removed the s6 finish scripts for both crashagent and qkview-collect, as basOS now handles their lifecycle management.

2368573-5

Lua script returns user-script errors when handling large arrays

Component: dssm

Symptoms: Scripts assume ARGV[] fields and Redis LINDEX/LRANGE results are always non-nil numeric strings, and raise a Lua runtime error when that assumption is violated.

Conditions: Lua scripts in Redis perform set and incr_if operations on long array data.

Impact: Script errors prevent Redis from storing the data.

Fix Text: Fixed missing string-to-number conversions in the Lua scripts wherever needed to handle non-nil numeric strings.

2456769-4

Gradual increase in TMM memory usage

Component: Firewall (ACL)

Symptoms: TMM memory usage shows gradual increases and does not go down when traffic stops. Memory usage for ACL allocation type shows the growth.

Conditions: CNF Deployment with Firewall policy containing “Drop” action rules.

Impact: Traffic disruption after TMM memory reaches threshold level.

Workaround: Disable hardware offloading of Firewall rules in Global Option CR.

Fix Text: Do not initiate Hardware offload for non DPU deployments.

2399969-5

DSSM pod performance degradation with multiple pool members down

Component: fsm

Symptoms: When you create a pool with a pool member and a monitor, every TMM in a TMM pod sends status updates to the DSSM each time the pool member’s state changes. This behavior can degrade performance, especially when many TMM pods contain multiple TMMs, causing the problem to scale rapidly.

Impact: Multiple TMM pods and TMMs writing to DSSM at the same time can create performance bottlenecks in the DSSM pod.

Workaround: Increase the CPU allocation for the DSSM pod to prevent write operations from overloading it. Alternatively, reduce the number of TMM threads, TMM pods, or both.

Fix Text: Fixed the DSSM limits. DSSM now writes to a single TMM in a given TMM pod instead of writing to all TMMs.

2330525-1

ICMP monitor prematurely marks pool member down before probe timeout

Component: fsm

Symptoms: The ICMP monitor marks pool members as DOWN earlier than the configured thresholds allow. When the interval and timeout are both set to 5 seconds with the default down-count of 3, the monitor should keep a pool member UP until it misses three consecutive probes, with each probe timing out after 5 seconds — totaling 15 seconds from the first missed reply. Instead, the monitor marks the member DOWN after approximately 13 seconds.

Additionally, after marking the member DOWN, the monitor sends probes at irregular intervals. Probes that should arrive every 5 seconds instead arrive inconsistently, sometimes 2 or more seconds late.

Conditions: If the virtual server has an ICMP monitor.

Impact: The ICMP monitor incorrectly marks pool members as DOWN sooner than the configured settings intend, specifically when the interval equals the timeout. This premature health-check failure causes unnecessary traffic disruption, particularly in environments that expect brief network delays and configure the timeout to tolerate them.

Fix Text: The ICMP monitor now derives its internal idle timeout from the configured Interval and Timeout settings instead of using a fixed short internal value. This eliminates the internal timing mismatch that previously caused the monitor to mark pool members as DOWN prematurely. The monitor now waits for the full configured timeout period before marking a pool member as DOWN, honoring the down-count and interval/timeout settings as expected.

2330521-1

CNF Qkview API omits TMM-pod containers when custom TMM pod or App name causes mTLS x509 SAN mismatch

Component: fsm-config

Symptoms: Occurs when:

• CNF TMM pod is deployed with a custom (non-default) pod/app name (any name other than the default f5-tmm).

• The qkview API is invoked to collect diagnostic data from TMM-pod containers.

• mTLS gRPC is used between the qkview orchestrator and TMM containers

Conditions: When the TMM pod uses a custom pod or app name, the CNF Qkview API fails to collect data from TMM-pod containers. The Qkview orchestrator derives the mTLS ServerName from the custom pod or app label, but the TMM server certificate’s SAN always resolves to f5-tmm. regardless of the configured pod name. This causes x509 verification to fail with the following error:

rpc error: code = Unavailable desc = connection error: desc = "transport: authentication
handshake failed: x509: certificate is valid for f5-tmm.<namespace>, not <custom-name>.<namespace>"

As a result, the Qkview output excludes all affected TMM-pod containers.

Impact: CNF 2.2.1: The Qkview API collects only 4 out of 24 TMM containers. Only f5-toda-tmstats succeeds because its endpoint resolves to a service-name SAN rather than the custom pod name. CNF 1.4.0: The Qkview API fails to collect all 24 TMM containers because both the pod and main container use custom names. Additionally, manifest.json falsely reports “completion_status”: “complete” even though the API never writes the TMM sub-packages to disk.

Fix Text: The fix adds another dns name to all the places in certs file where before there was only hardcoded “f5-tmm” default. Now there is still “f5-tmm” hardcoded dns name and there is an added templated { include “tmm.appName” } which will pull in a custom non “f5-tmm” name and process it correctly.

2220989-2

BGP may not immediately update routes after route-map changes

Component: fsm-dynamic-routing

Symptoms: If you use a route-map to filter BGP advertisements, modifying the route-map in a way that affects the filtered routes does not trigger updates to those routes.

Conditions: Occurs while using BGP with a route-map filtering advertisements.

Impact: BGP table may not reflect route-map changes until “clear ip bgp soft out” is executed.

Workaround: Run “clear ip bgp soft out” to perform a soft reconfiguration.

2389165-5

IMI memory leak on every ‘show running-config’ execution

Component: fsm-dynamic-routing

Symptoms: The management/control-plane (imish) process gradually increases its memory usage over time and fails to reclaim it, which can degrade performance or trigger process restarts during prolonged or heavy CLI usage.

Conditions: Issue occurs by repeatedly viewing configuration contexts in the imish CLI — for example, by repeatedly running “show running-config.”

Impact: Each affected operation leaks a small memory block from the internal configuration tree. With frequent CLI or automation polling, long-running sessions, or scripted “show running-config” calls, memory in the imi process grows steadily, increasing memory pressure and potentially triggering an unexpected process restart on the device.

Fix TextFixed a memory leak in the imi configuration module by releasing the internal patricia-tree structure allocated for each configuration mode when the mode is freed. The updated cleanup path now properly frees this structure, preventing leaks during repeated “show running-config” and related config-mode operations.

2440693-4

Stale NAT kernel routes remain after routing container restart

Component: fsm-dynamic-routing

Symptoms: A routing container restart can leave stale NAT kernel routes when the system updates NAT policy mid-restart (for example, during an OOM-triggered restart).

Conditions: Occurs when:

• The routing container is restarted.

• The NAT policy addresses are modified.

Impact: A stale route is invalid or could cause cross-pod BGP route advertisements.

Workaround: Restart the entire Pod, or just tmrouted container.

Fix Text: During reinitialization of the routing daemon, a full load sync of routes will occur.

2359009-4

While using bdt_cli incorrect routeECMP routes are displayed

Component: fsm-dynamic-routing

Symptoms: The bdt_cli route command may not properly display Equal-Cost Multi-Path (ECMP) routes learned from BGP in Cloud-Native Network Function (CNF) environments.

Conditions: Display ECMP routes using ‘bdt_cli route’ command.

Impact: Incorrect output.

Fix Text: The bdt_cli route command now correctly displays ECMP nexthops in CNF environments.

2358997-4

After BGP routing re-convergence ECMP routes can be incorrect

Component: fsm-dynamic-routing

Symptoms: In CNF environments, Equal-Cost Multi-Path (ECMP) routes learned from BGP may not be properly installed after routing changes or BGP session resets. This can result in:

• Missing next-hop gateways in multi-path routes.

• Incorrect number of paths displayed for ECMP routes.

• Incomplete routing information on some pods.

Conditions: Occurs when,

• BGP routes are updated during network convergence events.

• Multipath ECMP routes are in use.

Impact: Incorrect ECMP routes cause traffic loss.

Fix Text: Fixed ECMP nexthops to install correctly when routes change.

1929045-12

TMM may core after HTTP::respond is used for the first request on iSession connection

Component: fsm-hudfilters

Symptoms: TMM crashes while establishing an iSession tunnel

Conditions: Occurs when:

• APM is configured

• Tunnel is being established

Impact: Traffic disrupted while TMM restarts

Fix Text: When the tunnel is negotiated, BIG-IP prepares the connection for a graceful transition to the appropriate state, and TMM no longer crashes with the identified conditions.

2460921-1

Malformed tmctl --csv output from embedded commas in text columns

Component: fsm-libtmstat

Symptoms: Malformed Tmctl –csv outputs due to data within the table containing columns that are comma separated.

For example, when printing the table without the csv option: /tmctl -d blade tmm/xnet/device_probed id available_drivers driver_selected driver_in_use

---

xeth0 sock, dpdk, sock Yes 0000:d8:0e.2 sock, dpdk, dpdk Yes 0000:d8:13.7 sock, dpdk, dpdk Yes

/tmctl -d blade tmm/xnet/device_probed –csv id,available_drivers,driver_selected,driver_in_use xeth0,sock, dpdk, ,sock,Yes 0000:d8:0e.2,sock, dpdk, ,dpdk,Yes 0000:d8:13.7,sock, dpdk, ,dpdk,Yes

Due to the available_drivers being comma separated, there are double commas that causes the csv issue.

Conditions: Running the tmctl command with the --csv or -c flag on a table that contains comma-separated values in a column produces malformed output.

Impact: Output of tmstat table columns are malformed when using –csv option.

Fix Text: Wrap comma-separated strings in tmctl --csv output in double quotes (e.g., “val1, val2”) to follow the CSV format.

root@tmm-gcalvert-20260820-203915-8:/config# tmctl -d blade -i tmm/xnet/device_probed –csv id,available_drivers,driver_selected,driver_in_use xeth0,”sock, “,sock,Yes 0000:b1:11.3,”dpdk_mlnx, dpdk, iavf, “,dpdk,Yes 0000:b1:12.3,”dpdk_mlnx, dpdk, iavf, “,dpdk,Yes 0000:b1:14.0,”dpdk_mlnx, dpdk, iavf, “,dpdk,Yes

2224957-4

IPFix Templates not retransmitted at configured periodic intervals

Component: HSL

Symptoms: When using HSL Publisher with IPFix Format destination, IPFix Template information is not being retransmitted. For every new UDP socket connection established to log server, a single HSL template is transmitted once for a session, but never retransmitted.

Conditions: When using IPFix Format destination for HSL log publisher, the log collector may not receive continuous updates of IPFix Template information at configured intervals (default being 30 seconds).

Impact: Log collector will not receive IPFIX Template updates at configured intervals.

Fix Text: After the fix, the conditions under IPFIX template is transferred are listed below for UDP.

1. No template transmission will happen on idle logging scenario.

2. On every new UDP socket connect to log collector from Tmm, template is transferred to log server at the beginning. Under no logging activity, UDP socket may get closed & only when new socket is opened again on logging activity, the Templates are transmitted again.

3. When logs are continously generated to a IPFix destination, IPFix Tempaltes are transmitted during log data transmission at the configured periodic interval.

2311589-3

TMM pod fails to delete when using a non-default tmm.name in values override

Component: ingress

Symptoms: TMM pod is not deleted when TMM’s main container terminates.

Conditions: Non-default tmm.name value is passed in the values overrides file (default is f5-tmm).

Impact: Configuration de-sync may occur, and the controller may not configure TMM correctly.

Fix Text: Non-default values can now be passed to tmm.name in values override. When TMM main container terminates deletion of TMM pod will occur correctly. Post helm install editing of deployment is still un-supported.

2288497-4

CR status falsely reports success when F5-TMM fails to apply configuration

Component: ingress

Symptoms: The F5 Ingress Controller marks the CR status READY=true and reports “CR config sent to all grpc endpoints” even when F5-TMM fails to receive or apply the configuration. This behavior creates a false positive because the controller only confirms that it completed the gRPC send without transport-level errors and does not verify that F5-TMM applied the configuration internally.

Conditions: This can occur when:

• An f5-tmm pod is evicted/rescheduled (during node draining) while configuration is in-flight, causing partial delivery when the connection is re-established.

• A transient network interruption occurs while an f5-tmm pod is restarting, resulting in some objects being delivered before the interruption and others after, leaving f5-tmm with a partial configuration set.

• f5-tmm receives the gRPC message without a transport error but fails to apply the configuration internally (due to a transient internal error or state inconsistency), most frequently observed in clusters with a large number of f5-tmm replicas.

Impact: Configuration expected to be present on f5-tmm may be missing or partially applied, while the Kubernetes CR status continues to report success. This can result in traffic-affecting misconfiguration (e.g., missing Snatpool, virtual server, or pool objects) with no indication that remediation is required.

Workaround: Restart F5ingress. If issues persist after the f5ingress pod restart, the restart removes the missing configuration and forces f5ingress to send a new configuration.

2277713-2

Unable to delete the SNATPool Custom Resource (CR) that was not created f5-cne-controller namespace

Component: ingress

Symptoms: The f5-cne-controller watches and processes SNATPool Custom Resources (CRs) within its own namespace, only. SNATPool CRs created in other namespaces are ignored by the controller, and attempts to delete them will fail due to a validation webhook error.

Conditions: F5-cne-controller installed using FLO and SNATPool Custom Resources (CRs) created in a namespace other than f5-cne-controller.

Impact: SNATPool Custom Resources (CRs) cannot be deleted.

Workaround: Follow the steps in sequence:

1. Create SNATPool Custom Resources (CRs) with same name in the f5-cne-controller namespace.

2. Delete non f5-cne-controller namespace CR.

3. Delete f5-cne-controller namespace CR.

Fix Text: Updated the ValidatingWebhookConfiguration resource to optimize behavior when wholeClusterMode is enabled. In this mode, the validating webhook validates only snatpool CR objects in the controller namespace and no longer intercepts requests for snatpool CRs in other namespaces. As a result, the webhook no longer restricts deleting snatpool CRs in non-controller namespaces.

2349689-1

Unable to recover Gateway CR after configuring with invalid TLS secret for Client-Side TLS

Component: ingress

Symptoms: The gateway.networking.k8s.io/v1 CR becomes non-functional if updated with invalid TLS certificates. Even after reverting the CR to reference valid certificates, it fails to recover.

Conditions: Occurs when:

1. Initial configuration with valid certificates: Apply Gateway CR with a valid secret. Running curl https:// succeeds.

2. Update with invalid certificates: Modify the Gateway CR to reference an invalid or corrupt secret. Running curl https:// fails as expected.

3. Revert to valid certificates: Update Gateway CR to reference back the valid secret. curl https:// continues to fail despite using correct and valid certificates.

The issue could also occur if you start out with an invalid certificate.

Impact: Ingress functionality for client-side TLS configured via Gateway CR is disrupted. The use case remains non-operational even when valid certificates are reapplied.

workaround: To resolve the issue, delete the affected Gateway CR and recreate it.

Fix Text: Validation has been implemented in the Control Plane to ensure that referenced secrets contain valid certificates. The CP now rejects CRs with invalid certificates or keys, providing appropriate error statuses when invalid configurations are attempted.

2339177-1

F5SPKVlan and F5BnkGateway resources stuck in Terminating state after foreground deletion

Component: ingress

Symptoms: When you delete an F5SPKVlan or F5BnkGateway custom resource using Kubernetes foreground deletion, the resource can get stuck in the Terminating state. The controller completes the dataplane cleanup but then tries to add the Kubernetes foregroundDeletion finalizer to the resource. Kubernetes rejects this update with the following error: "metadata.finalizers: Forbidden: no new finalizers can be added if the object is being deleted" Because the controller does not remove its own finalizer, Kubernetes cannot complete the deletion.

Conditions: This issue occurs when you delete an F5SPKVlan or F5BnkGateway custom resource that contains the controller-managed finalizer using Kubernetes foreground deletion. For example:

kubectl delete f5-spk-vlan <name> -n <namespace> --cascade=foreground

Impact: Kubernetes rejects the controller’s finalizer update with a metadata.finalizers: Forbidden error because it does not allow new finalizers on an object that is already being deleted. Even though the controller may complete the dataplane cleanup, it does not remove its own finalizer. This causes the F5SPKVlan or F5BnkGateway resource to remain stuck in the Terminating state. Kubernetes does not garbage-collect the resource, and applications such as Argo CD cannot recreate a resource with the same name until you remove the stuck finalizer.

Workaround: The fix checks whether the custom resource has a deletion timestamp because Kubernetes does not allow new finalizers after deletion starts. When a resource enters the delete path, the shared finalizer helper removes both the controller-owned finalizer and the Kubernetes foregroundDeletion (FinalizerDeleteDependents) finalizer from the calculated finalizer list, then returns a delete operation. This ensures the finalizer update only removes finalizers and prevents Kubernetes from rejecting the update with a metadata.finalizers: Forbidden error. As a result, F5SPKVlan and F5BnkGateway resources no longer get stuck in the Terminating state.

2313345-4

F5-license-proxy Helm chart fails to deploy with CSI-based storage provisioners or OpenShift restricted security constraints

Component: License Proxy

Symptoms: When you deploy the f5-license-proxy (FLP) Helm chart in an environment that uses a CSI-based dynamic storage provisioner or in an OpenShift cluster with restricted Security Context Constraints (SCC), the following issues occur:

• On OpenShift with a restricted SCC, the IPC_LOCK capability prevents vault and vault-init pods from scheduling.

• Selector.matchLabels defined in the chart prevent CSI dynamic provisioners from binding volumes, leaving PVCs stuck in Pending.

• The chart sets storageClassName: standard in all PVs and PVCs, preventing use of a custom storage class.

• The chart always creates three hostPath PersistentVolumes with no option to disable them.

• If you upgrade the chart and change volumes.vaultDataDir, Kubernetes returns an immutability error.

Conditions: Occurs when:

• f5-license-proxy Helm chart versions earlier than 1.29.0-0.10.40 is deployed with

  • a Kubernetes cluster that uses a CSI-based dynamic storage provisioner (such as EBS CSI or any non-hostPath provisioner), and/or

  • an OpenShift cluster that enforces the restricted or restricted-v2 SCC.

• Attempted to upgrade the chart while changing the volumes.vaultDataDir value.

Impact: Environments that use CSI-based storage or enforce OpenShift’s restricted SCC prevent deploying FLP, blocking installations entirely.

Fix Text: Fixed these issues in f5-license-proxy Helm chart (1.29.0-0.10.40)

• Added storage.createPV flag (default: true) to control rendering of the three static hostPath PersistentVolumes. Set this to false to skip PV creation in CSI-based environments.

• Exposed storage.storageClassName (default: “standard”) and apply it uniformly to all PVs and PVCs, allowing you to specify your cluster’s storage class.

• Added optional OpenShift Route support. A new flp-route.yaml template can create a Route with passthrough TLS termination (route.enabled: false by default). The Route host must match a SAN in the FLP server TLS certificate (set via FLP_HOST in setup.sh).

• Removed IPC_LOCK from the vault and vault-init container securityContexts. Because disable_mlock = true is already set in vault.hcl, this capability was unnecessary and prevented scheduling under OpenShift’s restricted SCC. All containers now drop all capabilities.

• Render selector.matchLabels on all three PVCs only when storage.createPV: true. Omit selectors with CSI provisioners so dynamic provisioning works correctly. Upgrade note: The immutable PV spec issue during upgrades remains an operational constraint. Chart upgrades are not supported; reinstall the chart when changing versions.

2284341-8

PEM Gx Session Bin Entry Stay Even After PEM Session Deletion

Component: PEM_Diameter

Symptoms: Gx sessions remain even after the deletion of PEM sessions. The memory allocated to Gx sessions remains intact. As more PEM sessions are created and deleted, the memory for Gx sessions continues to grow and is not released.

Conditions: This is a rare timing-based scenario in which the diam_app is busy sending requests to a non-responsive PCRF. As a result, the middleware (MW) message bus becomes full. When this happens, the notification from SPM to Gx to end the Gx session is dropped because the MW bus has reached its capacity.

Impact: A slight increase in memory due to Gx sessions persisting even after PEM session deletion may lead to consequences over time, such as memory shortages.

Fix Text: Measures were implemented to ensure the deletion of the Gx session if the PCRF is unresponsive and a Gx session cannot be established with it.

2229893-10

PEM mw_bus is missing stats in production builds

Component: PEM_General

Symptoms: Middleware runtime statistics are unavailable in production builds because middleware tmstat instrumentation is only enabled in debug builds.

Conditions: Running a production (non-debug) TMM build and attempting to inspect middleware runtime statistics for troubleshooting or post-incident analysis.

Impact: Reduced diagnosability for engineering and support teams. No impact on traffic handling or feature functionality.

Fix Text: Middleware tmstat instrumentation is now enabled in production builds, providing access to middleware runtime statistics for troubleshooting and post-incident analysis while preserving existing functionality

2368509-7

Coremond may write core files to ‘unknown’ when pod or container names mismatch

Component: toda_coremond

Symptoms: Renaming a pod causes coremond to write the pod’s core files under /var/cores/<node>/unknown/ instead of the expected namespace directory because the configuration file mis-maps the pod and container names. This is a known issue in CNF 2.2.0. In CNF 2.3.0 and later, coremond no longer uses that configuration file, so the issue does not occur.

Conditions: This occurs when the pod name or Helm release name differs from the actual container name and the configuration file cannot accurately map the renamed pod name and the container name.

Impact: The core files generated by a pod are written under /var/cores/<node>/unknown/ instead of the expected namespace directory.

Workaround: You can customize the configuration file to explicitly provide the process-to-container mapping, for example:

pods:
  l1s6svcgtm:
    containers:
      tmm.0: f5-tmm

Fix Text: Customize the configuration file to explicitly provide the process-to-container mapping, for example:

pods:
  l1s6svcgtm:
    containers:
      tmm.0: f5-tmm

2289845-5

Resource limits set in Helm charts

Component: toda_fluentd

Symptoms: In release 2.2.0, installers had to manually configure resource limits for the Fluent Bit sidecar in f5-downloader and f5-toda-fluentd pods. The cluster enforces the rq-f5-cor-cgn ResourceQuota, which requires explicit CPU and memory limits for all containers.

Conditions: Unable to deploy f5-downloader and f5-toda-fluentd pods in Kubernetes because required resources were missing: the fluentbit sidecar container definition in f5-downloader and the fix-perms and fix-home-perms init container definitions in f5-toda-fluentd.

Impact: Pod creation failed with quota errors.

Fix Text: Starting with 2.2.x, the Helm charts configure CPU and memory limits by default (including for f5-downloader’s Fluent Bit sidecar and f5-toda-fluentd init containers), removing the need for manual settings.

2292021-5

Automated cleanup of orphaned log folders fully supported

Component: toda_fluentd

Symptoms: CNF 2.2.0 introduced the Automated Orphaned Log Folder Cleanup feature as an optional capability and documented it in the release notes. Initially, installation and upgrade workflows did not seamlessly support this feature.

Conditions: Helm chart for f5-toda-fluentd did not by default expose an env: or extraEnvVars: array in values.yaml to allow users to pass custom environment variables (such as those controlling the Folder Cleaner behavior) while installing/upgrade.

Impact: To support this feature, users needed to update the deployment’s environment variables after installation or upgrade.

Fix Text: Updated Fluentd helm charts to support the feature by default from release 2.2.x

Known Issues

> List of known issues.

2290393-2

Ingress FW rules fail for hairpin traffic across zones

Component: AFM

Symptoms: Ingress firewall rules fail for hairpin traffic when the app pod and TMM pod are in different zones.

Conditions: Applies only to hairpinned traffic.

Impact: In the IBM setup, when app pod A in Zone 1 sends traffic to TMM B in Zone 2, the local TMM A SNATs the packet’s source IP. This IP change prevents the ingress firewall rule on the remote TMM B from matching and filtering the packet.

Workaround: Apply the same firewall rule on TMM A egress instead of on TMM B ingress.

2484001-1

cert-manager fails to auto-recover and create a certificate after you fix ClusterIssuer and delete the TLS secret

Component: Cert-Mgr

Symptoms: After you correct an invalid ClusterIssuer and delete the TLS secret, cert-manager does not immediately create a new certificate and does not generate a new Order, which appears to prevent auto-recovery.

Conditions: An invalid ACME directory URL causes the certificate authority (CA) to reject the order and places cert-manager into exponential backoff (1–32 hours). The operator fixes the issuer, deletes the TLS secret and stale resources, and checks during the active backoff window.

Impact: This issue causes no permanent impact — cert-manager issues the certificate automatically once the backoff period elapses. If you delete the TLS secret during the backoff period, you may experience a temporary gap in certificate availability.

Workaround: cert-manager does not retry until the in-memory backoff period elapses, even after you fix the issuer and delete the TLS secret and stale CertificateRequest, Order, and Challenge resources. Once the backoff period elapses, cert-manager automatically recreates the CertificateRequest → Order → Challenge chain and issues the certificate.

To force immediate re-issuance (optional), use one of the following methods:

Run cmctl renew (if cmctl is installed):

cmctl renew <cert-name> -n <namespace>

Patch the Certificate status to set Issuing=True with reason RenewalRequested:

kubectl patch certificate <cert-name> -n <namespace> \
  --subresource=status \
  --type='merge' \
  -p '{
    "status": {
      "conditions": [
        {
          "type": "Issuing",
          "status": "True",
          "reason": "RenewalRequested",
          "message": "Manually triggered issuance of Certificate",
          "lastTransitionTime": "'$(date -u +'%Y-%m-%dT%H:%M:%SZ')'"
        }
      ]
    }
  }'

Rollout-restart the cert-manager pods to clear the in-memory backoff timers.

Delete and recreate the issuer and certificate with a valid configuration.

2457281-1

DNS behavior change: Aggressively scrubbing authoritative and additional sections to prevent cache poisoning

Component: dns-cache

Symptoms: After you upgrade the unbound version to 1.25.1 in this release, network diagnostics such as dig or nslookup on downstream clients may show that the AUTHORITY and ADDITIONAL sections of certain DNS responses are empty or significantly reduced compared to previous software versions.

Conditions: This behavior activates automatically when the upstream DNS server runs Unbound version 1.24.1 or later.

Impact: :* Security impact:: Greatly improved. The network now fully protects against a major security vulnerability (CVE-2025-11411). The underlying Unbound engine prevents attackers from hijacking your internet traffic through malicious data injection.

:* Operational impact:: None for normal web browsing, application connectivity, or email traffic. This change does not affect legitimate DNS queries. The only noticeable difference is that the resolver strips extraneous diagnostic data before it reaches your local network devices.

2436037-1

The TMM configview API does not display certain GSLB custom resources

Component: dns-gslb engine

Symptoms: The TMM configview API does not display GSLB custom resources (F5BigGslbSyncAgent, F5BigGslbLocalInstance, F5BigGslbInstance, and F5BigGslbProberPool) and returns the error: “Object not found or not supported” The configview API displays other GSLB objects such as Server, Pool, and Wideip as expected.

Conditions: When querying TMM configview for GSLB configuration, the F5BigGslbSyncAgent, F5BigGslbLocalInstance, F5BigGslbInstance, and F5BigGslbProberPool custom resources are not displayed. Returns “Object not found or not supported” error. But, other GSLB objects such as gslb_server, gslb_vs, and gslb_tmm_wideip are visible in configview as expected.

Impact: No functional impact. GSLB configuration is correctly applied and operational. The CR status shows “CR config sent to all grpc endpoints.” The only impact is that these four CR types cannot be inspected via the TMM configview API and must be inspected using alternative methods (kubectl describe, tmctl stats).

Workaround: Use kubectl describe to inspect these CRs and verify their delivery status. For runtime state, use tmctl stats on the gslb-engine pod:

• F5BigGslbLocalInstance: kubectl describe f5-big-gslb-local-instances.k8s.f5.com

• F5BigGslbInstance: kubectl describe f5-big-gslb-instances.k8s.f5.com

• F5BigGslbProberPool: kubectl describe f5-big-gslb-prober-pools.k8s.f5.com

• F5BigGslbSyncAgent: kubectl describe f5-big-gslb-sync-agents.k8s.f5.com

2471977-1

Deleting applied GSLB Instance custom resources required when upgrading the F5 CNF CRD bundle from BNK 2.2.4/2.2.3 to 2.4.0

Component: dns-gslb general

Symptoms: When you upgrade the F5 CNF CRD bundle (f5-cnf-crds Helm chart) from BIG-IP Next for Kubernetes 2.2.4 (or earlier 2.2/2.3 releases) to 2.4.0, the upgrade fails with the following error:

helm upgrade f5-cnf-crds f5-cnf-crds-<version>.tgz -n default
Error: UPGRADE FAILED: cannot patch "f5-big-gslb-instances.k8s.f5.com"
with kind CustomResourceDefinition: CustomResourceDefinition.apiextensions.k8s.io
"f5-big-gslb-instances.k8s.f5.com" is invalid: status.storedVersions[0]:
Invalid value: "v1alpha1": must appear in spec.versions

Conditions: Occurs when:

• You previously provisioned the cluster with the F5 CNF CRD bundle from a 2.2.x/2.3.x release, where the GslbInstance CRD exposed only the v1alpha1 API version.

• The 2.4.0 CRD bundle removes v1alpha1 from the GslbInstance CRD and exposes only v1, because GSLB moves from Early Access to Generally Available (GA) in 2.4.0 and the CRD schema standardizes on v1.

• The existing CRD’s status.storedVersions still references v1alpha1, which Kubernetes requires to remain in spec.versions before you can remove it.

• This occurs even if you have not created any GslbInstance custom resources on the cluster, because Kubernetes sets status.storedVersions when it establishes the CRD and does not clear it automatically.

Impact: The f5-cnf-crds Helm chart upgrade fails and blocks the overall platform upgrade from 2.2.4/2.3.x to 2.4.0.

Workaround: Before you upgrade the CRD bundle to 2.4.0:

1. Back up and delete any existing GslbInstance (v1alpha1) custom resources from the cluster.

2. Delete the existing CRD:

   kubectl delete crd f5-big-gslb-instances.k8s.f5.com
   

3. Run the Helm upgrade of the CRD bundle (f5-cnf-crds) to 2.4.0.

4. Recreate any required GslbInstance custom resources using the v1 API version after the upgrade completes.

2460797-1

GSLB Engine does not auto-exchange certificates with BIG-IP LTM when a certificate expires or changes

Component: dns-gslb general

Symptoms: When you configure a GSLB Engine with a GSLB Server of type BIGIP-LTM, you provide a secretRef containing the root password for the referenced TMOS BIG-IP. The GSLB Engine uses this password to establish an SSH connection and perform a certificate exchange with the BIG-IP, which enables an iQuery connection between the TMOS BIG-IP’s big3d and the GSLB Engine.

These certificates include a duration field that defines when they expire. You may also choose to update the certificate manually.

In both scenarios, the GSLB Engine does not automatically perform another certificate exchange. As a result, when the system attempts to re-establish an iQuery connection, the BIG-IP rejects the connection.

Conditions: Occurs when:

• You have configured a GSLB Server of type BIGIP-LTM with a valid secretRef that references a valid root password for the TMOS BIG-IP.

• You want to change the certificates, or the certificate has expired.

Impact: The BIG-IP rejects iQuery connections between the GSLB Engine and big3d the next time the system establishes a connection. This prevents the GSLB Engine from monitoring TMOS BIG-IP LTM resources.

Workaround: Delete the GSLB server configuration and recreate it.

2285413-3

GSLB inter-instance traffic on non-Sync Agent member is routed through the Kubernetes pod network instead of the TMM internal VLAN

Component: dns-gslb sync group

Symptoms: On the non-Sync Agent member of a GSLB Sync Group deployed on OpenShift, incoming GSLB traffic from the Sync Agent is received by TMM but is forwarded to the GSLB Engine via the Kubernetes pod network interface (eth0) instead of the TMM internal VLAN (shim interface). This causes GSLB inter-engine communication to use an incorrect network path, with ingress traffic not following the same data plane path as egress traffic.

Conditions: A GSLB Sync Group with two or more CNF deployments is configured on OpenShift. The non-Sync Agent member receives GSLB traffic from the Sync Agent. The f5ingress controller does not add the required static route on TMM to direct GSLB traffic through the internal VLAN interface.

Impact: GSLB traffic between Sync Group members on the non-Sync Agent side flows through the Kubernetes pod network instead of the TMM data plane. This results in asymmetric routing where egress GSLB traffic uses the correct internal VLAN path but ingress GSLB traffic bypasses it. This may cause GSLB health monitoring (e.g., HTTPS monitors) and probe traffic to fail or behave unexpectedly.

Workaround: There is no known workaround at this time.

2339825

GSLB Sync Group members on OpenShift clusters can lose connectivity to the Kubernetes API, preventing configuration synchronization.

Component: DoS

Symptoms: One GSLB Sync Group member cannot synchronize its GSLB configuration (wide IPs, pools, servers) with the rest of the group. Its logs repeatedly report errors while creating or updating GSLB custom resources, and its GSLB server objects remain in a NotReady state.

Conditions: This occurs when a GSLB Sync Group member is deployed on an OpenShift cluster using the OVN-Kubernetes network plugin (CNI). Sync group members deployed on non-OpenShift Kubernetes clusters are not affected.

Impact: The affected sync group member cannot create or update its own GSLB configuration objects and cannot exchange configuration with other members. The rest of the sync group considers this member as permanently out of sync. Until the issue is resolved, the affected member delivers degraded or unavailable GSLB service.

Workaround: At install time, configure the CSRC component’s Helm values (config.excludeCidr) with the affected cluster’s pod, service, and node CIDR ranges to restore normal Kubernetes API connectivity for that cluster’s GSLB pods.

2046925-3

TCP throughput degradation during UDP DDoS attack with DPU hardware acceleration

Component: DoS

Symptoms: Lower TCP throughput degradation could be observed during ongoing UDP DDoS attack on DPU platforms even when Global DDoS mitigation is configured.

Conditions: Occurs when,

• Global DDoS config has TCP and UDP vectors configured.

• DDoS hardware DPU acceleration is enabled.

• TCP and UDP traffic is being processed simultaneously.

Impact: Up to 30% degradation in throughput.

2455041-1

Sentinel crash on long-running product deployment

Component: dssm

Symptoms: Sentinel pods crash when they run for an extended period with the CPU resource limit set to 1.

Conditions: You deployed Sentinel using the f5-dssm Helm chart with a CPU limit of 1 in the override file.

Impact: This issue causes no functional impact but may affect primary database election.

Workaround: Increase the CPU limit to 2 or higher to accommodate occasional spikes in CPU usage.

2390145-2

Egress traffic is disrupted during the upgrade process

Component: egress

Symptoms: Egress traffic from the application pod will fail following the upgrade.

Conditions: Version upgrade and TMM Pod restart.

Impact: VXLAN interfaces and IP routes are wrongly provisioned on node and TMM, resulting in disruption of egress traffic.

Workaround: Delete Egress CR and restart the cne-controller pod. Improved the APP-TMM pod IP mappings synchronization logic in BIG-IP Next for Kubernetes 2.3.0 and higher versions.

2330917-1

Egress catchall virtual servers may not restore after you delete and recreate a dependent VRF

Component: egress

Symptoms: When an Egress custom resource depends on a flow-forward VLAN in a VRF and you delete and recreate that VRF, the Egress resource may transition back to Ready=True without fully recreating all Egress-related configuration.

Specifically, the system may restore only the primary IPv4 and IPv6 Egress virtual servers while failing to recreate the catchall IPv4 and IPv6 virtual servers.

Conditions: This issue occurs when all four of the following conditions are met:

• You configure an Egress custom resource with a flow-forward VLAN in a specific VRF (for example, VRF A).

• You enable the flow-forwarding feature on that Egress custom resource.

• You delete VRF A and then recreate it.

• The Egress custom resource recovers to Ready=True after the VRF is restored.

Impact: The Egress custom resource may report a healthy (Ready=True) status while TMM does not program its catchall virtual servers.

This creates a mismatch between the custom resource status and the actual dataplane configuration, which can affect inter-TMM flow-forwarding traffic.

Workaround: After recreating the dependent VRF, reapply the affected Egress CR(s). Reapplying the Egress CR forces reconciliation and restores the missing catchall virtual servers.

2503217

Egress traffic load balancing failure after TMM internal IP reconfiguration

Component: egress

Symptoms: Egress traffic load balancing fails when you reconfigure the TMM internal IP.

Conditions: Occurs when:

1. Deploy the BNK 2.4 build.

2. Scale up the TMM pods to a value greater than the number of internal VLAN self IPs in the F5SPKVlan custom resource. Ensure at least one TMM is in standby mode.

3. Update the internal IPv4 and IPv6 self IPs with new addresses in the F5SPKVlan custom resource and apply it.

Impact: The egress traffic load balancing does not working.

Workaround: Scale down TMM pods so that there is no standby TMM pod in the cluster.

2330929-8

ACL hardware stat intermittently out of sync

Component: Firewall (ACL)

Symptoms: The hw_counter field in the fw_rule_stat tmctl table may intermittently fail to increment.

Conditions: This occurs intermittently for gateway attached firewall policies.

Impact: ACL hw_counter stat may report values lower than actual traffic counts.

Workaround: Remove and reapply the configurations to reset the stats.

2503177-1

CNF NAT44 connection per second performance degrades with small packet size

Component: fsm

Symptoms: Connection per second performance degradation is seen with small packet size such 128 bytes.

Conditions: Connection is initiated with small packet.

Impact: With large amount of small packet connection, the connection per second performance degrades.

Workaround: Remove and reapply the configurations to reset the stats.

2503133-1

Recreated VLAN with AUTO_LASTHOP_DISABLED can disrupt traffic using dynamic routes

Component: fsm

Symptoms: After a VLAN with AUTO_LASTHOP_DISABLED is recreated, traffic may stop when its return route is a dynamic route whose gateway uses that VLAN. The route may display as resolved while remaining unresolved internally.

Conditions: Occurs when:

• VLAN is deleted and recreated, AUTO_LASTHOP_DISABLED is set on VLAN.

• A dynamic route uses a gateway reachable through that VLAN.

• The route is not re-advertised after VLAN recreation.

Impact: Connections using the affected return route fail or remain stalled. Unrelated traffic is unaffected.

Workaround: Clear and re-establish the BGP session with the neighbor on the affected VLAN. This can be done through the clear bgp <nbr> command in OcNOS/ZebOS. The routes will be withdrawn and re-advertised, allowing TMM to resolve them against the recreated VLAN.

2332481-1

VXLan reinstall may require retry when recreating during a pending delete

Component: fsm-dynamic-routing

Symptoms: When you delete a VXLan and quickly follow with a create, the system may reject the create because the delete is still pending. If you retry the create a few seconds later, it succeeds. This can cause a silent failure in automation that does not handle error checking, which can lead to unexpected BGP running configuration for objects that use that VXLan.

Conditions: When you delete and reapply VxLAN custom resources, TMM pods end up in an inconsistent configuration state. Each TMM has different VRF configurations, VNI/VXLAN interfaces have incorrect or missing VRF assignments, and BGP VRF address families are missing.

Impact: All tenant traffic (EVPN/VXLAN) breaks after you reinstall the VXLAN custom resource. Affected pods lose VRF isolation. BGP does not advertise or receive VRF routes. The cluster does not self-heal.

Workaround: In automation, use kubectl delete with –wait=true and check error handling. If manual, wait to retry.

1889425-5

Egress traffic fails during an f5-tmm pod restart event

Component: fsm-networking

Symptoms: Egress traffic fails while one or more f5-tmm pods are restarting.

Conditions: Occurs when,

• SPK is installed and configured to handle egress traffic from watched namespaces.

• One or more f5-tmm pods crash or are restarted by Kubernetes.

Impact: Egress traffic might fail from traffic routing to an f5-tmm pod that is restarting.

2471117-1

Partial and temporary ingress traffic loss during node reboot

Component: ingress

Symptoms: Healthy TMM pods drop traffic destined for an application pod on a rebooted node until the controller notifies them that the application pod is down. If the controller’s own node reboots, the disruption window is longer because the controller must recover first before it can notify TMM pods about the affected application pod.

Conditions: You reboot a Kubernetes node that hosts one or more application pods. However, healthy TMM pods continue to route traffic to the now-unavailable application pod because the controller has not yet detected and communicated the pod’s failure.

Impact: Healthy TMM pods drop traffic to the affected application pod from the moment the node reboots until the controller detects the pod failure and sends an exception to TMM, which triggers the removal of the unavailable pool member.

If the controller’s node reboots, the outage duration increases because the controller must fully restart before it can reconcile the application pod’s state and update TMM.

Traffic restores automatically when the affected pod becomes available again. The controller detects the pod’s recovery, updates TMM with the revised pool member configuration, and load balancing to the pod resumes.

Workaround: To minimize traffic disruption caused by TMM forwarding requests to unavailable application pods, configure health monitors on the Pool custom resource that your HTTPRoute backendRefs reference.

When you enable health monitors (such as HTTP, TCP, or ICMP) on a Pool, TMM actively probes pool members and can independently mark an application pod as down without waiting for the controller to detect and relay the pod failure. This significantly reduces the time that TMM routes traffic to an unavailable pod.

Select the appropriate monitor type and configure the relevant parameters (including interval, timeout, and send/receive strings) based on your application protocol to ensure prompt failure detection.

2455985-1

Renaming of metric scraping CRDs

Component: ingress

Symptoms: As part of complying with F5 Standardization, the following CRDs are renamed from the metrics.f5.net domain to the metrics.f5.com domain:

• scrapetemplates.metrics.f5.net → crapetemplates.metrics.f5.com

• scrapeclasses.metrics.f5.net → scrapeclasses.metrics.f5.com

• scrapes.metrics.f5.net → scrapes.metrics.f5.com

Conditions: As part of a helm limitation, the helm upgrade does not recreate the renamed CRDs by default.

Impact: F5 Ingress upgrade fails.

Workaround: This manual procedure is only needed for upgrades to 2.4, per the name change.

1. Apply new CRDs directly from the Observer chart helm show crds .../f5-toda-observer-< UPGRADE VERSION>.tgz | kubectl apply -f -

2. Remove stale old-group objects kubectl delete scrapetemplate.metrics.f5.net --all --all-namespaces || true kubectl delete scrapeclass.metrics.f5.net --all || true

3. Upgrade observer helm upgrade observer .../f5-toda-observer-<VERSION>.tgz ...

4. Upgrade ingress helm upgrade f5ingress ... /<UPGRADE-F5INGRESS-VERSION>.tgz

5. Remove the old CRD definitions (optional) kubectl delete crd scrapetemplates.metrics.f5.net kubectl delete crd scrapeclasses.metrics.f5.net kubectl delete crd scrapes.metrics.f5.net

2488649-1

Stale GatewaySetting configurations persist across TMM, VPC route table, and IPAM after EgressGateway CR update

Component: ingress

Symptoms: When you update the EgressGateway custom resource to reference a new GatewaySettings custom resource, the system does not properly clean up the old settings across TMM, the VPC route table, and IPAM.

As a result, stale configurations from the previous GatewaySetting persist and may conflict with the new configuration, which can disrupt traffic.

Conditions: Occurs when:

1. The required custom resources (Infra CR, GatewaySettings CRs, EgressGateway CR) are applied.

2. All the custom resource statuses show True.

3. The parametersRef section of the EgressGateway custom resource reference a new GatewaySettings custom resource.

Impact: Stale configurations may conflict with the new configurations and disrupt traffic.

Workaround: Option 1: Delete and recreate the EgressGateway custom resource with the updated GatewaySettings custom resource reference to ensure the system runs the correct cleanup processes.

Option 2: Update the GatewaySettings custom resource directly if no other Gateway or EgressGateway references it.

2284529-1

Stale egress configuration on TMM with multi-VRF VLAN references

Component: ingress

Symptoms: Although the controller rejects the Egress custom resource because the dependent custom resources are in different VRFs, TMM retains stale egress configuration. The Egress custom resource initially references a VLAN in one VRF, and when the next VLAN is created in a different VRF, TMM does not clean up the original configuration. This results in an inconsistent configuration on TMM.

Conditions: Occurs when,

1. Create an Egress custom resource with a VLAN in the TmmInterface section that belongs to the red VRF, and reference a second VLAN in the flow-forwarding section.

2. Create the second VLAN referenced in the flow-forwarding section in a different VRF.

Impact: TMM retains stale egress configuration until you move the VLAN to the correct VRF and reapply the VLAN custom resource.

Workaround: Move the VLAN to the correct VRF and reapply the VLAN custom resource. Ensure all configurations referenced in the Egress custom resource belong to a single VRF.

2331381-1

Custom resource status may remain stuck at False after a TMM pod restart or crash

Component: ingress

Symptoms: After a TMM pod restart or crash, one or more SPK custom resource statuses may remain stuck at False with the message “Waiting for one or more dependent CRs to be applied,” even though TMM successfully applied the configurations.

Conditions: A TMM pod crashes or restarts in an SPK deployment that has configured dependent custom resources.

Impact: No traffic impact. The custom resource status incorrectly reports False with “Waiting for one or more dependent CRs to be applied” even though TMM successfully applied the configuration.

Workaround: Delete and reapply the affected stuck custom resources to trigger reconciliation and restore the correct status.

2502537-1

BNK fails to provision Vxlan CRs on TMM when deployed with OcNOS and Vxlan on an OCP cluster

Component: ingress

Symptoms: The system intermittently fails to provision Vxlan CRs on TMMs. The logs confirm that the communication to the Kube API Server times out.

Conditions: This occurs when BNK is deployed with OcNOS, VRF and Vxlan are enabled on the OCP 6 node cluster with separate control and worker plane nodes. This is a pending case on Red Hat (ID: 04532910).

Impact: Ingress and Egress traffic will fail when BNK is deployed with OCNOS and VXLAN combination on an OCP 6-node cluster.

Workaround: Add required support for provisioning the VXLAN CR correctly without an API server timeout when BNK is deployed with OCNOS and VXLAN combination on the OCP clusters.

2459457-1

BNK fails to route egress traffic when deployed with OcNOS, Vxlan, and Vrf on an OCP cluster

Component: ingress

Symptoms: BNK fails to route egress traffic when deployed with OcNOS, VXLAN, and VRF on an OCP cluster. The OVN network does not populate the required routes for the specified app pod.

Conditions: This occurs when BNK is deployed with OcNOS, Vrf, Vxlan enabled on the OCP cluster. This is pending on Red Hat case # 04532910.

Impact: Egress traffic failed when BNK deployed with OCNOS, VXLAN and VRF combination on OCP cluster.

2503545-1

Toggling SelfIP count in one VLAN may result in missing config for other VLANs

Component: ingress

Symptoms: Missing VLAN config on some TMMs.

Conditions: Reducing the number of SelfIPs on a VLAN, then increasing it back to the original count. For example: two SelfIPs -> one SelfIP -> two SelfIPs

Impact: VLAN config from unmodified VLANs may be missing from some TMMs.

Workaround: Delete and re-apply the VLAN CRs that have missing config.

2284409-3

No automatic reassignment of freed IPs to failed gateways

Component: IPAM

Symptoms: When the IP pool is exhausted, new Gateway resources fail to obtain an IP address. When a Gateway is deleted and its IPs are freed, the IPs are not automatically reassigned to Gateways that previously failed due to IP exhaustion.

Conditions: Occurs when

• The IP pool is fully exhausted.

• Multiple Gateway resources fail due to lack of available IPs.

• An existing Gateway (with a successfully allocated IP) is deleted, freeing an IP.

Impact:

• Gateways that failed due to IP exhaustion remain failed.

• IP allocation isn’t automatically retried for affected Gateways.

• Manual intervention is required to recover.

Workaround: To allocate an IP to a Gateway that failed due to IP exhaustion:

1. Delete the affected Gateway resource.

2. Recreate the Gateway resource. This triggers a new IP allocation attempt, allowing the system to assign any available (freed) IP.

2460133-1

ESP packets appear on the f5-ipsec pod during traffic transmission

Component: IPSec

Symptoms: TMM intermittently leaks ESP packets and forwards them to the IPsec pod when the tunnel count exceeds 1,000.

Conditions: Triggering traffic with 1,000 tunnels causes intermittent ESP leaks at the IPsec pod.

Impact: Specific client traffic triggers ESP leaks at the IPsec pod, causing data loss.

2288025-1

Delayed DSSM availability after database failover in Sentinel deployment

Component: PE

Symptoms: In a Sentinel-based DSSM deployment, when the primary database goes down, failover to the new primary database takes approximately seven seconds with the default down-after-milliseconds parameter value of 5. During this interval, DSSM cannot process requests from the application and resumes serving requests only after the failover completes. Key impacts during this seven-second interval include inconsistencies in RADIUS accounting:

• Subscriber creation / accounting start: The system does not create subscribers. As a result, subscriber policies cannot apply until the next accounting update.

• Subscriber deletion / accounting stop: The system fails to delete subscribers, which leaves stale entries in the system.

• Re-Authentication Request (RAR): During RAR, the system cannot update new policies to DSSM. As a result, some subscribers may lose their applied policies during this brief downtime.

Conditions: DB failover

Impact: DSSM does not serve application requests during this interval.

2483861-1

cert-manager reports certificate as Ready=True while holding issuance retries in backoff after an issuer misconfiguration

Component: TLS/SSL

Symptoms: A certificate shows Ready=True even though recent issuance attempts failed and the certificate is nearing expiry. After you fix an invalid ClusterIssuer, no new Order appears immediately, and deleting stale CertificateRequest, Order, and Challenge resources does not force a retry.

Conditions: An invalid ACME directory URL in the ClusterIssuer causes the certificate authority (CA) to reject the order and places cert-manager into exponential backoff (1–32 hours). The existing TLS secret remains valid, so the certificate shows Ready=True. The operator checks during the backoff window.

Impact: No traffic impact — the existing TLS secret continues to serve traffic. The only impact is operational: the absence of new Orders during backoff can mislead operators into thinking recovery has failed.

Workaround: After you fix the ClusterIssuer, wait for the backoff period to elapse. cert-manager auto-recovers by recreating the CertificateRequest → Order → Challenge chain and renewing the secret. Deleting child resources does not speed up this process because cert-manager enforces backoff at the account level. To force immediate re-issuance (optional), use one of the following methods: Run cmctl renew (if cmctl is installed):

cmctl renew <cert-name> -n <namespace>

Patch the Certificate status to set Issuing=True with reason RenewalRequested:

kubectl patch certificate <cert-name> -n <namespace> \
  --subresource=status \
  --type='merge' \
  -p '{
    "status": {
      "conditions": [
        {
          "type": "Issuing",
          "status": "True",
          "reason": "RenewalRequested",
          "message": "Manually triggered issuance of Certificate",
          "lastTransitionTime": "'$(date -u +'%Y-%m-%dT%H:%M:%SZ')'"
        }
      ]
    }
  }'

Rollout-restart the cert-manager pods to clear the in-memory backoff timers. Delete and recreate the issuer and certificate with a valid configuration. Reference: https://cert-manager.io/v1.11-docs/faq/#what-happens-if-issuance-fails-will-it-be-retried

2482985-1

TODA operator cannot persist status updates after forced pod termination

Component: toda_observer

Symptoms: After an abrupt or forced termination of the TODA Observer Operator or Observer worker pods (for example, using kubectl delete pod --force --grace-period=0 or an ungraceful crash), the system fails to transition newly created or updated ScrapeTemplate custom resources (CRs) to a Running state (Ready=True). Instead, these CRs remain stuck in a Pending or Error state (Ready: 0/N, Ready=False).

The Operator and Observer logs display RPC timeout errors such as: rpc error: code = Unknown desc = query timed out in expression evaluation The system takes approximately 10–15 minutes to resolve the CR status and recover automatically. The Operator and Observer logs report RPC timeout errors such as: rpc error: code = Unknown desc = query timed out in expression evaluation

The CR status may remain unresolved for approximately 10–15 minutes before eventually recovering on its own.

Conditions: The system abruptly or forcibly terminates the TODA Observer Operator or Observer worker pods without performing a graceful shutdown, severing sockets without sending TCP FIN/RST packets. The user applies or modifies new ScrapeClass or ScrapeTemplate CRs shortly after the restart, within the connection cache or retransmission window. This issue occurs on Kubernetes environments (such as bare-metal or ARM64 with Calico and VXLAN networking) where abruptly destroyed network interfaces leave stale half-open TCP connections in the kernel’s ESTABLISHED state.

Impact: Metrics scraping configuration and data collection for newly created ScrapeTemplate resources are delayed or fail to initialize for 10–15 minutes. Normal data path metrics collection resumes automatically once the stale socket window expires.

Workaround: Graceful deletion: Avoid using –force –grace-period=0 when deleting Observer pods, allowing the operating system to send proper TCP FIN/RST packets and cleanly drain sockets. Wait for socket sxpiration: If forced pod termination has occurred, wait approximately 10–15 minutes before creating new ScrapeTemplate CRs to allow the Linux kernel TCP retransmission budget (tcp_retries2) to reap stale sockets. Kernel / CNI Tuning: Reducing the node’s net.ipv4.tcp_retries2 setting or switching Calico to eBPF mode helps mitigate hung sockets across ungraceful interface tear-downs.

2456521-1

Qkview displays misleading “Running” status after CWC pod restart

Component: toda_qkview

Symptoms: When a qkview capture is in progress and the CWC pod restarts, the status continues to show “Running” indefinitely with a 0B size. The qkview is not actually running — the pod restart terminated the capture. The API reads stale on-disk state after the restart and returns the misleading status.

Attempting to cancel the qkview fails with: “cancel requested for non-running qkview,” which confirms the status is incorrect.

Conditions: Occurs when:

• You start a qkview capture while CWC is running.

• The CWC pod restarts during the capture.

Impact: Users see a misleading “Running” status for orphaned qkviews.

Workaround: Delete the stale qkview entry.