BIG-IP Next for Kubernetes 2.4.1 release notes

About this release

Introduction

These release notes describe the differences between BIG-IP Next for Kubernetes (DPU and Host) 2.4.0 and 2.4.1.

See the BIG-IP cloud-native products lifecycle policy for details on supported BIG-IP Next for Kubernetes versions and early access support.

Supported container-orchestration platforms

This release is officially supported on these container-orchestration platforms and versions:

Type	Platform	Version	Recommended Helm version
BNK (DPU)	Kubernetes	1.35	4.3
		1.30	3.18
BNK (Host)	Kubernetes	1.35	4.3
	OpenShift	4.22	4.3
		4.20	4.0
		4.18	3.19
		4.16	3.17

Breaking changes

(No breaking changes)

Security updates

> Click to view table of fixed CVEs:

CVE Number	Bug IDs	Image Names	Package Name
CVE-2023-52168	2459141	f5-access-renderer	7zip
CVE-2023-52169	2459145	f5-access-renderer	7zip
CVE-2024-2236	2476717	baseos	libgcrypt20
CVE-2024-24786	2475069, 2506137	f5-zonerunner	google.golang.org/protobuf
CVE-2025-15649	2489445	baseos	perl-base
CVE-2025-5278	2507945	baseos	coreutils
CVE-2025-59375	2506341, 2506469, 2506909, 2507017, 2507169, 2507313, 2507473, 2507577, 2507745	dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc	libexpat1
CVE-2025-6141	2506901, 2507309, 2507949	baseos, f5-gslb-debug-sidecar, f5dr-img	libncurses6, libncursesw6
CVE-2026-10722	2475129	opentelemetry-collector-contrib	github.com/cilium/ebpf
CVE-2026-10723	2476245, 2506661	f5-gslb-debug-sidecar	bind9-dnsutils
CVE-2026-10822	2476249, 2506665	f5-gslb-debug-sidecar	bind9-dnsutils
CVE-2026-11331	2476253, 2506669	f5-gslb-debug-sidecar	bind9-dnsutils
CVE-2026-11622	2476257, 2506673	f5-gslb-debug-sidecar	bind9-dnsutils
CVE-2026-11721	2476261, 2506677	f5-gslb-debug-sidecar	bind9-dnsutils
CVE-2026-11856	2476265, 2476393, 2476461, 2506681	f5-access-apmd, f5-fluentbit, f5-gslb-debug-sidecar	curl, libcurl4t64
CVE-2026-12087	2489449	baseos	perl-base
CVE-2026-12617	2476269, 2506685	f5-gslb-debug-sidecar	bind9-dnsutils
CVE-2026-13204	2506689	f5-gslb-debug-sidecar	bind9-dnsutils
CVE-2026-13221	2489453	baseos	perl-base
CVE-2026-13321	2476273, 2506693	f5-gslb-debug-sidecar	bind9-dnsutils
CVE-2026-13595	2507021, 2507925, 2517373	baseos, dnsx-img, f5-fluentd	bsdextrautils, bsdutils, libfdisk1
CVE-2026-13608	2506449, 2506573, 2506593, 2507749, 2507897	crd-installer, f5-debug-sidecar, f5-ipsec, f5ingress, ocnos-img	curl, libcurl4t64
CVE-2026-13757	2476693	baseos	libp11-kit0
CVE-2026-14663	2476469	f5-fluentbit	libpq5
CVE-2026-14664	2476473	f5-fluentbit	libpq5
CVE-2026-14666	2476477	f5-fluentbit	libpq5
CVE-2026-14668	2476481	f5-fluentbit	libpq5
CVE-2026-14669	2476485	f5-fluentbit	libpq5
CVE-2026-14670	2476489	f5-fluentbit	libpq5
CVE-2026-14671	2476493	f5-fluentbit	libpq5
CVE-2026-14672	2476497	f5-fluentbit	libpq5
CVE-2026-14673	2476501	f5-fluentbit	libpq5
CVE-2026-14677	2476505	f5-fluentbit	libpq5
CVE-2026-14678	2476509	f5-fluentbit	libpq5
CVE-2026-14679	2476513	f5-fluentbit	libpq5
CVE-2026-14680	2476517	f5-fluentbit	libpq5
CVE-2026-15059	2476697, 2517377	baseos, f5-fluentd	libsystemd-shared, libsystemd0
CVE-2026-15308	2506345, 2506473, 2506701, 2506913, 2507025, 2507173, 2507321, 2507477, 2507581	dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-gslb-debug-sidecar, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, spk-csrc	libpython3.12-minimal
CVE-2026-15534	2507177, 2507325, 2507965	baseos, f5-access-apmd, f5-bnk-cis	perl-base
CVE-2026-15588	2507753	ocnos-img	libglib2.0-0t64
CVE-2026-15741	2476521	f5-fluentbit	libpq5
CVE-2026-15742	2476525	f5-fluentbit	libpq5
CVE-2026-16118	2507757	ocnos-img	libglib2.0-0t64
CVE-2026-16239	2476529	f5-fluentbit	libpq5
CVE-2026-16241	2476533	f5-fluentbit	libpq5
CVE-2026-16742	2476701, 2517381	baseos, f5-fluentd	libsystemd-shared, libsystemd0
CVE-2026-18024	2476537	f5-fluentbit	libpq5
CVE-2026-18374	2506597, 2507029, 2507181, 2507329, 2517385	dnsx-img, f5-access-apmd, f5-bnk-cis, f5-fluentd, f5-ipsec	libc-bin
CVE-2026-18408	2476541	f5-fluentbit	libpq5
CVE-2026-18924	2506453, 2506577, 2506601, 2507761, 2507901	crd-installer, f5-debug-sidecar, f5-ipsec, f5ingress, ocnos-img	curl, libcurl4t64
CVE-2026-18938	2489413	baseos	libp11-kit0
CVE-2026-19385	2476545	f5-fluentbit	libpq5
CVE-2026-19487	2507185, 2507337, 2507973	baseos, f5-access-apmd, f5-bnk-cis	perl-base
CVE-2026-19499	2506605, 2507033, 2507189, 2507341, 2507977, 2517389	baseos, dnsx-img, f5-access-apmd, f5-bnk-cis, f5-fluentd, f5-ipsec	libc-bin
CVE-2026-19542	2506609, 2507037, 2507193, 2507345, 2507981, 2517393	baseos, dnsx-img, f5-access-apmd, f5-bnk-cis, f5-fluentd, f5-ipsec	libc-bin
CVE-2026-19931	2506457, 2506581, 2506613, 2506709, 2507349, 2507709, 2507765, 2507905	crd-installer, f5-access-apmd, f5-debug-sidecar, f5-fluentbit, f5-gslb-debug-sidecar, f5-ipsec, f5ingress, ocnos-img	curl, libcurl4t64
CVE-2026-25680	2475073, 2475549, 2506141	f5-dssm-upgrader, f5-zonerunner	golang.org/x/net
CVE-2026-25681	2475017, 2475509, 2506101	f5-dssm-upgrader, f5-zonerunner	golang.org/x/net
CVE-2026-27136	2475021, 2475513, 2506105	f5-dssm-upgrader, f5-zonerunner	golang.org/x/net
CVE-2026-27171	2476725	baseos	zlib1g
CVE-2026-27456	2476349, 2476397, 2476705, 2517401	baseos, dnsx-img, f5-access-apmd, f5-fluentd	bsdextrautils, bsdutils, libfdisk1
CVE-2026-32776	2506349, 2506477, 2506917, 2507041, 2507197, 2507353, 2507481, 2507585, 2507769	dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc	expat, libexpat1
CVE-2026-32777	2506353, 2506481, 2506921, 2507045, 2507201, 2507357, 2507485, 2507589, 2507773	dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc	expat, libexpat1
CVE-2026-32778	2506357, 2506485, 2506925, 2507049, 2507205, 2507361, 2507489, 2507593, 2507777	dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc	expat, libexpat1
CVE-2026-33186	2475013, 2506097	f5-zonerunner	google.golang.org/grpc
CVE-2026-33814	2459181, 2475025, 2506109	f5-dssm-upgrader, f5-zonerunner	golang.org/x/net, stdlib
CVE-2026-33818	2474189, 2474233, 2474269, 2474313, 2474357, 2474389, 2474421, 2474457, 2474489, 2474521, 2474557, 2474593, 2474633, 2474737, 2474773, 2474809, 2474845, 2474909, 2474941, 2474981, 2475029, 2475089, 2475137, 2475181, 2475217, 2475257, 2475297, 2475333, 2475373, 2475405, 2475441, 2475477, 2475517, 2475569, 2475601, 2475605, 2475609, 2475613, 2475617, 2475621, 2475817, 2475849, 2475893, 2475929, 2475965, 2476001, 2476037, 2476069, 2476101, 2476137, 2476173, 2476205, 2476661, 2489353, 2505657, 2505829, 2506053, 2517205, 2517309, 2517341	baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-cert-manager-extension, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-epp, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-ipsec, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5-zonerunner, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contrib, rabbit, spk-csrc, spk-cwc, tmrouted-img	stdlib
CVE-2026-39113	2506361, 2506489, 2506729, 2506929, 2507053, 2507209, 2507365, 2507493, 2507597, 2507781, 2507917	dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-gslb-debug-sidecar, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, rabbit, spk-csrc	libsqlite3-0
CVE-2026-39821	2459149, 2474193, 2474237, 2474273, 2474317, 2474361, 2474393, 2474425, 2474461, 2474493, 2474525, 2474561, 2474597, 2474637, 2474741, 2474777, 2474813, 2474849, 2474913, 2474945, 2474985, 2475033, 2475093, 2475141, 2475185, 2475221, 2475261, 2475301, 2475337, 2475377, 2475409, 2475445, 2475481, 2475573, 2475625, 2475629, 2475633, 2475637, 2475641, 2475645, 2475821, 2475853, 2475897, 2475933, 2475969, 2476005, 2476041, 2476073, 2476105, 2476141, 2476177, 2476209, 2476665, 2489357, 2505661, 2505833, 2506057, 2506113, 2517209, 2517313, 2517345	baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-cert-manager-extension, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-epp, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-ipsec, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5-zonerunner, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contrib, rabbit, spk-csrc, spk-cwc, tmrouted-img	golang.org/x/net, stdlib
CVE-2026-39822	2459153, 2459157	f5-blobd, f5-dssm-upgrader	stdlib
CVE-2026-39824	2474453, 2475085, 2475565, 2506157	f5-dssm-store, f5-dssm-upgrader, f5-zonerunner	golang.org/x/sys
CVE-2026-4046	2476733	baseos	libc-bin
CVE-2026-41080	2506365, 2506493, 2506933, 2507057, 2507213, 2507369, 2507497, 2507601, 2507785	dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc	libexpat1
CVE-2026-42250	2507953	baseos	libbz2-1.0
CVE-2026-42502	2475077, 2475553, 2506145	f5-dssm-upgrader, f5-zonerunner	golang.org/x/net
CVE-2026-42505	2475557, 2475889	f5-blobd, f5-dssm-upgrader	stdlib
CVE-2026-42506	2475081, 2475561, 2506149	f5-dssm-upgrader, f5-zonerunner	golang.org/x/net
CVE-2026-4360	2506369, 2506497, 2506737, 2506941, 2507061, 2507217, 2507373, 2507501, 2507605	dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-gslb-debug-sidecar, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, spk-csrc	libpython3.12-minimal
CVE-2026-4437	2476737	baseos	libc-bin
CVE-2026-4438	2476741	baseos	libc-bin
CVE-2026-45186	2506373, 2506501, 2506945, 2507065, 2507221, 2507377, 2507505, 2507609, 2507789	dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc	libexpat1
CVE-2026-46600	2474197, 2474241, 2474277, 2474321, 2474365, 2474397, 2474429, 2474465, 2474497, 2474529, 2474565, 2474605, 2474641, 2474749, 2474781, 2474817, 2474857, 2474917, 2474949, 2474989, 2475037, 2475097, 2475145, 2475189, 2475225, 2475265, 2475305, 2475341, 2475381, 2475413, 2475449, 2475485, 2475521, 2475577, 2475649, 2475653, 2475657, 2475661, 2475665, 2475669, 2475825, 2475857, 2475901, 2475937, 2475973, 2476009, 2476045, 2476077, 2476109, 2476145, 2476181, 2476213, 2476669, 2489361, 2505665, 2505837, 2506061, 2506117, 2517213, 2517317, 2517349	baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-cert-manager-extension, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-epp, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-ipsec, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5-zonerunner, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contrib, rabbit, spk-csrc, spk-cwc, tmrouted-img	golang.org/x/net, stdlib
CVE-2026-48959	2489457	baseos	perl-base
CVE-2026-48962	2489461	baseos	perl-base
CVE-2026-49478	2474685	f5-lifecycle-operator-catalog	github.com/sigstore/fulcio
CVE-2026-50163	2474201	f5-lifecycle-operator	oras.land/oras-go/v2
CVE-2026-50219	2506377, 2506505, 2506949, 2507069, 2507225, 2507381, 2507509, 2507613, 2507793	dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc	libexpat1
CVE-2026-53495	2506209	f5-lifecycle-operator	github.com/containerd/containerd
CVE-2026-53612	2507073, 2507929, 2517405	baseos, dnsx-img, f5-fluentd	bsdextrautils, bsdutils, libfdisk1
CVE-2026-53613	2507077, 2507933, 2517409	baseos, dnsx-img, f5-fluentd	bsdextrautils, bsdutils, libfdisk1
CVE-2026-53614	2507081, 2507937, 2517413	baseos, dnsx-img, f5-fluentd	bsdextrautils, bsdutils, libfdisk1
CVE-2026-53615	2507085, 2507941, 2517417	baseos, dnsx-img, f5-fluentd	bsdextrautils, bsdutils, libfdisk1
CVE-2026-53910	2489417	baseos	diffutils
CVE-2026-5435	2476745	baseos	libc-bin
CVE-2026-54371	2489421	baseos	libattr1
CVE-2026-54411	2476709	baseos	libpam-modules
CVE-2026-5450	2476749	baseos	libc-bin
CVE-2026-54696	2517273	f5-fluentd	json
CVE-2026-54874	2489433, 2517449	baseos, f5-fluentd	libssl3t64
CVE-2026-55654	2476637	gslb-engine	openssh-client
CVE-2026-55655	2476621	gslb-engine	openssh-client
CVE-2026-56131	2506381, 2506509, 2506953, 2507089, 2507513, 2507617, 2507797	dnsx-img, f5-analyzer, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc	libexpat1
CVE-2026-56132	2506385, 2506513, 2506957, 2507093, 2507517, 2507621, 2507801	dnsx-img, f5-analyzer, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc	libexpat1
CVE-2026-56403	2506389, 2506517, 2506961, 2507097, 2507237, 2507393, 2507521, 2507625, 2507805	dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc	libexpat1
CVE-2026-56404	2506393, 2506521, 2506965, 2507101, 2507241, 2507397, 2507525, 2507629, 2507809	dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc	libexpat1
CVE-2026-56405	2506397, 2506525, 2506969, 2507105, 2507245, 2507401, 2507529, 2507633, 2507813	dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc	libexpat1
CVE-2026-56406	2506401, 2506529, 2506973, 2507109, 2507533, 2507637, 2507817	dnsx-img, f5-analyzer, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc	libexpat1
CVE-2026-56407	2506405, 2506533, 2506977, 2507113, 2507537, 2507641, 2507821	dnsx-img, f5-analyzer, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc	libexpat1
CVE-2026-56408	2506409, 2506537, 2506981, 2507117, 2507257, 2507413, 2507541, 2507645, 2507825	dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc	libexpat1
CVE-2026-56409	2506417, 2506541, 2506985, 2507121, 2507545, 2507649, 2507829	dnsx-img, f5-analyzer, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc	libexpat1
CVE-2026-56410	2506421, 2506545, 2506989, 2507125, 2507549, 2507653, 2507833	dnsx-img, f5-analyzer, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc	libexpat1
CVE-2026-56411	2506425, 2506549, 2506993, 2507129, 2507553, 2507657, 2507837	dnsx-img, f5-analyzer, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc	libexpat1
CVE-2026-56412	2506429, 2506553, 2506997, 2507133, 2507273, 2507429, 2507557, 2507661, 2507841	dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc	libexpat1
CVE-2026-56852	2475041, 2475149, 2475269, 2475525, 2475861, 2506121	f5-blobd, f5-dssm-upgrader, f5-toda-observer, f5-zonerunner, f5ing-tmm-pod-manager	golang.org/x/text
CVE-2026-56853	2474205, 2474245, 2474281, 2474325, 2474369, 2474401, 2474433, 2474469, 2474501, 2474533, 2474569, 2474609, 2474645, 2474753, 2474785, 2474821, 2474861, 2474921, 2474953, 2474993, 2475045, 2475101, 2475153, 2475193, 2475229, 2475273, 2475309, 2475345, 2475385, 2475417, 2475453, 2475489, 2475529, 2475581, 2475673, 2475677, 2475681, 2475685, 2475689, 2475693, 2475829, 2475865, 2475905, 2475941, 2475977, 2476013, 2476049, 2476081, 2476113, 2476149, 2476185, 2476217, 2476673, 2489365, 2505669, 2505841, 2506065, 2517217, 2517321, 2517353	baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-cert-manager-extension, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-epp, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-ipsec, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5-zonerunner, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contrib, rabbit, spk-csrc, spk-cwc, tmrouted-img	stdlib
CVE-2026-56854	2505569, 2505593, 2505673, 2505753, 2505781, 2505897, 2505925, 2506017, 2506161, 2506197, 2506249, 2506261, 2506289, 2506313, 2506329, 2517221, 2517281	cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-fluentd, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, ocnos-img, opentelemetry-collector-contrib, spk-cwc	golang.org/x/crypto
CVE-2026-56855	2505557, 2505581, 2505605, 2505729, 2505761, 2505793, 2505913, 2505937, 2505969, 2506029, 2506173, 2506213, 2506253, 2506277, 2506301, 2506321, 2506333, 2517257, 2517297	cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-coremond, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-epp, f5-fluentd, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, ocnos-img, opentelemetry-collector-contrib, spk-cwc	golang.org/x/crypto
CVE-2026-56858	2474209, 2474249, 2474285, 2474329, 2474373, 2474405, 2474437, 2474473, 2474505, 2474537, 2474573, 2474613, 2474649, 2474757, 2474789, 2474825, 2474865, 2474925, 2474957, 2474997, 2475049, 2475105, 2475157, 2475197, 2475233, 2475277, 2475313, 2475349, 2475389, 2475421, 2475457, 2475493, 2475533, 2475585, 2475697, 2475701, 2475705, 2475709, 2475713, 2475717, 2475833, 2475869, 2475909, 2475945, 2475981, 2476017, 2476053, 2476085, 2476117, 2476153, 2476189, 2476221, 2476677, 2489369, 2505677, 2505845, 2506069, 2517225, 2517325, 2517357	baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-cert-manager-extension, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-epp, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-ipsec, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5-zonerunner, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contrib, rabbit, spk-csrc, spk-cwc, tmrouted-img	stdlib
CVE-2026-56859	2474213, 2474253, 2474289, 2474333, 2474377, 2474409, 2474441, 2474477, 2474509, 2474541, 2474577, 2474617, 2474653, 2474761, 2474793, 2474829, 2474869, 2474929, 2474961, 2475001, 2475053, 2475109, 2475161, 2475201, 2475237, 2475281, 2475317, 2475353, 2475393, 2475425, 2475461, 2475497, 2475537, 2475589, 2475721, 2475725, 2475729, 2475733, 2475737, 2475741, 2475837, 2475873, 2475913, 2475949, 2475985, 2476021, 2476057, 2476089, 2476121, 2476157, 2476193, 2476225, 2476681, 2489373, 2505681, 2505849, 2506073, 2517229, 2517329, 2517361	baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-cert-manager-extension, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-epp, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-ipsec, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5-zonerunner, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contrib, rabbit, spk-csrc, spk-cwc, tmrouted-img	stdlib
CVE-2026-56860	2474217, 2474257, 2474293, 2474337, 2474381, 2474413, 2474445, 2474481, 2474513, 2474545, 2474581, 2474621, 2474657, 2474765, 2474797, 2474833, 2474873, 2474933, 2474965, 2475005, 2475057, 2475113, 2475165, 2475205, 2475241, 2475285, 2475321, 2475357, 2475397, 2475429, 2475465, 2475501, 2475541, 2475593, 2475745, 2475749, 2475753, 2475757, 2475761, 2475765, 2475841, 2475877, 2475917, 2475953, 2475989, 2476025, 2476061, 2476093, 2476125, 2476161, 2476197, 2476229, 2476685, 2489377, 2505685, 2505853, 2506077, 2517233, 2517333, 2517365	baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-cert-manager-extension, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-epp, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-ipsec, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5-zonerunner, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contrib, rabbit, spk-csrc, spk-cwc, tmrouted-img	stdlib
CVE-2026-56862	2474221, 2474261, 2474297, 2474341, 2474385, 2474417, 2474449, 2474485, 2474517, 2474549, 2474585, 2474625, 2474661, 2474769, 2474801, 2474837, 2474877, 2474937, 2474969, 2475009, 2475061, 2475117, 2475169, 2475209, 2475245, 2475289, 2475325, 2475361, 2475401, 2475433, 2475469, 2475505, 2475545, 2475597, 2475769, 2475773, 2475777, 2475781, 2475789, 2475793, 2475845, 2475881, 2475921, 2475957, 2475993, 2476029, 2476065, 2476097, 2476129, 2476165, 2476201, 2476233, 2476689, 2489381, 2505689, 2505857, 2506081, 2517237, 2517337, 2517369	baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-cert-manager-extension, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-epp, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-ipsec, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5-zonerunner, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contrib, rabbit, spk-csrc, spk-cwc, tmrouted-img	stdlib
CVE-2026-56864	2475121	opentelemetry-collector-contrib	golang.org/x/mod
CVE-2026-56865	2475125	opentelemetry-collector-contrib	golang.org/x/mod
CVE-2026-5704	2476713	baseos	tar
CVE-2026-57062	2507921, 2507957	baseos, rabbit	dirmngr, gpgv
CVE-2026-57432	2489465	baseos	perl-base
CVE-2026-57433	2489469	baseos	perl-base
CVE-2026-58010	2507845	ocnos-img	libglib2.0-0t64
CVE-2026-58011	2507849	ocnos-img	libglib2.0-0t64
CVE-2026-58012	2507853	ocnos-img	libglib2.0-0t64
CVE-2026-58013	2507857	ocnos-img	libglib2.0-0t64
CVE-2026-58014	2507861	ocnos-img	libglib2.0-0t64
CVE-2026-58015	2507865	ocnos-img	libglib2.0-0t64
CVE-2026-58016	2507869	ocnos-img	libglib2.0-0t64
CVE-2026-5928	2476753	baseos	libc-bin
CVE-2026-59843	2506805, 2507713	f5-fluentbit, f5-gslb-debug-sidecar	libssh-4
CVE-2026-59845	2506809, 2507717	f5-fluentbit, f5-gslb-debug-sidecar	libssh-4
CVE-2026-59846	2506813, 2507721	f5-fluentbit, f5-gslb-debug-sidecar	libssh-4
CVE-2026-59847	2506817, 2507725	f5-fluentbit, f5-gslb-debug-sidecar	libssh-4
CVE-2026-59848	2506821, 2507729	f5-fluentbit, f5-gslb-debug-sidecar	libssh-4
CVE-2026-59850	2506825, 2507733	f5-fluentbit, f5-gslb-debug-sidecar	libssh-4
CVE-2026-59890	2474897	f5-bnk-cis	setuptools
CVE-2026-6238	2476757	baseos	libc-bin
CVE-2026-63072	2489425, 2517421	baseos, f5-fluentd	libssl3t64
CVE-2026-63074	2489437, 2517453	baseos, f5-fluentd	libssl3t64
CVE-2026-63076	2489429, 2517425	baseos, f5-fluentd	libssl3t64
CVE-2026-6368	2506617, 2507137, 2507277, 2507433, 2507985, 2517429	baseos, dnsx-img, f5-access-apmd, f5-bnk-cis, f5-fluentd, f5-ipsec	libc-bin
CVE-2026-6390	2476289, 2476597, 2506829	f5-debug-sidecar, f5-gslb-debug-sidecar	nano
CVE-2026-6464	2476549	f5-fluentbit	libpq5
CVE-2026-6469	2476553	f5-fluentbit	libpq5
CVE-2026-6470	2476557	f5-fluentbit	libpq5
CVE-2026-6471	2476561	f5-fluentbit	libpq5
CVE-2026-66046	2506433, 2506557, 2507001, 2507141, 2507561, 2507665, 2507873	dnsx-img, f5-analyzer, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc	libexpat1
CVE-2026-66484	2476569	tmm-img	cpio
CVE-2026-66485	2476573	tmm-img	cpio
CVE-2026-66486	2476577	tmm-img	cpio
CVE-2026-6791	2506621, 2507145, 2507285, 2507441, 2507989, 2517433	baseos, dnsx-img, f5-access-apmd, f5-bnk-cis, f5-fluentd, f5-ipsec	libc-bin
CVE-2026-7017	2489473	baseos	perl-base
CVE-2026-72522	2506437, 2506561, 2507005, 2507149, 2507565, 2507669, 2507877	dnsx-img, f5-analyzer, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc	libexpat1
CVE-2026-73071	2476293, 2506841	f5-gslb-debug-sidecar	vim
CVE-2026-73072	2476297, 2506845	f5-gslb-debug-sidecar	vim
CVE-2026-73073	2489389, 2506849	f5-gslb-debug-sidecar	vim
CVE-2026-73074	2476301, 2506853	f5-gslb-debug-sidecar	vim
CVE-2026-73076	2476305, 2506857	f5-gslb-debug-sidecar	vim
CVE-2026-73077	2476309, 2506861	f5-gslb-debug-sidecar	vim
CVE-2026-73078	2476313, 2506865	f5-gslb-debug-sidecar	vim
CVE-2026-75803	2489441, 2517457	baseos, f5-fluentd	libssl3t64
CVE-2026-76641	2506441, 2506565, 2507009, 2507153, 2507569, 2507673, 2507881	dnsx-img, f5-analyzer, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc	libexpat1
CVE-2026-76957	2506445, 2506569, 2507013, 2507157, 2507573, 2507677, 2507885	dnsx-img, f5-analyzer, f5-nsec-ips-daemon, gslb-engine, gslb-probe-agent, ocnos-img, spk-csrc	libexpat1
CVE-2026-77117	2506625, 2507161, 2507301, 2507457, 2507993, 2517437	baseos, dnsx-img, f5-access-apmd, f5-bnk-cis, f5-fluentd, f5-ipsec	libc-bin
CVE-2026-78662	2505561, 2505585, 2505609, 2505733, 2505765, 2505797, 2505917, 2505941, 2505973, 2506033, 2506177, 2506217, 2506257, 2506281, 2506305, 2506325, 2506337, 2517261, 2517301	cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-coremond, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-epp, f5-fluentd, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, ocnos-img, opentelemetry-collector-contrib, spk-cwc	golang.org/x/crypto
CVE-2026-79921	2505693, 2505757, 2505901, 2506265, 2506317, 2517285	crd-conversion, f5-debug-sidecar, f5-downloader, f5-license-helper, opentelemetry-collector-contrib, spk-cwc	github.com/rabbitmq/amqp091-go
CVE-2026-80212	2517241	f5-fluentd	resolv
CVE-2026-80213	2517265	f5-fluentd	resolv
CVE-2026-80230	2506461, 2506585, 2506629, 2507889, 2507909	crd-installer, f5-debug-sidecar, f5-ipsec, f5ingress, ocnos-img	curl, libcurl4t64
CVE-2026-80489	2506633, 2507165, 2507305, 2507465, 2507997, 2517441	baseos, dnsx-img, f5-access-apmd, f5-bnk-cis, f5-fluentd, f5-ipsec	libc-bin
CVE-2026-82209	2506465, 2506589, 2506637, 2507893, 2507913	crd-installer, f5-debug-sidecar, f5-ipsec, f5ingress, ocnos-img	curl, libcurl4t64
CVE-2026-84303	2505533, 2505545, 2505565, 2505589, 2505613, 2505653, 2505737, 2505741, 2505745, 2505749, 2505777, 2505801, 2505813, 2505825, 2505869, 2505881, 2505893, 2505921, 2505945, 2505957, 2505977, 2505989, 2506001, 2506013, 2506037, 2506049, 2506093, 2506153, 2506181, 2506193, 2506221, 2506233, 2506245, 2506285, 2506309, 2517269, 2517305	cert-manager-controller, cert-manager-webhook, crdupdater, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-manager-extension, f5-coremond, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-dwbld, f5-epp, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-ipsec, f5-l4p-engine, f5-lifecycle-operator, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5-zonerunner, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, ocnos-img, opentelemetry-collector-contrib, spk-csrc, spk-cwc	google.golang.org/grpc
CVE-2026-84304	2505525, 2505537, 2505549, 2505573, 2505597, 2505645, 2505697, 2505701, 2505705, 2505709, 2505769, 2505785, 2505805, 2505817, 2505861, 2505873, 2505885, 2505905, 2505929, 2505949, 2505961, 2505981, 2505993, 2506005, 2506021, 2506041, 2506085, 2506125, 2506165, 2506185, 2506201, 2506225, 2506237, 2506269, 2506293, 2517245, 2517289	cert-manager-controller, cert-manager-webhook, crdupdater, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-manager-extension, f5-coremond, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-dwbld, f5-epp, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-ipsec, f5-l4p-engine, f5-lifecycle-operator, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5-zonerunner, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, ocnos-img, opentelemetry-collector-contrib, spk-csrc, spk-cwc	google.golang.org/grpc
CVE-2026-84445	2505529, 2505541, 2505553, 2505577, 2505601, 2505649, 2505713, 2505717, 2505721, 2505725, 2505773, 2505789, 2505809, 2505821, 2505865, 2505877, 2505889, 2505909, 2505933, 2505953, 2505965, 2505985, 2505997, 2506009, 2506025, 2506045, 2506089, 2506129, 2506169, 2506189, 2506205, 2506229, 2506241, 2506273, 2506297, 2517249, 2517293	cert-manager-controller, cert-manager-webhook, crdupdater, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-manager-extension, f5-coremond, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-dwbld, f5-epp, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-ipsec, f5-l4p-engine, f5-lifecycle-operator, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5-zonerunner, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, ocnos-img, opentelemetry-collector-contrib, spk-csrc, spk-cwc	google.golang.org/grpc
CVE-2026-85091	2517465	f5-bnk-cis	zlib1g
CVE-2026-8932	2489393, 2489397, 2489401, 2506905	f5-access-apmd, f5-fluentbit, f5-gslb-debug-sidecar	curl, libcurl4t64
CVE-2026-9538	2489477	baseos	perl-base
CVE-2026-14662	2476465	f5-fluentbit	libpq5

What’s new

Note

Early Access feature documentation is available on request. Contact your F5 account team if you want to learn more about Early Access features.

• Improved the Semantic AI Cache to pool and reuse connections to the model cache endpoint instead of opening a new connection for each inference request. Configure limits for connection reuse with two annotations:

  • The semantic_cache_pool_max_size annotation sets the maximum number of pooled connections to the model cache endpoint (default 10000).

  • The semantic_cache_pool_idle_timeout annotation sets the idle time in seconds before BNK closes a pooled connection (default 300).

  For more information, see Semantic AI Model Caching.

• Added Early Access support for deploying devices, memory, and CPUs across multiple NUMA nodes. Previous versions of BNK required the Kubernetes Topology Manager Policy to be set to single-numa-node in your cluster to ensure that TMM pods were deployed to a single NUMA node. Now, TMM NUMA spanning is configured using the TMM_ENFORCE_SINGLE_NUMA_NODE environment variable. By default this is false and allows VFs, CPUs, and hugepages to reside on separate NUMA nodes. When set to true, the BNK will block TMM deployment if data plane VFs are not on the same NUMA node or not enough resources are available to deploy CPU and hugepages on the same node. Configure this environment variable in spec.advanced.tmm.env in the CNEInstance resource.

  For the best performance in your cluster, F5 recommends using single-numa-node Topology Manager Policy but it is no longer required for TMM deployment.

• Added Early Access support for Zero-Trust DPF deployments with NVIDIA NICo integration. In this mode, the BNK data plane (TMM) runs as a DPU service on NVIDIA BlueField DPUs, deployed through the NVIDIA DOCA Platform Framework (DPF) and NVIDIA Infrastructure Controller (NICo). BNK control plane components run on the infrastructure cluster and are deployed separately from the DPU service. TMM provides L4–L7 traffic management for Load Balancer objects configured in NICo, on the DPU and outside the tenant host.

  Key characteristics of this deployment:

  • The DPF control plane and BMC/Redfish manage the DPU out-of-band. The tenant host has no path to the DPU management plane.

  • Per-tenant fabric VRFs isolate tenants. You configure them manually in this release.

  • Standard DPF workflows automate DPU provisioning and lifecycle.

  • Unlike host-trusted mode, the host does not need to be a node in the management Kubernetes cluster.

  Deployment requires NVIDIA BlueField DPUs, the DPF control plane, NICo, and an infrastructure cluster for the BNK control plane components.

• Added Early Access support for an LLM Gateway that manages traffic to large language model providers from within the TMM data path. The gateway removes the need for an additional proxy hop. It presents OpenAI-compatible and Anthropic Messages API endpoints to clients and forwards requests to configured providers, such as OpenAI, Anthropic, and Google Gemini.

  Supported capabilities in this release:

  • Multi-provider routing: route requests across providers and models by cost, performance, or policy rule, with failover when a provider is unavailable or rate-limited. A client written for one provider’s API can reach another without changes.

  • Virtual keys: issue per-org, per-team, per-user, and per-key virtual credentials to clients without exposing upstream provider keys.

  • Budgets and rate limits: enforce token, request, and spend limits at the org, team, user, and key level. Requests that would exceed a configured limit are rejected before reaching a provider.

  • Inbound authentication: validate client identity using virtual keys or JWT/OIDC.

  • Per-request telemetry: record model, token counts, cost, latency, and outcome per request, attributable to the issuing key, user, or team.

  • Prompt-cache optimization: reuse eligible repeated prompt content to reduce upstream token usage. Only OpenAI and Anthropic models in 2.4.1.

  The gateway is configured through new AIProvider, AIModel, AIGatewayProfile, AICredential, and AITenant custom resources.

Fixed issues

> Click to view a list of fixed issues:

2549993-3

bdt_cli connection list does not filter by IP address

Component: dsc-bdt_cli

Symptoms: When bdt_cli connection list is run with –cs_client_addr, –cs_server_addr, –ss_server_addr, or –ss_client_addr, the command returns the full connection table instead of only matching flows.

Conditions: SPK/CNF/BNK deployments that use bdt_cli to match specific flow(s) by specifying address(es) for –cs_client_addr, –cs_server_addr, –ss_server_addr, or –ss_client_addr

Impact: The specified address does not take effect, and no flow filtering occurs. Instead, all flows are returned.

Fix Text: bdt_cli now respects the address parameters for –cs_client_addr, –cs_server_addr, –ss_server_addr, or –ss_client_addr and returns desired matching flows.

2503041

configview output displays improper format for some config fields

Component: dsc-cfgview

Symptoms: When executing configview show all in the TMM debug container, the key_cert_pairs fields in declTmm.profile_clientssl and declTmm.profile_serverssl and the port_list field in declTmm.self_ip show Go runtime memory addresses (e.g., &{{} [] [] 0xc000182770}) instead of the expected certificate names, key names, or port numbers. All other fields in these objects show correctly.

Conditions:

• This issue affects any BIG-IP Next CNF, SPK, or BNK deployment that uses the debug sidecar container.

• The issue affects all versions from CNF 1.4.0 onward.

• Running configview show all or querying declTmm.profile_clientssl, declTmm.profile_serverssl, or declTmm.self_ip triggers the issue whenever those objects have key_cert_pairs or port_list entries configured.

Impact:

• You cannot use configview to verify that TMM applied TLS certificate/key pairs and self-IP port-list configuration correctly.

• This issue creates only a diagnostic observability gap; it does not impact traffic, cause configuration-application failures, or expose security risks.

• TMM applies the configuration correctly; only the display fails to render correctly.

Fix Text: Fixed formatting of some config fields in the configview output.

2513953-1

configview shows empty output for some f5-tmm configuration object types starting in version 2.3.0.

Component: dsc-cfgview

Symptoms: Previously some config objects in the configview output, were shown in raw, hard to read form. Starting in release 2.3.0, they display as empty, incorrectly implying that the configuration is missing, when it is actually present and active on the device.

Conditions: When objects that carry a blob of bytes in its protobuf objects like datagroup or security_inspection_profile are configured on a BNK cluster.

Impact: This is a display-only defect in the troubleshooting tool. It does not affect traffic handling or the actual running configuration. Affected object types print with no content at all, giving the false impression that the configuration is missing, when it is actually present and active on the device.

Fix Text: configview now displays configuration objects that contain binary data, such as datagroup and security_inspection_profile.

2493309-4

Redis Sentinel failover and DB restart duplicate some entries

Component: dssm

Symptoms: Duplicate entries with empty values present in the same aux list.

Conditions: After a Redis Sentinel failover, DNS46 sub-record entries can reference the same key multiple times in the aux-list—and transiently leave it with an empty value, because add_script unconditionally appends to KEYS[2] on every retry. If replication splits the paired SET/RPUSH between the old and new primary keys, the next entry resets the value and appends the key again, which grows the aux-list without bound across failovers.

Impact: Duplicate entries with empty values present in the same aux list.

Fix Text: We make the aux-list append idempotent by calling LREM KEYS[2] 0 KEYS[1] immediately before LINSERT (eviction path) and RPUSH (non-eviction path) in add_script’s sub-record branch. Because the Lua script runs atomically on the primary key, the LREM+append sequence ensures the key appears exactly once in the list and self-heals any residual duplicates from prior failovers.

2432005-1

Deploying TMM with resources that span multiple NUMA Nodes

Component: fsm

Symptoms: TMM does not come up successfully when its assigned VFs and CPUs are on different NUMA nodes. However, TMM comes up if hugepages don’t have local NUMA affinity.

Conditions: VFs and CPUs used by TMM are on one NUMA node while the hugepages are on a different NUMA node.

Impact: Seeing as there were only checks for the global pages, those could contain hugepages that are located on the opposite node to the VFs and CPUS. Thus, causing a potential hit on performance. This does not result in any functional issues.

Workaround: Manually ensure that the assigned hugepages to TMM are from the local NUMA node.

Fix Text: Introduction of the environment variable TMM_ENFORCE_SINGLE_NUMA_NODE

By default this is false and allows VFs, CPUs, and hugepages to reside on separate NUMA nodes. When set to True, TMM startup process will enforce that VFs, CPUs, and hugepages all reside on the same NUMA node.

2501773-2

NAT46/DNS64 translation entries expire during active use, causing intermittent connection failures

Component: ingress

Symptoms: When you enable DNS64/NAT46 on a virtual server, clients intermittently fail to connect to synthesized IPv4 addresses with a TCP reset (“No route to host”), even while they continuously resolve the domain and actively use the connection. These failures recur in multi-second windows tied to the configured DNS64/NAT46 TTL; outside these windows, connections succeed normally. During the failure window, DNS responses still show the mapping as valid with a non-zero remaining TTL, even as new connections to the translated address reset.

Conditions:

• DNS64/NAT46 is enabled on the virtual server (dnsNat46Enabled: true).

• A client resolves an AAAA-only hostname through the NAT46 resolver and receives a synthesized A record.

• The client keeps using that synthesized address continuously (repeated DNS lookups and/or ongoing data connections) for longer than the configured maxDNS46TTL.

Impact: Client applications that maintain long-lived or frequent connections to a DNS64/NAT46-synthesized address periodically encounter intermittent “No route to host” failures, even while continuously using the mapping.

Fix Text: Perform a “touch” on DNS queries to update the DSSM entry timestamp and refresh the NAT46 record. This synchronizes expiration so the DNS entry and NAT record expire together, preventing the DNS entry from outliving the NAT record.

2483173-3

f5ingress debug endpoint conflicts with f5-tmm-pod-manager metrics server on port 8080

Component: ingress

Symptoms: Enabling f5ingressDebug alongside the f5-tmm-pod-manager sidecar in the same f5ingress pod prevents the f5-tmm-pod-manager container from starting its metrics server. It logs “error”=”failed to start metrics server: failed to create listener: listen tcp :8080: bind: address already in use,” and the f5ingress pod remains in CrashLoopBackOff.

Conditions: In the f5ingress Helm chart values.yaml

• controller.f5ingressDebug is set to true

• controller.debug.port is left at its default value of 8080

• controller.tmm_pod_manager.enabled is true

Both containers run in the same pod and therefore share a network namespace; the f5-tmm-pod-manager sidecar’s metrics server bind address is not currently exposed as a configurable Helm value and defaults to 8080.

Impact: The f5ingress pod enters CrashLoopBackOff because f5-tmm-pod-manager repeatedly fails to start due to the port conflict.

Workaround: Change controller.debug.port to a non-conflicting value (e.g., 6060) in your Helm values, or disable controller.f5ingressDebug if pprof-based debugging is not required.

Fix Text: The unnecessary tmm-pod-manager metrics server has been disabled to fix this issue.

2560921-3

f5ingress Helm install fails with release names over 36 characters

Component: toda_spk

Symptoms: If you use a release name longer than 36 characters (e.g., spk-automation-spk-operator-app-destination), the chart generates volume names that exceed Kubernetes’ 63-character limit, causing the installation to fail.

Conditions: Install the ingress chart with a release name longer than 36 characters (e.g., spk-automation-spk-operator-app-destination).

Impact: When you use a release name longer than 36 characters, the f5ingress Helm chart generates a volume name that exceeds Kubernetes’ 63-character limit, causing the installation to fail. Helm reports: “spec.template.spec.volumes[44].name: Invalid value: “spk-automation-spk-operator-app-destination-f5-tmm-fluentbit-config”: must be no more than 63 characters.” The observer ConfigMap encounters the same issue.

Workaround: Shorten the ingress Helm chart release name to ensure the generated volume names (-fluentbit-config, -observer-config, -logs-config) stay within the 63-character Kubernetes limit.

Fix Text: Build a config map/object name that fits within Kubernetes’ 63-character limit without collisions: truncate only the base (tmm.name), always preserve the descriptive suffix, and append a short deterministic hash of the full name for uniqueness when truncation is required.

Known issues

> Click to view a list of known issues:

2290393-3

Ingress FW rules fail for hairpin traffic across zones

Component: AFM

Symptoms: Ingress firewall rules fail for hairpin traffic when the app pod and TMM pod are in different zones.

Conditions: Applies only to hairpinned traffic.

Impact: In the IBM setup, when app pod A in Zone 1 sends traffic to TMM B in Zone 2, the local TMM A SNATs the packet’s source IP. This IP change prevents the ingress firewall rule on the remote TMM B from matching and filtering the packet.

Workaround: Apply the same firewall rule on TMM A egress instead of on TMM B ingress.

2484001-2

cert-manager fails to auto-recover and create a certificate after you fix ClusterIssuer and delete the TLS secret

Component: Cert-Mgr

Symptoms: After you correct an invalid ClusterIssuer and delete the TLS secret, cert-manager does not immediately create a new certificate and does not generate a new Order, which appears to prevent auto-recovery.

Conditions: An invalid ACME directory URL causes the certificate authority (CA) to reject the order and places cert-manager into exponential backoff (1–32 hours). The operator fixes the issuer, deletes the TLS secret and stale resources, and checks during the active backoff window.

Impact: This issue causes no permanent impact — cert-manager issues the certificate automatically once the backoff period elapses. If you delete the TLS secret during the backoff period, you may experience a temporary gap in certificate availability.

Workaround: cert-manager does not retry until the in-memory backoff period elapses, even after you fix the issuer and delete the TLS secret and stale CertificateRequest, Order, and Challenge resources. Once the backoff period elapses, cert-manager automatically recreates the CertificateRequest → Order → Challenge chain and issues the certificate.

To force immediate re-issuance (optional), use one of the following methods:

• Run cmctl renew (if cmctl is installed):

  cmctl renew <cert-name> -n <namespace>
  

• Patch the Certificate status to set Issuing=True with reason RenewalRequested:

  kubectl patch certificate <cert-name> -n <namespace> \
    --subresource=status \
    --type='merge' \
    -p '{
      "status": {
        "conditions": [
          {
            "type": "Issuing",
            "status": "True",
            "reason": "RenewalRequested",
            "message": "Manually triggered issuance of Certificate",
            "lastTransitionTime": "'$(date -u +'%Y-%m-%dT%H:%M:%SZ')'"
          }
        ]
      }
    }'
  

Rollout-restart the cert-manager pods to clear the in-memory backoff timers.

Delete and recreate the issuer and certificate with a valid configuration.

2457281-3

DNS behavior change: Aggressively scrubbing authoritative and additional sections to prevent cache poisoning

Component: dns-cache

Symptoms: After you upgrade the unbound version to 1.25.1 in this release, network diagnostics such as dig or nslookup on downstream clients may show that the AUTHORITY and ADDITIONAL sections of certain DNS responses are empty or significantly reduced compared to previous software versions.

Conditions: This behavior activates automatically when the upstream DNS server runs Unbound version 1.24.1 or later.

Impact:

Security impact: Greatly improved. The network now fully protects against a major security vulnerability (CVE-2025-11411). The underlying Unbound engine prevents attackers from hijacking your internet traffic through malicious data injection.

Operational impact: None for normal web browsing, application connectivity, or email traffic. This change does not affect legitimate DNS queries. The only noticeable difference is that the resolver strips extraneous diagnostic data before it reaches your local network devices.

2436037-2

The TMM configview API does not display certain GSLB custom resources

Component: dns-gslb engine

Symptoms: The TMM configview API does not display GSLB custom resources (F5BigGslbSyncAgent, F5BigGslbLocalInstance, F5BigGslbInstance, and F5BigGslbProberPool) and returns the error: “Object not found or not supported” The configview API displays other GSLB objects such as Server, Pool, and Wideip as expected.

Conditions: When querying TMM configview for GSLB configuration, the F5BigGslbSyncAgent, F5BigGslbLocalInstance, F5BigGslbInstance, and F5BigGslbProberPool custom resources are not displayed. Returns “Object not found or not supported” error. But, other GSLB objects such as gslb_server, gslb_vs, and gslb_tmm_wideip are visible in configview as expected.

Impact: No functional impact. GSLB configuration is correctly applied and operational. The CR status shows “CR config sent to all grpc endpoints.” The only impact is that these four CR types cannot be inspected via the TMM configview API and must be inspected using alternative methods (kubectl describe, tmctl stats).

Workaround: Use kubectl describe to inspect these CRs and verify their delivery status. For runtime state, use tmctl stats on the gslb-engine pod:

• F5BigGslbLocalInstance: kubectl describe f5-big-gslb-local-instances.k8s.f5.com

• F5BigGslbInstance: kubectl describe f5-big-gslb-instances.k8s.f5.com

• F5BigGslbProberPool: kubectl describe f5-big-gslb-prober-pools.k8s.f5.com

• F5BigGslbSyncAgent: kubectl describe f5-big-gslb-sync-agents.k8s.f5.com

2471977-2

Deleting applied GSLB Instance custom resources required when upgrading the F5 CNF CRD bundle from BNK 2.2.4/2.2.3 to 2.4.0

Component: dns-gslb general

Symptoms: When you upgrade the F5 CNF CRD bundle (f5-cnf-crds Helm chart) from BIG-IP Next for Kubernetes 2.2.4 (or earlier 2.2/2.3 releases) to 2.4.0, the upgrade fails with the following error:

helm upgrade f5-cnf-crds f5-cnf-crds-<version>.tgz -n default
Error: UPGRADE FAILED: cannot patch "f5-big-gslb-instances.k8s.f5.com"
with kind CustomResourceDefinition: CustomResourceDefinition.apiextensions.k8s.io
"f5-big-gslb-instances.k8s.f5.com" is invalid: status.storedVersions[0]:
Invalid value: "v1alpha1": must appear in spec.versions

Conditions: Occurs when:

• You previously provisioned the cluster with the F5 CNF CRD bundle from a 2.2.x/2.3.x release, where the GslbInstance CRD exposed only the v1alpha1 API version.

• The 2.4.0 CRD bundle removes v1alpha1 from the GslbInstance CRD and exposes only v1, because GSLB moves from Early Access to Generally Available (GA) in 2.4.0 and the CRD schema standardizes on v1.

• The existing CRD’s status.storedVersions still references v1alpha1, which Kubernetes requires to remain in spec.versions before you can remove it.

• This occurs even if you have not created any GslbInstance custom resources on the cluster, because Kubernetes sets status.storedVersions when it establishes the CRD and does not clear it automatically.

Impact: The f5-cnf-crds Helm chart upgrade fails and blocks the overall platform upgrade from 2.2.4/2.3.x to 2.4.0.

Workaround: Before you upgrade the CRD bundle to 2.4.0:

1. Back up and delete any existing GslbInstance (v1alpha1) custom resources from the cluster.

2. Delete the existing CRD:

   kubectl delete crd f5-big-gslb-instances.k8s.f5.com
   

3. Run the Helm upgrade of the CRD bundle (f5-cnf-crds) to 2.4.0.

4. Re-create any required GslbInstance resources using the v1 API version after the upgrade completes.

2285413-6

GSLB inter-instance traffic on non-Sync Agent member is routed through the Kubernetes pod network instead of the TMM internal VLAN

Component: dns-gslb sync group

Symptoms: On the non-Sync Agent member of a GSLB Sync Group deployed on OpenShift, incoming GSLB traffic from the Sync Agent is received by TMM but is forwarded to the GSLB Engine via the Kubernetes pod network interface (eth0) instead of the TMM internal VLAN (shim interface). This causes GSLB inter-engine communication to use an incorrect network path, with ingress traffic not following the same data plane path as egress traffic.

Conditions: A GSLB Sync Group with two or more CNF deployments is configured on OpenShift. The non-Sync Agent member receives GSLB traffic from the Sync Agent. The f5ingress controller does not add the required static route on TMM to direct GSLB traffic through the internal VLAN interface.

Impact: GSLB traffic between Sync Group members on the non-Sync Agent side flows through the Kubernetes pod network instead of the TMM data plane. This results in asymmetric routing where egress GSLB traffic uses the correct internal VLAN path but ingress GSLB traffic bypasses it. This may cause GSLB health monitoring (e.g., HTTPS monitors) and probe traffic to fail or behave unexpectedly.

Workaround: There is no known workaround at this time.

2046925-4

TCP throughput degradation during UDP DDoS attack with DPU hardware acceleration

Component: DoS

Symptoms: Lower TCP throughput degradation could be observed during ongoing UDP DDoS attack on DPU platforms even when Global DDoS mitigation is configured.

Conditions: Occurs when,

• Global DDoS config has TCP and UDP vectors configured.

• DDoS hardware DPU acceleration is enabled.

• TCP and UDP traffic is being processed simultaneously.

Impact: Up to 30% degradation in throughput.

2339825-3

GSLB Sync Group members on OpenShift clusters can lose connectivity to the Kubernetes API, preventing configuration synchronization.

Component: dns-gslb sync group

Symptoms: One GSLB Sync Group member cannot synchronize its GSLB configuration (wide IPs, pools, servers) with the rest of the group. Its logs repeatedly report errors while creating or updating GSLB custom resources, and its GSLB server objects remain in a NotReady state.

Conditions: This occurs when a GSLB Sync Group member is deployed on an OpenShift cluster using the OVN-Kubernetes network plugin (CNI). Sync group members deployed on non-OpenShift Kubernetes clusters are not affected.

Impact: The affected sync group member cannot create or update its own GSLB configuration objects and cannot exchange configuration with other members. The rest of the sync group considers this member as permanently out of sync. Until the issue is resolved, the affected member delivers degraded or unavailable GSLB service.

Workaround: At install time, configure the CSRC component’s Helm values (config.excludeCidr) with the affected cluster’s pod, service, and node CIDR ranges to restore normal Kubernetes API connectivity for that cluster’s GSLB pods.

2330917-2

Egress catchall virtual servers may not restore after you delete and recreate a dependent VRF

Component: egress

Symptoms: When an Egress custom resource depends on a flow-forward VLAN in a VRF and you delete and recreate that VRF, the Egress resource may transition back to Ready=True without fully recreating all Egress-related configuration.

Specifically, the system may restore only the primary IPv4 and IPv6 Egress virtual servers while failing to recreate the catchall IPv4 and IPv6 virtual servers.

Conditions: This issue occurs when all four of the following conditions are met:

• You configure an Egress custom resource with a flow-forward VLAN in a specific VRF (for example, VRF A).

• You enable the flow-forwarding feature on that Egress custom resource.

• You delete VRF A and then recreate it.

• The Egress custom resource recovers to Ready=True after the VRF is restored.

Impact: The Egress custom resource may report a healthy (Ready=True) status while TMM does not program its catchall virtual servers.

This creates a mismatch between the custom resource status and the actual dataplane configuration, which can affect inter-TMM flow-forwarding traffic.

Workaround: After recreating the dependent VRF, reapply the affected Egress CR(s). Reapplying the Egress CR forces reconciliation and restores the missing catchall virtual servers.

2330929-12

ACL hardware stat intermittently out of sync

Component: Firewall (ACL)

Symptoms: The hw_counter field in the fw_rule_stat tmctl table may intermittently fail to increment.

Conditions: This occurs intermittently for gateway attached firewall policies.

Impact: ACL hw_counter stat may report values lower than actual traffic counts.

Workaround: Remove and reapply the configurations to reset the stats.

2503177-2

CNF NAT44 connection per second performance degrades with small packet size

Component: fsm

Symptoms: Connection per second performance degradation is seen with small packet size such 128 bytes.

Conditions: Connection is initiated with small packet.

Impact: With large amount of small packet connection, the connection per second performance degrades.

2389241-6

Failed dynamic route restoration after overlapping static route removal

Component: fsm-dynamic-routing

Symptoms: When you delete a static route that exactly overlaps a dynamic route, BNK may not restore the dynamic route it replaced.

Conditions: Occurs when you configure a static route with the same destination and prefix as an existing dynamic route. For example, for existing dynamic route 192.0.2.0/24 (an example network), BNK also creates a static route for 192.0.2.0/24. You then delete the static route.

Impact: Traffic that matches the dynamic route may not route as expected until BNK reconciles the routing information.

Workaround: To avoid this issue, do not create static routes that exactly overlap dynamic routes. To recover the dynamic route, clear the BGP session that the dynamic route was learned from. For example, if the route was learned from neighbor 198.51.100.1 (an example address), run the following command in the ZebOS or OcNOS shell:

clear bgp 198.51.100.1

2332481-2

VXLAN reinstall may require retry when recreating during a pending delete

Component: fsm-dynamic-routing

Symptoms: When you delete a VXLAN and quickly follow with a create, the system may reject the create because the delete is still pending. If you retry the create a few seconds later, it succeeds. This can cause a silent failure in automation that does not handle error checking, which can lead to unexpected BGP running configuration for objects that use that VXLAN.

Conditions: When you delete and reapply VXLAN custom resources, TMM pods end up in an inconsistent configuration state. Each TMM has different VRF configurations, VNI/VXLAN interfaces have incorrect or missing VRF assignments, and BGP VRF address families are missing.

Impact: All tenant traffic (EVPN/VXLAN) breaks after you reinstall the VXLAN custom resource. Affected pods lose VRF isolation. BGP does not advertise or receive VRF routes. The cluster does not self-heal.

Workaround: In automation, use kubectl delete with –wait=true and check error handling. If manual, wait to retry.

2547629-3

During upgrade traffic drops if BGP routing is used

Component: fsm-dynamic-routing

Symptoms: Ingress and egress traffic are dropped while TMM pods are replaced during an upgrade. Routes to the pods being replaced can remain advertised until the upgrade completes.

Conditions:

• BGP is used to route traffic to the TMM pods.

• An upgrade replaces the TMM pods.

Impact: Connections fail or time out until the upgrade completes.

Workaround: Configure BGP so that a replacement TMM pod advertises its routes without delay, and upstream routers stop using a removed TMM pod quickly. Apply both steps. Step 1 shortens the interruption when a replacement pod starts, and step 2 shortens the interruption when a pod is removed; each step alone leaves the other interruption in place.

1. On the TMM, add the following for each upstream neighbor: neighbor <upstream-IP> advertisement-interval 0 neighbor <upstream-IP> as-origination-interval 1

2. Configure how upstream routers detect a removed TMM pod, using one of the following methods:

   • BFD (recommended): On the TMM, add neighbor <upstream-IP> fall-over bfd for each upstream neighbor. On each upstream router, enable BFD for the BGP session to each TMM pod. Upstream routers then stop using a removed pod in less than a second.

   • BGP timers: On the TMM, add neighbor <upstream-IP> timers 10 30 for each upstream neighbor. Upstream routers then stop using a removed pod within 30 seconds. Shorter timers, such as timers 3 9, reduce the interruption further but can cause BGP sessions to flap when keepalives are delayed, for example when a TMM pod is under heavy load. Confirm that your upstream routers accept the configured hold time.

Traffic can still be interrupted for a few seconds each time a TMM pod is replaced, until the replacement pod establishes its BGP sessions.

1889425-6

Egress traffic fails during an f5-tmm pod restart event

Component: fsm-networking

Symptoms: Egress traffic fails while one or more f5-tmm pods are restarting.

Conditions: Occurs when,

• SPK is installed and configured to handle egress traffic from watched namespaces.

• One or more f5-tmm pods crash or are restarted by Kubernetes.

Impact: Egress traffic might fail from traffic routing to an f5-tmm pod that is restarting.

2471117-2

Partial and temporary ingress traffic loss during node reboot

Component: ingress

Symptoms: Healthy TMM pods drop traffic destined for an application pod on a rebooted node until the controller notifies them that the application pod is down. If the controller’s own node reboots, the disruption window is longer because the controller must recover first before it can notify TMM pods about the affected application pod.

Conditions: You reboot a Kubernetes node that hosts one or more application pods. However, healthy TMM pods continue to route traffic to the now-unavailable application pod because the controller has not yet detected and communicated the pod’s failure.

Impact: Healthy TMM pods drop traffic to the affected application pod from the moment the node reboots until the controller detects the pod failure and sends an exception to TMM, which triggers the removal of the unavailable pool member.

If the controller’s node reboots, the outage duration increases because the controller must fully restart before it can reconcile the application pod’s state and update TMM.

Traffic restores automatically when the affected pod becomes available again. The controller detects the pod’s recovery, updates TMM with the revised pool member configuration, and load balancing to the pod resumes.

Workaround: To minimize traffic disruption caused by TMM forwarding requests to unavailable application pods, configure health monitors on the Pool custom resource that your HTTPRoute backendRefs reference.

When you enable health monitors (such as HTTP, TCP, or ICMP) on a Pool, TMM actively probes pool members and can independently mark an application pod as down without waiting for the controller to detect and relay the pod failure. This significantly reduces the time that TMM routes traffic to an unavailable pod.

Select the appropriate monitor type and configure the relevant parameters (including interval, timeout, and send/receive strings) based on your application protocol to ensure prompt failure detection.

2455985-2

Renaming of metric scraping CRDs

Component: ingress

Symptoms: As part of complying with F5 Standardization, the following CRDs are renamed from the metrics.f5.net domain to the metrics.f5.com domain:

• scrapetemplates.metrics.f5.net → scrapetemplates.metrics.f5.com

• scrapeclasses.metrics.f5.net → scrapeclasses.metrics.f5.com

• scrapes.metrics.f5.net → scrapes.metrics.f5.com

Conditions: As part of a helm limitation, the helm upgrade does not recreate the renamed CRDs by default.

Impact: f5ingress upgrade fails.

Workaround: This manual procedure is only needed for upgrades to 2.4, per the name change.

1. Apply new CRDs directly from the Observer chart helm show crds .../f5-toda-observer-< UPGRADE VERSION>.tgz | kubectl apply -f -

2. Remove stale old-group objects kubectl delete scrapetemplate.metrics.f5.net --all --all-namespaces || true kubectl delete scrapeclass.metrics.f5.net --all || true

3. Upgrade observer helm upgrade observer .../f5-toda-observer-<VERSION>.tgz ...

4. Upgrade ingress helm upgrade f5ingress ... /<UPGRADE-F5INGRESS-VERSION>.tgz

5. Remove the old CRD definitions (optional) kubectl delete crd scrapetemplates.metrics.f5.net kubectl delete crd scrapeclasses.metrics.f5.net kubectl delete crd scrapes.metrics.f5.net

2503545-2

Toggling SelfIP count in one VLAN may result in missing config for other VLANs

Component: ingress

Symptoms: Missing VLAN config on some TMMs.

Conditions: Reducing the number of SelfIPs on a VLAN, then increasing it back to the original count. For example: two SelfIPs -> one SelfIP -> two SelfIPs

Impact: VLAN config from unmodified VLANs may be missing from some TMMs.

Workaround: Delete and re-apply the VLAN CRs that have missing config.

2331381-2

Custom resource status may remain stuck at False after a TMM pod restart or crash

Component: ingress

Symptoms: After a TMM pod restart or crash, one or more SPK custom resource statuses may remain stuck at False with the message “Waiting for one or more dependent CRs to be applied,” even though TMM successfully applied the configurations.

Conditions: A TMM pod crashes or restarts in an SPK deployment that has configured dependent custom resources.

Impact: No traffic impact. The custom resource status incorrectly reports False with “Waiting for one or more dependent CRs to be applied” even though TMM successfully applied the configuration.

Workaround: Delete and reapply the affected stuck custom resources to trigger reconciliation and restore the correct status.

2459457-2

BNK fails to route egress traffic when deployed with OcNOS, VXLAN, and VRF on an OpenShift cluster

Component: ingress

Symptoms: BNK fails to route egress traffic when deployed with OcNOS, VXLAN, and VRF on an OpenShift cluster. The OVN network does not populate the required routes for the specified app pod.

Conditions: This occurs when BNK is deployed with OcNOS, VRF, and VXLAN enabled on an OpenShift cluster.

Impact: Egress traffic failed when BNK deployed with OcNOS, VXLAN, and VRF on an OpenShift cluster.

2502537-2

BNK fails to provision VXLAN CRs on TMM when deployed with OcNOS and VXLAN on an OpenShift cluster

Component: ingress

Symptoms: The system intermittently fails to provision VXLAN CRs on TMMs. The logs confirm that the communication to the Kubernetes API server times out.

Conditions: This occurs when BNK is deployed with OcNOS, VRF, and VXLAN enabled on a six-node OpenShift cluster with separate control and worker plane nodes.

Impact: Ingress and Egress traffic will fail when BNK is deployed with OcNOS and VXLAN on a six-node OpenShift cluster.

Workaround: No Workaround

2488649-2

Stale GatewaySetting configurations persist across TMM, VPC route table, and IPAM after EgressGateway CR update

Component: ingress

Symptoms: When you update the EgressGateway custom resource to reference a new GatewaySettings custom resource, the system does not properly clean up the old settings across TMM, the VPC route table, and IPAM.

As a result, stale configurations from the previous GatewaySetting persist and may conflict with the new configuration, which can disrupt traffic.

Conditions: Occurs when:

• The required resources (Infra, GatewaySettings, EgressGateway) are applied.

• All the resource statuses show True.

• The parametersRef section of the EgressGateway resource reference a new GatewaySettings resource.

Impact: Stale configurations may conflict with the new configurations and disrupt traffic.

Workaround: Option 1: Delete and recreate the EgressGateway custom resource with the updated GatewaySettings custom resource reference to ensure the system runs the correct cleanup processes.

Option 2: Update the GatewaySettings custom resource directly if no other Gateway or EgressGateway references it.

2284409-4

No automatic reassignment of freed IPs to failed gateways

Component: IPAM

Symptoms: When the IP pool is exhausted, new Gateway resources fail to obtain an IP address. When a Gateway is deleted and its IPs are freed, the IPs are not automatically reassigned to Gateways that previously failed due to IP exhaustion.

Conditions: Occurs when

• The IP pool is fully exhausted.

• Multiple Gateway resources fail due to lack of available IPs.

• An existing Gateway (with a successfully allocated IP) is deleted, freeing an IP.

Impact:

• Gateways that failed due to IP exhaustion remain failed.

• IP allocation isn’t automatically retried for affected Gateways.

• Manual intervention is required to recover.

Workaround: To allocate an IP to a Gateway that failed due to IP exhaustion:

1. Delete the affected Gateway resource.

2. Recreate the Gateway resource. This triggers a new IP allocation attempt, allowing the system to assign any available (freed) IP.

2460133-2

ESP packets seen on the f5-ipsec pod while sending traffic.

Component: IPSec

Symptoms: Intermittent ESP leaks from TMM that are forwarded to IPsec pod when the tunnel count exceeds 1,000.

Conditions: When traffic is triggered with 1,000 tunnels, intermittent ESP leaks are observed at the IPsec pod.

Impact: ESP leaks are observed at the IPsec pod for specific client traffic, which is leading to data loss

Workaround: There is no known workaround at this time.

2569605-1

License Registration failing due to TEEM’s certs expiry

Component: licensing

Symptoms: License Activation failure - Device Registration failure.

License CR Output – (trimmed)

  operationMode: connected
status:
  conditions:
  - lastTransitionTime: "202X-1X-1XT09:48:11Z"
    message: 'Device registration failed: JWT verification failed. Error: token
      is unverifiable: error while executing keyfunc: x509: certificate has expired
      or is not yet valid: current time 202X-0X-1XT09:48:10Z is after 202X-10-11T00:24:51Z'

Conditions: Activating License using License CR without providing the TEEM’s JWKS configmap reference in the CR.

Impact: License Activation failure, hence the cluster can be used for traffic.

Workaround: Activation was successful by providing the JWKS reference in License CR.

Fix Text: Download the latest JWKS from the public URL https://product.apis.f5.com/ee/v1/keys/jwks and store in a file (.json ) say for example, cwc-jwks.cm.json.

For GA Builds 2.3.x , 2.4.x if the registration error is observed while license activation. Please perform the below steps:-

1. Delete the license CR

2. Clean up the license secrets data.

3. Restart the CWC

4. Create the config map using the above downloaded file as input.

example:

  kubectl create configmap cwc-jwks-cm \
  --from-file=key=cwc-jwks.cm.json \
  -n <cwc-namespace> \
  --dry-run=client -o yaml | kubectl apply -f -

5. Refer the configmap name and key in the license CR example:

apiVersion: k8s.f5net.com/v1
kind: License
metadata:
  name: cnf-license
spec:
  jwt: "<JWT_TOKEN>
  operationMode: "connected"
  jwksConfigMapRef:
    name: cwc-jwks-cm
    key: key

License CR has to be updated. Along with JWT and Operation Mode need to provide the JWKS config map reference and key of the config map. JWKS Config map and License CR both should be in namespace where CWC is running.

Also post activation, telemetry report should be send to TEEM’s server regularly every month in case of disconnected mode. In case of connected mode it is being send automatically.

2288025-2

Delayed DSSM availability after database failover in Sentinel deployment

Component: PE

Symptoms: In a Sentinel-based DSSM deployment, when the primary database goes down, failover to the new primary database takes approximately seven seconds with the default down-after-milliseconds parameter value of 5 seconds. During this interval, DSSM cannot process requests from the application and resumes serving requests only after the failover completes. Key impacts during this seven-second interval include inconsistencies in RADIUS accounting:

• Subscriber creation / accounting start: The system does not create subscribers. As a result, subscriber policies cannot apply until the next accounting update.

• Subscriber deletion / accounting stop: The system fails to delete subscribers, which leaves stale entries in the system.

• Re-Authentication Request (RAR): During RAR, the system cannot update new policies to DSSM. As a result, some subscribers may lose their applied policies during this brief downtime.

Conditions: DB failover

Impact: DSSM does not serve application requests during this interval.

2483861-2

cert-manager reports certificate as Ready=True while holding issuance retries in backoff after an issuer misconfiguration

Component: TLS/SSL

Symptoms: A certificate shows Ready=True even though recent issuance attempts failed and the certificate is nearing expiry. After you fix an invalid ClusterIssuer, no new Order appears immediately, and deleting stale CertificateRequest, Order, and Challenge resources does not force a retry.

Conditions: An invalid ACME directory URL in the ClusterIssuer causes the certificate authority (CA) to reject the order and places cert-manager into exponential backoff (1–32 hours). The existing TLS secret remains valid, so the certificate shows Ready=True. The operator checks during the backoff window.

Impact: No traffic impact — the existing TLS secret continues to serve traffic. The only impact is operational: the absence of new Orders during backoff can mislead operators into thinking recovery has failed.

Workaround: After you fix the ClusterIssuer, wait for the backoff period to elapse. cert-manager auto-recovers by recreating the CertificateRequest → Order → Challenge chain and renewing the secret. Deleting child resources does not speed up this process because cert-manager enforces backoff at the account level. To force immediate re-issuance (optional), use one of the following methods:

• Run cmctl renew (if cmctl is installed):

  cmctl renew <cert-name> -n <namespace>
  

• Patch the Certificate status to set Issuing=True with reason RenewalRequested:

  kubectl patch certificate <cert-name> -n <namespace> \
    --subresource=status \
    --type='merge' \
    -p '{
      "status": {
        "conditions": [
          {
            "type": "Issuing",
            "status": "True",
            "reason": "RenewalRequested",
            "message": "Manually triggered issuance of Certificate",
            "lastTransitionTime": "'$(date -u +'%Y-%m-%dT%H:%M:%SZ')'"
          }
        ]
      }
    }'
  

Rollout-restart the cert-manager pods to clear the in-memory backoff timers. Delete and recreate the issuer and certificate with a valid configuration. Reference: https://cert-manager.io/v1.11-docs/faq/#what-happens-if-issuance-fails-will-it-be-retried

2482985-2

TODA operator cannot persist status updates after forced pod termination

Component: toda_observer

Symptoms: After an abrupt or forced termination of the TODA Observer Operator or Observer worker pods (for example, using kubectl delete pod --force --grace-period=0 or an ungraceful crash), the system fails to transition newly created or updated ScrapeTemplate custom resources (CRs) to a Running state (Ready=True). Instead, these CRs remain stuck in a Pending or Error state (Ready: 0/N, Ready=False).

The Operator and Observer logs display RPC timeout errors such as: rpc error: code = Unknown desc = query timed out in expression evaluation The system takes approximately 10–15 minutes to resolve the CR status and recover automatically. The Operator and Observer logs report RPC timeout errors such as: rpc error: code = Unknown desc = query timed out in expression evaluation

The CR status may remain unresolved for approximately 10–15 minutes before eventually recovering on its own.

Conditions: The system abruptly or forcibly terminates the TODA Observer Operator or Observer worker pods without performing a graceful shutdown, severing sockets without sending TCP FIN/RST packets. The user applies or modifies new ScrapeClass or ScrapeTemplate CRs shortly after the restart, within the connection cache or retransmission window. This issue occurs on Kubernetes environments (such as bare-metal or ARM64 with Calico and VXLAN networking) where abruptly destroyed network interfaces leave stale half-open TCP connections in the kernel’s ESTABLISHED state.

Impact: Metrics scraping configuration and data collection for newly created ScrapeTemplate resources are delayed or fail to initialize for 10–15 minutes. Normal data path metrics collection resumes automatically once the stale socket window expires.

Workaround: Graceful deletion: Avoid using –force –grace-period=0 when deleting Observer pods, allowing the operating system to send proper TCP FIN/RST packets and cleanly drain sockets. Wait for socket expiration: If forced pod termination has occurred, wait approximately 10–15 minutes before creating new ScrapeTemplate CRs to allow the Linux kernel TCP retransmission budget (tcp_retries2) to reap stale sockets. Kernel / CNI Tuning: Reducing the node’s net.ipv4.tcp_retries2 setting or switching Calico to eBPF mode helps mitigate hung sockets across ungraceful interface tear-downs.

2456521-2

Qkview displays misleading “Running” status after CWC pod restart

Component: toda_qkview

Symptoms: When a qkview capture is in progress and the CWC pod restarts, the status continues to show “Running” indefinitely with a 0B size. The qkview is not actually running — the pod restart terminated the capture. The API reads stale on-disk state after the restart and returns the misleading status.

Attempting to cancel the qkview fails with: “cancel requested for non-running qkview,” which confirms the status is incorrect.

Conditions: Occurs when:

• You start a qkview capture while CWC is running.

• The CWC pod restarts during the capture.

Impact: Users see a misleading “Running” status for orphaned qkviews.

Workaround: Delete the stale qkview entry.