Cloud-Native Network Functions on Robin 2.4.0 release notes¶
About this release¶
Introduction¶
These release notes describe the differences between CNFs on Robin 2.3.x and 2.4.0.
Supported container-orchestration platforms¶
This release is officially supported on these container-orchestration platforms and versions:
| Platform | Version | Recommended Helm version |
|---|---|---|
| Robin | 5.4.3-616 (HF5) | 3 or later |
| Robin | 5.4.3-564 | 3 or later |
| Robin | 5.4.3-302 | 3 or later |
| Robin | 5.3.11-217 | 3 or later |
Security updates¶
List of other CVEs¶
> Click to view table
| CVE Number | Bug IDs | Image Names | Package Name |
|---|---|---|---|
| CVE-2020-14040 | 2323429 | f5dr-img | golang.org/x/text |
| CVE-2021-31525 | 2323433 | f5dr-img | golang.org/x/net |
| CVE-2021-33194 | 2323365 | f5dr-img | golang.org/x/net |
| CVE-2021-38561 | 2323369 | f5dr-img | golang.org/x/text |
| CVE-2021-44716 | 2363753 | f5-debug-sidecar | golang.org/x/net |
| CVE-2022-27664 | 2323373, 2324697 | f5-debug-sidecar, f5dr-img | golang.org/x/net |
| CVE-2022-29526 | 2324825 | ||
| CVE-2022-32149 | 2323377, 2324701 | f5-debug-sidecar, f5dr-img | golang.org/x/text |
| CVE-2022-41717 | 2323437, 2324829 | f5-debug-sidecar | golang.org/x/net |
| CVE-2022-41723 | 2323381, 2324705 | f5-debug-sidecar | golang.org/x/net |
| CVE-2023-39325 | 1821969, 2323385, 2324709 | f5-debug-sidecar | golang.org/x/net |
| CVE-2023-3978 | 2323441, 2324833 | f5dr-img | golang.org/x/net |
| CVE-2023-42366 | 2325837, 2325921 | ||
| CVE-2023-44487 | 1821969, 1821981, 2323385, 2323445, 2324837 | f5-debug-sidecar, f5dr-img | golang.org/x/net |
| CVE-2023-45142 | 1821985 | ||
| CVE-2023-45283 | 1821989 | ||
| CVE-2023-45288 | 1821997, 2323449, 2324841 | ||
| CVE-2023-45290 | 1822005, 1846389 | ||
| CVE-2024-2236 | 1822741, 1823117, 1823337, 1845929, 1846153, 1847557, 2335741, 2335897, 2336053, 2336209, 2336365, 2336549, 2336705, 2336861, 2337025, 2337181 | f5-bnk-cis, f5-fqdn-resolver, f5-ipam-controller, f5-urlcat | libgcrypt20 |
| CVE-2024-24783 | 1822013 | ||
| CVE-2024-24786 | 2323453, 2324845 | f5dr-img | google.golang.org/protobuf |
| CVE-2024-28180 | 1846477 | ||
| CVE-2024-45337 | 2427553 | f5-cert-manager-extension | golang.org/x/crypto |
| CVE-2024-45338 | 2363757, 2427557 | f5-cert-manager-extension, f5-debug-sidecar | golang.org/x/net |
| CVE-2024-56433 | 1816629, 1817121 | ||
| CVE-2024-58251 | 2325841, 2325925 | gslb-engine, gslb-probe-agent | busybox |
| CVE-2025-13462 | 2325701, 2325713, 2325725, 2325861, 2325929, 2325969, 2325985 | dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, spk-csrc | libpython3.12-minimal |
| CVE-2025-14017 | 2324101 | vault-init | curl |
| CVE-2025-14524 | 2324133 | vault-init | curl |
| CVE-2025-14819 | 2324137 | vault-init | curl |
| CVE-2025-22868 | 2427561 | f5-cert-manager-extension | golang.org/x/oauth2 |
| CVE-2025-22869 | 2427565 | f5-cert-manager-extension | golang.org/x/crypto |
| CVE-2025-22870 | 2323457, 2324849, 2427637 | f5-cert-manager-extension, f5-debug-sidecar | golang.org/x/net |
| CVE-2025-22872 | 2323461, 2324853, 2427641 | f5-cert-manager-extension | golang.org/x/net |
| CVE-2025-45582 | 2326069 | BaseOS | tar |
| CVE-2025-46394 | 2325845, 2325933 | gslb-engine, gslb-probe-agent | busybox |
| CVE-2025-47911 | 2363257, 2363921, 2364533, 2427645 | f5-cert-manager-extension, f5-debug-sidecar, f5-node-labeler, init-certmgr | golang.org/x/net |
| CVE-2025-47913 | 2427569 | f5-cert-manager-extension | golang.org/x/crypto |
| CVE-2025-47914 | 2427649 | f5-cert-manager-extension | golang.org/x/crypto |
| CVE-2025-55198 | 2427373 | f5-toda-assistant | helm.sh/helm/v3 |
| CVE-2025-55199 | 2427377 | f5-toda-assistant | helm.sh/helm/v3 |
| CVE-2025-58181 | 2427653 | f5-cert-manager-extension | golang.org/x/crypto |
| CVE-2025-58190 | 2363261, 2363925, 2364537, 2427657 | f5-cert-manager-extension, f5-debug-sidecar, f5-node-labeler, init-certmgr | golang.org/x/net |
| CVE-2025-60876 | 2325849, 2325937, 2428229, 2428369 | gslb-engine, gslb-probe-agent | busybox |
| CVE-2025-69534 | 2428257, 2428309 | f5-bnk-cis, spk-csrc | libpython3.12-minimal |
| CVE-2025-69720 | 2325053, 2428225, 2428461 | baseos, f5dr-img, postgresql | libncurses6, libncursesw6, ncurses |
| CVE-2026-0994 | 2227677 | f5-l4p-engine | libprotobuf32t64 |
| CVE-2026-10536 | 2364845, 2364881, 2364917, 2364953, 2365009, 2365045 | crd-installer, f5-access-apmd, f5-debug-sidecar, f5-fluentbit, f5ingress, ocnos-img | curl, libcurl4t64 |
| CVE-2026-11822 | 2428313, 2428433 | f5-bnk-cis, rabbit | libsqlite3-0 |
| CVE-2026-11824 | 2428317, 2428437 | f5-bnk-cis, rabbit | libsqlite3-0 |
| CVE-2026-11856 | 2364837, 2364873, 2364909, 2364945, 2364981, 2365037 | crd-installer, f5-access-apmd, f5-debug-sidecar, f5-fluentbit, f5ingress, ocnos-img | curl, libcurl4t64 |
| CVE-2026-12064 | 2364849, 2364885, 2364921, 2364957, 2365013, 2365049 | crd-installer, f5-access-apmd, f5-debug-sidecar, f5-fluentbit, f5ingress, ocnos-img | curl, libcurl4t64 |
| CVE-2026-1299 | 2428261, 2428321 | f5-bnk-cis, spk-csrc | libpython3.12-minimal |
| CVE-2026-1484 | 2227669 | postgresql | glib |
| CVE-2026-1485 | 2227673 | postgresql | glib |
| CVE-2026-1502 | 2428265, 2428325 | f5-bnk-cis, spk-csrc | libpython3.12-minimal |
| CVE-2026-1965 | 2324105 | vault-init | curl |
| CVE-2026-2219 | 2326073, 2335649, 2335805, 2335961, 2336117, 2336273, 2336457, 2336613, 2336769, 2336933, 2337093 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img | dpkg |
| CVE-2026-2297 | 2325709, 2325721, 2325733, 2325869, 2325945, 2325977, 2325993 | dnsx-img, f5-access-apmd, f5-analyzer, f5-bnk-cis, f5-nsec-ips-daemon, gslb-engine, spk-csrc | libpython3.12-minimal, python-unversioned-command |
| CVE-2026-2303 | 2363645 | opentelemetry-collector-contri | go.mongodb.org/mongo-driver/v2 |
| CVE-2026-24051 | 2427573 | f5-cert-manager-extension | go.opentelemetry.io/otel/sdk |
| CVE-2026-25679 | 2323473, 2323709 | f5-dssm-upgrader, f5-lifecycle-operator-catalog | stdlib |
| CVE-2026-25680 | 2363205, 2363233, 2363269, 2363301, 2363329, 2363357, 2363385, 2363537, 2363617, 2363649, 2363761, 2363765, 2363769, 2363773, 2363777, 2363953, 2364033, 2364061, 2364229, 2364257, 2364285, 2364313, 2364401, 2364429, 2364509, 2364545, 2364629, 2364721, 2364749, 2364777, 2427121, 2427661, 2427761 | crd-conversion, crd-installer, crdupdater, f5-analyzer, f5-bdosd, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-dwbld, f5-env-discovery, f5-epp, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, init-certmgr, ocnos-img, spk-csrc, spk-cwc | golang.org/x/net |
| CVE-2026-25681 | 2363209, 2363237, 2363273, 2363305, 2363333, 2363361, 2363389, 2363541, 2363621, 2363653, 2363781, 2363785, 2363789, 2363793, 2363797, 2363957, 2364037, 2364065, 2364233, 2364261, 2364289, 2364317, 2364405, 2364433, 2364513, 2364549, 2364633, 2364725, 2364753, 2364781, 2427061, 2427577, 2427709 | crd-conversion, crd-installer, crdupdater, f5-analyzer, f5-bdosd, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-dwbld, f5-env-discovery, f5-epp, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, init-certmgr, ocnos-img, spk-csrc, spk-cwc | golang.org/x/net |
| CVE-2026-25934 | 2323533 | f5-lifecycle-operator-catalog | github.com/go-git/go-git/v5 |
| CVE-2026-2673 | 2325673 | vault | libcrypto3 |
| CVE-2026-27135 | 2325761 | f5-fluentbit | libnghttp2-14 |
| CVE-2026-27136 | 2363213, 2363241, 2363277, 2363309, 2363337, 2363365, 2363393, 2363545, 2363625, 2363657, 2363801, 2363805, 2363809, 2363813, 2363817, 2363961, 2364041, 2364069, 2364237, 2364265, 2364293, 2364321, 2364409, 2364437, 2364517, 2364553, 2364637, 2364729, 2364757, 2364785, 2427065, 2427581, 2427713 | crd-conversion, crd-installer, crdupdater, f5-analyzer, f5-bdosd, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-dwbld, f5-env-discovery, f5-epp, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, init-certmgr, ocnos-img, spk-csrc, spk-cwc | golang.org/x/net |
| CVE-2026-27139 | 2323581, 2323793 | f5-dssm-upgrader, f5-lifecycle-operator-catalog | stdlib |
| CVE-2026-27142 | 2323537, 2323769 | f5-dssm-upgrader, f5-lifecycle-operator-catalog | stdlib |
| CVE-2026-27145 | 2322881, 2322929, 2322973, 2323025, 2323073, 2323117, 2323177, 2323237, 2323281, 2323341, 2323465, 2323629, 2323689, 2323773, 2323833, 2323893, 2323965, 2324037, 2324109, 2324181, 2324225, 2324273, 2324337, 2324393, 2324409, 2324453, 2324501, 2324549, 2324593, 2324641, 2324685, 2324857, 2324861, 2324933, 2324953, 2325001, 2325245, 2325301, 2325361, 2325417, 2325477, 2325537, 2325589, 2325677, 2326049, 2335189, 2335361, 2335457, 2335501, 2335621, 2427337 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmm-img, tmrouted-img, vault, vault-init | stdlib |
| CVE-2026-28387 | 2325609, 2326189, 2335745, 2335901, 2336057, 2336213, 2336369, 2336553, 2336709, 2336865, 2337029, 2337185 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault | libcrypto3, libssl3t64 |
| CVE-2026-28388 | 2325613, 2326193, 2335749, 2335905, 2336061, 2336217, 2336373, 2336557, 2336713, 2336869, 2337033, 2337189 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault | libcrypto3, libssl3t64 |
| CVE-2026-28389 | 2325617, 2326197, 2335753, 2335909, 2336065, 2336221, 2336377, 2336561, 2336717, 2336873, 2337037, 2337193 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault | libcrypto3, libssl3t64 |
| CVE-2026-28390 | 2325621, 2326201, 2335757, 2335913, 2336069, 2336225, 2336381, 2336565, 2336721, 2336877, 2337041, 2337197 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault | libcrypto3, libssl3t64, openssl |
| CVE-2026-29111 | 2326081, 2335653, 2335809, 2335965, 2336121, 2336277, 2336461, 2336617, 2336773, 2336937, 2337097 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img | libsystemd0, systemd-libs |
| CVE-2026-29181 | 2323713 | f5-dssm-upgrader | go.opentelemetry.io/otel |
| CVE-2026-31789 | 2325605, 2326205, 2335761, 2335917, 2336073, 2336229, 2336385, 2336569, 2336725, 2336881, 2337045, 2337201 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault | libcrypto3, libssl3t64 |
| CVE-2026-31790 | 2325681, 2326085, 2335657, 2335813, 2335969, 2336125, 2336281, 2336465, 2336621, 2336777, 2336941, 2337101 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault | libcrypto3, libssl3t64, openssl |
| CVE-2026-32280 | 2323125, 2323477, 2323637, 2323717, 2323841, 2323913, 2323985, 2324285, 2324713, 2324717, 2325193, 2325309, 2325425, 2325997, 2334977, 2335049, 2335077, 2335109, 2335141, 2335273, 2335397, 2335573 | baseos, crdupdater, f5-access-renderer, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fqdn-resolver, f5-ipam-controller, f5-lifecycle-operator-catalog, f5-node-labeler, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, ocnos-img, tmrouted-img | stdlib |
| CVE-2026-32281 | 2323129, 2323481, 2323641, 2323721, 2323845, 2323917, 2323989, 2324289, 2324721, 2324725, 2325197, 2325313, 2325429, 2326001, 2334981, 2335053, 2335081, 2335113, 2335145, 2335277, 2335401, 2335577 | baseos, crdupdater, f5-access-renderer, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fqdn-resolver, f5-ipam-controller, f5-lifecycle-operator-catalog, f5-node-labeler, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, ocnos-img, tmrouted-img | stdlib |
| CVE-2026-32282 | 2323181, 2323545, 2323693, 2323777, 2323897, 2323969, 2324041, 2324341, 2324865, 2324869, 2325249, 2325365, 2325481, 2326053, 2334993, 2335065, 2335093, 2335125, 2335193, 2335289, 2335413, 2335625 | baseos, crdupdater, f5-access-renderer, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fqdn-resolver, f5-ipam-controller, f5-lifecycle-operator-catalog, f5-node-labeler, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, ocnos-img, tmrouted-img | stdlib |
| CVE-2026-32283 | 2323133, 2323485, 2323645, 2323725, 2323849, 2323921, 2323993, 2324293, 2324729, 2324733, 2325201, 2325317, 2325433, 2326005, 2334985, 2335057, 2335085, 2335117, 2335149, 2335281, 2335405, 2335581 | baseos, crdupdater, f5-access-renderer, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fqdn-resolver, f5-ipam-controller, f5-lifecycle-operator-catalog, f5-node-labeler, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, ocnos-img, tmrouted-img | stdlib |
| CVE-2026-32288 | 2323185, 2323549, 2323697, 2323781, 2323901, 2323973, 2324045, 2324345, 2324873, 2324877, 2325253, 2325369, 2325485, 2326057, 2334997, 2335069, 2335097, 2335129, 2335197, 2335293, 2335417, 2335629 | baseos, crdupdater, f5-access-renderer, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fqdn-resolver, f5-ipam-controller, f5-lifecycle-operator-catalog, f5-node-labeler, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, ocnos-img, tmrouted-img | stdlib |
| CVE-2026-32289 | 2323189, 2323553, 2323701, 2323785, 2323905, 2323977, 2324049, 2324349, 2324881, 2324885, 2325257, 2325373, 2325489, 2326061, 2335001, 2335073, 2335101, 2335133, 2335201, 2335297, 2335421, 2335633 | baseos, crdupdater, f5-access-renderer, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fqdn-resolver, f5-ipam-controller, f5-lifecycle-operator-catalog, f5-node-labeler, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, ocnos-img, tmrouted-img | stdlib |
| CVE-2026-3276 | 2428269, 2428329 | f5-bnk-cis, spk-csrc | libpython3.12-minimal |
| CVE-2026-32952 | 2324113, 2324229, 2324277, 2324397, 2324457, 2325685 | cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, vault, vault-init | github.com/Azure/go-ntlmssp |
| CVE-2026-33186 | 2323361, 2324509, 2324693, 2427549 | f5-cert-manager-extension, f5-debug-sidecar, f5-urlcat, f5dr-img | google.golang.org/grpc |
| CVE-2026-33762 | 2323585 | f5-lifecycle-operator-catalog | github.com/go-git/go-git/v5 |
| CVE-2026-33810 | 2323649, 2323853, 2323925, 2323997, 2324297, 2324737, 2324741, 2325205, 2325321, 2325437, 2326009, 2334989, 2335061, 2335089, 2335121, 2335137, 2335153, 2335285, 2335409, 2335585 | baseos, crdupdater, f5-access-renderer, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fqdn-resolver, f5-ipam-controller, f5-node-labeler, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, ocnos-img, tmrouted-img | stdlib |
| CVE-2026-33811 | 2322845, 2322889, 2322937, 2322981, 2323037, 2323081, 2323137, 2323197, 2323245, 2323289, 2323389, 2323489, 2323593, 2323653, 2323729, 2323797, 2323857, 2323929, 2324001, 2324057, 2324145, 2324189, 2324237, 2324301, 2324357, 2324417, 2324465, 2324513, 2324557, 2324601, 2324649, 2324745, 2324749, 2324897, 2324965, 2325209, 2325265, 2325325, 2325381, 2325441, 2325497, 2325545, 2325625, 2326013, 2335157, 2335309, 2335425, 2335469, 2335589, 2427341 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator-catalog, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmm-img, tmrouted-img, vault, vault-init | stdlib |
| CVE-2026-33814 | 2322849, 2322893, 2322941, 2322985, 2323041, 2323085, 2323141, 2323201, 2323249, 2323293, 2323393, 2323493, 2323597, 2323657, 2323801, 2323861, 2323933, 2324005, 2324061, 2324149, 2324193, 2324241, 2324305, 2324361, 2324421, 2324469, 2324517, 2324561, 2324605, 2324653, 2324753, 2324757, 2324901, 2324969, 2325213, 2325269, 2325329, 2325385, 2325445, 2325501, 2325549, 2325629, 2326017, 2335161, 2335313, 2335429, 2335473, 2335593, 2364641, 2364789, 2427345, 2427585 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator, f5-lifecycle-operator-catalog, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmm-img, tmrouted-img, vault, vault-init | golang.org/x/net, stdlib |
| CVE-2026-33845 | 2325017, 2326089, 2335661, 2335817, 2335973, 2336129, 2336285, 2336469, 2336625, 2336781, 2336945, 2337105 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, postgresql, tmrouted-img | gnutls, libgnutls30t64 |
| CVE-2026-33846 | 2325057, 2326093, 2335665, 2335821, 2335977, 2336133, 2336289, 2336473, 2336629, 2336785, 2336949, 2337109 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, postgresql, tmrouted-img | gnutls, libgnutls30t64 |
| CVE-2026-34165 | 2323557 | f5-lifecycle-operator-catalog | github.com/go-git/go-git/v5 |
| CVE-2026-34180 | 2335233, 2335533, 2335765, 2335921, 2336077, 2336233, 2336389, 2336573, 2336729, 2336885, 2337049, 2337205, 2337257 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault, vault-init | libcrypto3, libssl3t64 |
| CVE-2026-34181 | 2335237, 2335537 | vault, vault-init | libcrypto3 |
| CVE-2026-34182 | 2335217, 2335517, 2335669, 2335825, 2335981, 2336137, 2336293, 2336477, 2336633, 2336789, 2336953, 2337113, 2337245 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault, vault-init | libcrypto3, libssl3t64 |
| CVE-2026-34183 | 2335221, 2335521 | vault, vault-init | libcrypto3 |
| CVE-2026-34743 | 2325913, 2326209, 2335769, 2335925, 2336081, 2336237, 2336393, 2336577, 2336733, 2336889, 2337053, 2337209 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, rabbit, tmrouted-img | liblzma5, xz-libs, xz-utils |
| CVE-2026-34986 | 2323145 | f5-blobd | github.com/go-jose/go-jose/v4 |
| CVE-2026-35206 | 2324957, 2427381 | f5-lifecycle-operator, f5-toda-assistant | helm.sh/helm/v3 |
| CVE-2026-35469 | 2322897, 2323205, 2323737, 2324609, 2324761, 2324941, 2325505, 2427349 | crd-conversion, f5-debug-sidecar, f5-dssm-upgrader, f5-license-helper, f5-lifecycle-operator, f5-toda-assistant, spk-csrc, spk-cwc | github.com/moby/spdystream |
| CVE-2026-3644 | 2428273, 2428333 | f5-bnk-cis, spk-csrc | libpython3.12-minimal, python-unversioned-command |
| CVE-2026-3783 | 2324117 | vault-init | curl |
| CVE-2026-3784 | 2324121 | vault-init | curl |
| CVE-2026-3805 | 2324125 | vault-init | curl |
| CVE-2026-3832 | 2326097, 2335673, 2335829, 2335985, 2336141, 2336297, 2336481, 2336637, 2336793, 2336957, 2337117 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img | libgnutls30t64 |
| CVE-2026-3833 | 2325061, 2326101, 2335677, 2335833, 2335989, 2336145, 2336301, 2336485, 2336641, 2336797, 2336961, 2337121 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, postgresql, tmrouted-img | gnutls, libgnutls30t64 |
| CVE-2026-39820 | 2322853, 2322901, 2322945, 2322989, 2323045, 2323089, 2323149, 2323209, 2323253, 2323297, 2323397, 2323497, 2323601, 2323661, 2323741, 2323805, 2323865, 2323937, 2324009, 2324065, 2324153, 2324197, 2324245, 2324309, 2324365, 2324425, 2324473, 2324521, 2324565, 2324613, 2324657, 2324765, 2324769, 2324905, 2324973, 2325217, 2325273, 2325333, 2325389, 2325449, 2325509, 2325553, 2325633, 2326021, 2335165, 2335317, 2335433, 2335477, 2335597, 2427353 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator-catalog, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmm-img, tmrouted-img, vault, vault-init | stdlib |
| CVE-2026-39821 | 2363217, 2363245, 2363281, 2363313, 2363341, 2363369, 2363397, 2363549, 2363629, 2363661, 2363821, 2363825, 2363829, 2363833, 2363837, 2363965, 2364045, 2364073, 2364241, 2364269, 2364297, 2364325, 2364413, 2364441, 2364521, 2364557, 2364645, 2364733, 2364761, 2364793, 2427069, 2427589, 2427717 | crd-conversion, crd-installer, crdupdater, f5-analyzer, f5-bdosd, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-dwbld, f5-env-discovery, f5-epp, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, init-certmgr, ocnos-img, spk-csrc, spk-cwc | golang.org/x/net |
| CVE-2026-39822 | 2426949, 2426965, 2426985, 2427005, 2427013, 2427029, 2427045, 2427073, 2427177, 2427185, 2427201, 2427221, 2427253, 2427277, 2427293, 2427329, 2427357, 2427413, 2427425, 2427437, 2427457, 2427473, 2427477, 2427533, 2427593, 2427721, 2427813, 2427897, 2427905, 2427917, 2427957, 2427973, 2427989, 2428041, 2428057, 2428073, 2428089, 2428101, 2428117, 2428137, 2428145, 2428161, 2428177, 2428193, 2428213, 2428441, 2430577 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-bnk-cis, f5-cert-client, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-epp, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, strongswan, tmrouted-img | stdlib |
| CVE-2026-39823 | 2322857, 2322905, 2322949, 2322993, 2323049, 2323093, 2323153, 2323213, 2323257, 2323301, 2323401, 2323501, 2323605, 2323665, 2323745, 2323809, 2323869, 2323941, 2324013, 2324069, 2324157, 2324201, 2324249, 2324313, 2324369, 2324429, 2324477, 2324525, 2324569, 2324617, 2324661, 2324773, 2324777, 2324909, 2324977, 2325221, 2325277, 2325337, 2325393, 2325453, 2325513, 2325557, 2325637, 2326025, 2335169, 2335321, 2335437, 2335481, 2335601, 2427385 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator-catalog, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmm-img, tmrouted-img, vault, vault-init | stdlib |
| CVE-2026-39824 | 2363229, 2363265, 2363293, 2363297, 2363325, 2363353, 2363381, 2363409, 2363613, 2363641, 2363745, 2363749, 2363945, 2363949, 2364029, 2364057, 2364085, 2364253, 2364281, 2364309, 2364337, 2364425, 2364505, 2364541, 2364621, 2364625, 2364717, 2364745, 2364773, 2364805, 2427161, 2427693, 2427793, 2427881 | crd-conversion, crd-installer, crdupdater, f5-analyzer, f5-bdosd, f5-bnk-cis, f5-cert-client, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-dwbld, f5-env-discovery, f5-epp, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, init-certmgr, ocnos-img, spk-csrc, spk-cwc, tmrouted-img | golang.org/x/sys |
| CVE-2026-39825 | 2322861, 2322909, 2322953, 2322997, 2323053, 2323097, 2323157, 2323217, 2323261, 2323305, 2323405, 2323505, 2323609, 2323669, 2323749, 2323813, 2323873, 2323945, 2324017, 2324073, 2324161, 2324205, 2324253, 2324317, 2324373, 2324433, 2324481, 2324529, 2324573, 2324621, 2324665, 2324781, 2324785, 2324913, 2324981, 2325225, 2325281, 2325341, 2325397, 2325457, 2325517, 2325561, 2325641, 2326029, 2335173, 2335325, 2335441, 2335485, 2335605, 2427389 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator-catalog, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmm-img, tmrouted-img, vault, vault-init | stdlib |
| CVE-2026-39826 | 2322865, 2322913, 2322957, 2323001, 2323057, 2323101, 2323161, 2323221, 2323265, 2323309, 2323409, 2323509, 2323613, 2323673, 2323753, 2323817, 2323877, 2323949, 2324021, 2324077, 2324165, 2324209, 2324257, 2324321, 2324377, 2324437, 2324485, 2324533, 2324577, 2324625, 2324669, 2324789, 2324793, 2324917, 2324985, 2325229, 2325285, 2325345, 2325401, 2325461, 2325521, 2325565, 2325645, 2326033, 2335205, 2335365, 2335461, 2335505, 2335637, 2427393 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator-catalog, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmm-img, tmrouted-img, vault, vault-init | stdlib |
| CVE-2026-39827 | 2363553, 2363665, 2363841, 2363969, 2364341, 2364445, 2364561, 2364649, 2427125, 2427665, 2427765 | crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, f5-lifecycle-operator-catalog, spk-cwc | golang.org/x/crypto |
| CVE-2026-39828 | 2363557, 2363669, 2363845, 2363973, 2364345, 2364449, 2364565, 2364653, 2427077, 2427597, 2427725 | crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, f5-lifecycle-operator-catalog, spk-cwc | golang.org/x/crypto |
| CVE-2026-39829 | 2363561, 2363673, 2363849, 2363977, 2364349, 2364453, 2364569, 2364657, 2427081, 2427601, 2427729 | crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, f5-lifecycle-operator-catalog, spk-cwc | golang.org/x/crypto |
| CVE-2026-39830 | 2363565, 2363677, 2363853, 2363981, 2364353, 2364457, 2364573, 2364661, 2427085, 2427605, 2427733 | crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, f5-lifecycle-operator-catalog, spk-cwc | golang.org/x/crypto |
| CVE-2026-39831 | 2363597, 2363713, 2363929, 2364013, 2364381, 2364489, 2364605, 2364697, 2427089, 2427609, 2427737 | crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, f5-lifecycle-operator-catalog, spk-cwc | golang.org/x/crypto |
| CVE-2026-39832 | 2363569, 2363681, 2363857, 2363985, 2364357, 2364461, 2364577, 2364665, 2427093, 2427613, 2427741 | crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, f5-lifecycle-operator-catalog, spk-cwc | golang.org/x/crypto |
| CVE-2026-39833 | 2363601, 2363717, 2363933, 2364017, 2364385, 2364493, 2364609, 2364701, 2427129, 2427669, 2427769 | crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, f5-lifecycle-operator-catalog, spk-cwc | golang.org/x/crypto |
| CVE-2026-39834 | 2363605, 2363721, 2363937, 2364021, 2364389, 2364497, 2364613, 2364705, 2427133, 2427673, 2427773 | crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, f5-lifecycle-operator-catalog, spk-cwc | golang.org/x/crypto |
| CVE-2026-39835 | 2363573, 2363685, 2363861, 2363989, 2364361, 2364465, 2364581, 2364669, 2427097, 2427617, 2427745 | crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, f5-lifecycle-operator-catalog, spk-cwc | golang.org/x/crypto |
| CVE-2026-39836 | 2322869, 2322917, 2322961, 2323005, 2323061, 2323105, 2323165, 2323225, 2323269, 2323313, 2323413, 2323513, 2323617, 2323677, 2323757, 2323821, 2323881, 2323953, 2324025, 2324081, 2324169, 2324213, 2324261, 2324325, 2324381, 2324441, 2324489, 2324537, 2324581, 2324629, 2324673, 2324797, 2324801, 2324921, 2324989, 2325233, 2325289, 2325349, 2325405, 2325465, 2325525, 2325569, 2325649, 2326037, 2335177, 2335329, 2335445, 2335489, 2335609, 2427361 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator-catalog, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmm-img, tmrouted-img, vault, vault-init | stdlib |
| CVE-2026-39883 | 2427621 | f5-cert-manager-extension | go.opentelemetry.io/otel/sdk |
| CVE-2026-40179 | 2323345, 2325593, 2427137 | f5-epp, f5-toda-observer, opentelemetry-collector-contri | github.com/prometheus/prometheus |
| CVE-2026-40200 | 2325653 | vault | musl |
| CVE-2026-40225 | 2326105, 2335681, 2335837, 2335993, 2336149, 2336305, 2336489, 2336645, 2336801, 2336965, 2337125 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img | libsystemd0 |
| CVE-2026-40226 | 2335685, 2335841, 2335997, 2336153, 2336309, 2336493, 2336649, 2336805, 2336969, 2337129, 2337249 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img | libsystemd0 |
| CVE-2026-40228 | 2325757, 2335773, 2335929, 2336085, 2336241, 2336397, 2336581, 2336737, 2336893, 2337057, 2337213 | f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmm-img, tmrouted-img | libsystemd0 |
| CVE-2026-41080 | 2325065 | postgresql | expat-libs |
| CVE-2026-41218 | 2259649 | ||
| CVE-2026-41316 | 2335333 | f5-fluentd | erb |
| CVE-2026-41506 | 2323561 | f5-lifecycle-operator-catalog | github.com/go-git/go-git/v5 |
| CVE-2026-41602 | 2323317, 2324085, 2325657 | opentelemetry-collector-contri, vault, vault-init | github.com/apache/thrift |
| CVE-2026-41889 | 2323357, 2324141, 2325697 | opentelemetry-collector-contri, vault, vault-init | github.com/jackc/pgx/v5 |
| CVE-2026-41989 | 2326113, 2335689, 2335845, 2336001, 2336157, 2336313, 2336497, 2336653, 2336809, 2336973, 2337133 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img | libgcrypt20 |
| CVE-2026-41991 | 2428453 | baseos | gzip |
| CVE-2026-41992 | 2428457 | baseos | gzip |
| CVE-2026-42009 | 2326117, 2335693, 2335849, 2336005, 2336161, 2336317, 2336501, 2336657, 2336813, 2336977, 2337137 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img | libgnutls30t64 |
| CVE-2026-42010 | 2325021, 2326121, 2335697, 2335853, 2336009, 2336165, 2336321, 2336505, 2336661, 2336817, 2336981, 2337141 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, postgresql, tmrouted-img | gnutls, libgnutls30t64 |
| CVE-2026-42011 | 2325069, 2326125, 2335701, 2335857, 2336013, 2336169, 2336325, 2336509, 2336665, 2336821, 2336985, 2337145 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, postgresql, tmrouted-img | gnutls, libgnutls30t64 |
| CVE-2026-42012 | 2326129, 2335705, 2335861, 2336017, 2336173, 2336329, 2336513, 2336669, 2336825, 2336989, 2337149 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img | libgnutls30t64 |
| CVE-2026-42013 | 2326133, 2335709, 2335865, 2336021, 2336177, 2336333, 2336517, 2336673, 2336829, 2336993, 2337153 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img | libgnutls30t64 |
| CVE-2026-42014 | 2326137, 2335713, 2335869, 2336025, 2336181, 2336337, 2336521, 2336677, 2336833, 2336997, 2337157 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img | libgnutls30t64 |
| CVE-2026-42015 | 2326141, 2335717, 2335873, 2336029, 2336185, 2336341, 2336525, 2336681, 2336837, 2337001, 2337161 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img | libgnutls30t64 |
| CVE-2026-42151 | 2323321, 2325573, 2335337, 2427101 | f5-epp, f5-fluentd, f5-toda-observer, opentelemetry-collector-contri | github.com/prometheus/prometheus |
| CVE-2026-42154 | 2323325, 2325577, 2335341, 2427105 | f5-epp, f5-fluentd, f5-toda-observer, opentelemetry-collector-contri | github.com/prometheus/prometheus |
| CVE-2026-4224 | 2335345, 2335349, 2428277, 2428337 | f5-bnk-cis, f5-fluentd, spk-csrc | libpython3.12-minimal, net-imap, python-unversioned-command |
| CVE-2026-42245 | 2335345 | f5-fluentd | net-imap |
| CVE-2026-42246 | 2335349 | f5-fluentd | net-imap |
| CVE-2026-42256 | 2335369 | f5-fluentd | net-imap |
| CVE-2026-42257 | 2335301 | f5-fluentd | net-imap |
| CVE-2026-42258 | 2335305 | f5-fluentd | net-imap |
| CVE-2026-42496 | 2365073 | baseos | perl-base |
| CVE-2026-42499 | 2322873, 2322921, 2322965, 2323009, 2323065, 2323109, 2323169, 2323229, 2323273, 2323329, 2323417, 2323517, 2323621, 2323681, 2323761, 2323825, 2323885, 2323957, 2324029, 2324089, 2324173, 2324217, 2324265, 2324329, 2324385, 2324445, 2324493, 2324541, 2324585, 2324633, 2324677, 2324805, 2324809, 2324925, 2324993, 2325237, 2325293, 2325353, 2325409, 2325469, 2325529, 2325581, 2325661, 2326041, 2335181, 2335353, 2335449, 2335493, 2335613, 2427365 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-eowyn-install, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator-catalog, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmm-img, tmrouted-img, vault, vault-init | stdlib |
| CVE-2026-42502 | 2363221, 2363249, 2363285, 2363317, 2363345, 2363373, 2363401, 2363577, 2363633, 2363689, 2363865, 2363869, 2363873, 2363877, 2363881, 2363993, 2364049, 2364077, 2364245, 2364273, 2364301, 2364329, 2364417, 2364469, 2364525, 2364585, 2364673, 2364737, 2364765, 2364797, 2427141, 2427677, 2427777 | crd-conversion, crd-installer, crdupdater, f5-analyzer, f5-bdosd, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-dwbld, f5-env-discovery, f5-epp, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, init-certmgr, ocnos-img, spk-csrc, spk-cwc | golang.org/x/net |
| CVE-2026-42504 | 2322877, 2322925, 2322969, 2323013, 2323069, 2323113, 2323173, 2323233, 2323277, 2323333, 2323421, 2323625, 2323685, 2323765, 2323829, 2323889, 2323961, 2324033, 2324093, 2324177, 2324221, 2324269, 2324333, 2324389, 2324405, 2324449, 2324497, 2324545, 2324589, 2324637, 2324681, 2324813, 2324817, 2324929, 2324945, 2324997, 2325241, 2325297, 2325357, 2325413, 2325473, 2325533, 2325585, 2325665, 2326045, 2335185, 2335357, 2335453, 2335497, 2335617, 2427369 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmm-img, tmrouted-img, vault, vault-init | stdlib |
| CVE-2026-42505 | 2426953, 2426969, 2426989, 2427009, 2427017, 2427033, 2427049, 2427145, 2427181, 2427189, 2427205, 2427225, 2427261, 2427281, 2427297, 2427333, 2427397, 2427417, 2427429, 2427441, 2427461, 2427481, 2427485, 2427537, 2427681, 2427781, 2427849, 2427901, 2427909, 2427929, 2427961, 2427977, 2427993, 2428045, 2428061, 2428077, 2428093, 2428105, 2428121, 2428141, 2428149, 2428165, 2428181, 2428197, 2428217, 2428445, 2430581 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-bnk-cis, f5-cert-client, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-epp, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, strongswan, tmrouted-img | stdlib |
| CVE-2026-42506 | 2363225, 2363253, 2363289, 2363321, 2363349, 2363377, 2363405, 2363581, 2363637, 2363693, 2363885, 2363889, 2363893, 2363897, 2363901, 2363997, 2364053, 2364081, 2364249, 2364277, 2364305, 2364333, 2364421, 2364473, 2364529, 2364589, 2364677, 2364741, 2364769, 2364801, 2427149, 2427685, 2427785 | crd-conversion, crd-installer, crdupdater, f5-analyzer, f5-bdosd, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-dwbld, f5-env-discovery, f5-epp, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, init-certmgr, ocnos-img, spk-csrc, spk-cwc | golang.org/x/net |
| CVE-2026-42507 | 2322885, 2322933, 2322977, 2323029, 2323077, 2323121, 2323193, 2323241, 2323285, 2323349, 2323469, 2323633, 2323705, 2323789, 2323837, 2323909, 2323981, 2324053, 2324129, 2324185, 2324233, 2324281, 2324353, 2324401, 2324413, 2324461, 2324505, 2324553, 2324597, 2324645, 2324689, 2324889, 2324893, 2324937, 2324961, 2325005, 2325261, 2325305, 2325377, 2325421, 2325493, 2325541, 2325597, 2325689, 2326065, 2335209, 2335373, 2335465, 2335509, 2335641, 2427401 | baseos, cert-manager-cainjector, cert-manager-controller, cert-manager-startupapicheck, cert-manager-webhook, crd-conversion, crd-installer, crdupdater, f5-access-renderer, f5-analyzer, f5-bdosd, f5-blobd, f5-bnk-cis, f5-cert-client, f5-debug-sidecar, f5-downloader, f5-dssm-store, f5-dssm-upgrader, f5-dwbld, f5-env-discovery, f5-eowyn-install, f5-fluentbit, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-license-proxy, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-observer, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ing-tmm-pod-manager, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, rabbit, spk-csrc, spk-cwc, tmm-img, tmrouted-img, vault, vault-init | stdlib |
| CVE-2026-42508 | 2363585, 2363697, 2363905, 2364001, 2364365, 2364477, 2364593, 2364681, 2427109, 2427625, 2427749 | crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, f5-lifecycle-operator-catalog, spk-cwc | golang.org/x/crypto |
| CVE-2026-42602 | 2323337 | opentelemetry-collector-contri | |
| CVE-2026-42764 | 2335225, 2335525 | vault, vault-init | libcrypto3 |
| CVE-2026-42766 | 2335241, 2335541, 2335777, 2335933, 2336089, 2336245, 2336401, 2336585, 2336741, 2336897, 2337061, 2337217, 2337261 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault, vault-init | libcrypto3, libssl3t64 |
| CVE-2026-42767 | 2335245, 2335545, 2335781, 2335937, 2336093, 2336249, 2336405, 2336589, 2336745, 2336901, 2337065, 2337221, 2337265 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault, vault-init | libcrypto3, libssl3t64 |
| CVE-2026-42768 | 2335249, 2335549 | vault, vault-init | libcrypto3 |
| CVE-2026-42769 | 2335253, 2335553 | vault, vault-init | libcrypto3 |
| CVE-2026-42770 | 2335257, 2335557, 2335785, 2335941, 2336097, 2336253, 2336409, 2336593, 2336749, 2336905, 2337069, 2337225, 2337269 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault, vault-init | libcrypto3, libssl3t64 |
| CVE-2026-42790 | 2354529 | ||
| CVE-2026-44024 | 2427809 | f5-fluentd | fluentd |
| CVE-2026-44025 | 2427817 | f5-fluentd | fluentd |
| CVE-2026-44160 | 2427821 | f5-fluentd | fluentd |
| CVE-2026-44161 | 2427825 | f5-fluentd | fluentd |
| CVE-2026-44503 | 2324097, 2325669 | vault, vault-init | github.com/microsoft/kiota-http-go |
| CVE-2026-44740 | 2323569 | f5-lifecycle-operator-catalog | github.com/go-git/go-billy/v5 |
| CVE-2026-44903 | 2323353, 2325601, 2335377, 2427153 | f5-epp, f5-fluentd, f5-toda-observer, opentelemetry-collector-contri | github.com/prometheus/prometheus |
| CVE-2026-44973 | 2323525 | f5-lifecycle-operator-catalog | github.com/go-git/go-billy/v5 |
| CVE-2026-45022 | 2323529 | f5-lifecycle-operator-catalog | github.com/go-git/go-git/v5 |
| CVE-2026-45186 | 2325073 | postgresql | expat-libs |
| CVE-2026-4519 | 2428281, 2428341 | f5-bnk-cis, spk-csrc | libpython3.12-minimal, python-unversioned-command |
| CVE-2026-45445 | 2335229, 2335529, 2335721, 2335877, 2336033, 2336189, 2336345, 2336529, 2336685, 2336841, 2337005, 2337165, 2337253 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault, vault-init | libcrypto3, libssl3t64 |
| CVE-2026-45446 | 2335261, 2335561, 2335789, 2335945, 2336101, 2336257, 2336413, 2336597, 2336753, 2336909, 2337073, 2337229, 2337273 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault, vault-init | libcrypto3, libssl3t64 |
| CVE-2026-45447 | 2335213, 2335513, 2335645, 2335801, 2335957, 2336113, 2336269, 2336453, 2336609, 2336765, 2336929, 2337089, 2337241 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault, vault-init | libcrypto3, libssl3t64 |
| CVE-2026-45570 | 2323589 | f5-lifecycle-operator-catalog | github.com/go-git/go-git/v5 |
| CVE-2026-45571 | 2323573 | f5-lifecycle-operator-catalog | github.com/go-git/go-git/v5 |
| CVE-2026-46595 | 2363589, 2363701, 2363909, 2364005, 2364369, 2364481, 2364597, 2364685, 2427113, 2427629, 2427753 | crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, f5-lifecycle-operator-catalog, spk-cwc | golang.org/x/crypto |
| CVE-2026-46597 | 2363593, 2363705, 2363913, 2364009, 2364373, 2364485, 2364601, 2364689, 2427117, 2427633, 2427757 | crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, f5-lifecycle-operator-catalog, spk-cwc | golang.org/x/crypto |
| CVE-2026-46598 | 2363609, 2363725, 2363941, 2364025, 2364393, 2364501, 2364617, 2364709, 2427157, 2427689, 2427789 | crd-conversion, f5-bnk-cis, f5-cert-manager-extension, f5-debug-sidecar, f5-downloader, f5-epp, f5-ipam-controller, f5-license-helper, f5-lifecycle-operator, f5-lifecycle-operator-catalog, spk-cwc | golang.org/x/crypto |
| CVE-2026-46600 | 2426957, 2426973, 2426993, 2427021, 2427037, 2427053, 2427165, 2427209, 2427229, 2427265, 2427285, 2427301, 2427405, 2427445, 2427465, 2427489, 2427493, 2427497, 2427501, 2427505, 2427541, 2427697, 2427797, 2427885, 2427945, 2427965, 2427981, 2427997, 2428005, 2428049, 2428065, 2428081, 2428125, 2428153, 2428169, 2428185, 2428201 | crd-conversion, crd-installer, crdupdater, f5-analyzer, f5-bdosd, f5-bnk-cis, f5-cert-manager-extension, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-dwbld, f5-env-discovery, f5-epp, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, spk-csrc, spk-cwc, strongswan | golang.org/x/net |
| CVE-2026-46680 | 2324949 | f5-lifecycle-operator | github.com/containerd/containerd |
| CVE-2026-47240 | 2335381 | f5-fluentd | net-imap |
| CVE-2026-47241 | 2335389 | f5-fluentd | net-imap |
| CVE-2026-47242 | 2335385 | f5-fluentd | net-imap |
| CVE-2026-47262 | 2364397, 2364713 | f5-lifecycle-operator, f5-lifecycle-operator-catalog | github.com/containerd/containerd |
| CVE-2026-4786 | 2428285, 2428345 | f5-bnk-cis, spk-csrc | libpython3.12-minimal |
| CVE-2026-4873 | 2325129, 2325825 | f5-fluentbit, postgresql | curl, libcurl4t64 |
| CVE-2026-4878 | 2326153, 2335725, 2335881, 2336037, 2336193, 2336349, 2336533, 2336689, 2336845, 2337009 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, tmrouted-img | libcap2 |
| CVE-2026-48978 | 2427941 | f5-lifecycle-operator | oras.land/oras-go/v2 |
| CVE-2026-49014 | 2325077 | postgresql | gdal |
| CVE-2026-50151 | 2427921 | f5-lifecycle-operator | oras.land/oras-go/v2 |
| CVE-2026-50162 | 2427933 | f5-lifecycle-operator | oras.land/oras-go/v2 |
| CVE-2026-50163 | 2428021 | f5-lifecycle-operator-catalog | oras.land/oras-go/v2 |
| CVE-2026-5260 | 2326157, 2335729, 2335885, 2336041, 2336197, 2336353, 2336537, 2336693, 2336849, 2337013, 2337169 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img | libgnutls30t64 |
| CVE-2026-53488 | 2364377, 2364693 | f5-lifecycle-operator, f5-lifecycle-operator-catalog | github.com/containerd/containerd |
| CVE-2026-5419 | 2326161, 2335733, 2335889, 2336045, 2336201, 2336357, 2336541, 2336697, 2336853, 2337017, 2337173 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img | libgnutls30t64 |
| CVE-2026-5450 | 2325025, 2427853, 2427857 | f5-fluentd, postgresql | glibc, oj |
| CVE-2026-54500 | 2427853 | f5-fluentd | oj |
| CVE-2026-54502 | 2427857 | f5-fluentd | oj |
| CVE-2026-54592 | 2427829 | f5-fluentd | oj |
| CVE-2026-54896 | 2427833 | f5-fluentd | oj |
| CVE-2026-54897 | 2427837 | f5-fluentd | oj |
| CVE-2026-54898 | 2427861 | f5-fluentd | oj |
| CVE-2026-54899 | 2427865 | f5-fluentd | oj |
| CVE-2026-54900 | 2427841 | f5-fluentd | oj |
| CVE-2026-54901 | 2427869 | f5-fluentd | oj |
| CVE-2026-54902 | 2427873 | f5-fluentd | oj |
| CVE-2026-54903 | 2427845 | f5-fluentd | oj |
| CVE-2026-5545 | 2325133, 2325765 | f5-fluentbit, postgresql | curl, libcurl4t64 |
| CVE-2026-56852 | 2426961, 2426977, 2426997, 2427025, 2427041, 2427057, 2427169, 2427213, 2427233, 2427269, 2427289, 2427305, 2427409, 2427449, 2427469, 2427509, 2427513, 2427517, 2427521, 2427525, 2427545, 2427701, 2427801, 2427889, 2427949, 2427969, 2427985, 2428001, 2428009, 2428053, 2428069, 2428085, 2428129, 2428157, 2428173, 2428189, 2428205 | crd-conversion, crd-installer, crdupdater, f5-analyzer, f5-bdosd, f5-bnk-cis, f5-cert-manager-extension, f5-csm-qkview, f5-debug-sidecar, f5-downloader, f5-dwbld, f5-env-discovery, f5-epp, f5-fluentd, f5-fqdn-resolver, f5-ipam-controller, f5-l4p-engine, f5-license-helper, f5-lifecycle-operator, f5-node-labeler, f5-nsec-ips-daemon, f5-toda-assistant, f5-toda-tmstatsd, f5-urlcat, f5dr-img, f5ingress, gslb-probe-agent, init-certmgr, ocnos-img, opentelemetry-collector-contri, spk-csrc, spk-cwc, strongswan | golang.org/x/text |
| CVE-2026-5773 | 2325081, 2325829 | f5-fluentbit, postgresql | curl, libcurl4t64 |
| CVE-2026-58055 | 2428425 | f5-fluentbit | libnghttp2-14 |
| CVE-2026-58469 | 2428373, 2428389, 2428409 | f5-downloader, f5-urlcat, f5ing-tmm-pod-manager | wget |
| CVE-2026-58470 | 2428377, 2428393, 2428413 | f5-downloader, f5-urlcat, f5ing-tmm-pod-manager | wget |
| CVE-2026-58471 | 2428381, 2428397, 2428417 | f5-downloader, f5-urlcat, f5ing-tmm-pod-manager | wget |
| CVE-2026-58472 | 2428385, 2428401, 2428421 | f5-downloader, f5-urlcat, f5ing-tmm-pod-manager | wget |
| CVE-2026-5928 | 2325085 | postgresql | glibc |
| CVE-2026-5958 | 2326173, 2335737, 2335893, 2336049, 2336205, 2336361, 2336545, 2336701, 2336857, 2337021, 2337177 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img | sed |
| CVE-2026-59762 | 2310861 | ||
| CVE-2026-6019 | 2428289, 2428349 | f5-bnk-cis, spk-csrc | libpython3.12-minimal |
| CVE-2026-6042 | 2325693 | vault | musl |
| CVE-2026-6100 | 2428293, 2428353 | f5-bnk-cis, spk-csrc | libpython3.12-minimal |
| CVE-2026-6253 | 2325137, 2325769 | f5-fluentbit, postgresql | curl, libcurl4t64 |
| CVE-2026-6276 | 2325089, 2325833 | f5-fluentbit, postgresql | curl, libcurl4t64 |
| CVE-2026-6429 | 2325141, 2325773 | f5-fluentbit, postgresql | curl, libcurl4t64 |
| CVE-2026-6472 | 2325145, 2325777 | f5-fluentbit, postgresql | libpq5, postgresql |
| CVE-2026-6473 | 2325093, 2325781 | f5-fluentbit, postgresql | libpq5, postgresql |
| CVE-2026-6474 | 2325149, 2325785 | f5-fluentbit, postgresql | libpq5, postgresql |
| CVE-2026-6475 | 2325097, 2325789 | f5-fluentbit, postgresql | libpq5, postgresql |
| CVE-2026-6476 | 2325101, 2325793 | f5-fluentbit, postgresql | libpq5, postgresql |
| CVE-2026-6477 | 2325105, 2325797 | f5-fluentbit, postgresql | libpq5, postgresql |
| CVE-2026-6478 | 2325153, 2325801 | f5-fluentbit, postgresql | libpq5, postgresql |
| CVE-2026-6479 | 2325109, 2325805 | f5-fluentbit, postgresql | libpq5, postgresql |
| CVE-2026-6575 | 2325157, 2325809 | f5-fluentbit, postgresql | libpq5, postgresql |
| CVE-2026-6637 | 2325113, 2325813 | f5-fluentbit, postgresql | libpq5, postgresql |
| CVE-2026-6638 | 2325117, 2325817 | f5-fluentbit, postgresql | libpq5, postgresql |
| CVE-2026-7168 | 2325161, 2325821 | f5-fluentbit, postgresql | curl, libcurl4t64 |
| CVE-2026-7383 | 2335265, 2335565, 2335793, 2335949, 2336105, 2336261, 2336417, 2336601, 2336757, 2336913, 2337077, 2337233, 2337277 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault, vault-init | libcrypto3, libssl3t64 |
| CVE-2026-7774 | 2428297, 2428357 | f5-bnk-cis, spk-csrc | libpython3.12-minimal |
| CVE-2026-8084 | 2325169 | postgresql | gdal |
| CVE-2026-8086 | 2325173 | postgresql | gdal |
| CVE-2026-8087 | 2325177 | postgresql | gdal |
| CVE-2026-8088 | 2325181 | postgresql | gdal |
| CVE-2026-8212 | 2325185 | postgresql | gdal |
| CVE-2026-8213 | 2325189 | postgresql | gdal |
| CVE-2026-8286 | 2364853, 2364889, 2364925, 2364961, 2365017, 2365053 | crd-installer, f5-access-apmd, f5-debug-sidecar, f5-fluentbit, f5ingress, ocnos-img | curl, libcurl4t64 |
| CVE-2026-8328 | 2428301, 2428361 | f5-bnk-cis, spk-csrc | libpython3.12-minimal |
| CVE-2026-8376 | 2365077 | baseos | perl-base |
| CVE-2026-8458 | 2364857, 2364893, 2364929, 2364965, 2365021, 2365057 | crd-installer, f5-access-apmd, f5-debug-sidecar, f5-fluentbit, f5ingress, ocnos-img | curl, libcurl4t64 |
| CVE-2026-8924 | 2364861, 2364897, 2364933, 2364969, 2365025, 2365061 | crd-installer, f5-access-apmd, f5-debug-sidecar, f5-fluentbit, f5ingress, ocnos-img | curl, libcurl4t64 |
| CVE-2026-8925 | 2428429 | f5-fluentbit | libcurl4t64 |
| CVE-2026-8927 | 2364841, 2364877, 2364913, 2364949, 2365005, 2365041 | crd-installer, f5-access-apmd, f5-debug-sidecar, f5-fluentbit, f5ingress, ocnos-img | curl, libcurl4t64 |
| CVE-2026-8932 | 2364865, 2364901, 2364937, 2364973, 2365029, 2365065 | crd-installer, f5-access-apmd, f5-debug-sidecar, f5-fluentbit, f5ingress, ocnos-img | curl, libcurl4t64 |
| CVE-2026-9076 | 2335269, 2335569, 2335797, 2335953, 2336109, 2336265, 2336421, 2336605, 2336761, 2336917, 2337081, 2337237, 2337281 | baseos, f5-bnk-cis, f5-cert-client, f5-dssm-store, f5-dssm-upgrader, f5-fqdn-resolver, f5-ipam-controller, f5-toda-tmstatsd, f5-urlcat, gslb-probe-agent, tmrouted-img, vault, vault-init | libcrypto3, libssl3t64 |
| CVE-2026-9547 | 2364869, 2364905, 2364941, 2364977, 2365033, 2365069 | crd-installer, f5-access-apmd, f5-debug-sidecar, f5-fluentbit, f5ingress, ocnos-img | curl, libcurl4t64 |
| CVE-2026-9669 | 2428305, 2428365 | f5-bnk-cis, spk-csrc | libpython3.12-minimal |
New features¶
Access Control List (ACL) and Network Address Translation (NAT) policy for Virtual Routing and Forwarding (VRF)¶
You can now configure VRF through a Custom Resource Definition (CRD) in F5 BIG-IP Next Cloud-Native Network Function (CNF). Configure ACL firewall policies and carrier-grade NAT (CGNAT) policies to specific VRFs or across multiple VRFs for precise control over traffic flows.
VRF-aware Virtual Local Area Network (VLAN) and Secure Context functionalities now support VRF-aware destination addresses.
For more information, see Virtual Routing and Forwarding with ACL and NAT policy support.
File Transfer Protocol (FTP) profiles in Local Traffic Manager (LTM) load balancing¶
You can now use FTP profiles with LTM load balancing to manage FTP workloads in cloud-native deployments. This provides flexible and scalable options for modernizing FTP-based services.
For more information, see FTP profiles for LTM.
distributed session state management (dSSM) sharding (clustering)¶
dSSM sharding addresses limitations of single-threaded Redis operations. This improves scalability, fault tolerance, and high availability.
For more information, see dSSM Database.
URL classification for Quick UDP Internet Connections (QUIC) traffic over Transport Layer Security (TLS) 1.3¶
Classify traffic for encrypted websites that use TLS 1.3 and Encrypted Client Hello (ECH). This improves filtering and management for internet service providers (ISPs) that handle QUIC traffic.
For more information, see URL Categorization, ECH traffic classification for TLS 1.3, Deep Packet Inspection and F5BigDpiPeOptions
Rate limiting on Load Balancing (LB) virtual servers¶
You can configure rate limits on virtual servers to control traffic flow and protect services from overload.
For more information, see VirtualServer connection rate limiting overview.
Health monitors (TCP-half open, UDP, HTTP, and HTTPS)¶
Run health checks at the protocol layer — including TCP-half open, UDP, HTTP, and HTTPS — to detect faults and improve availability for pool members. These health monitors support pool members both inside and outside the Kubernetes cluster.
For more information, see Configure pool health monitors.
IPSec StrongSwan Integration¶
IPsec operations now use StrongSwan instead of Racoon, which improves security and reliability.
For more information, see Internet Protocol Security.
Edge firewall with Fully Qualified Domain Name (FQDN) support¶
Create dynamic ACL rules based on domain names to simplify firewall management. Rules update automatically when domain name resolutions change.
For more information, see FQDN support for Edge Firewall ACL rules and lists.
Dynamic DoS Signatures¶
Enhances anomaly detection and scalability with automated DDoS mitigation across multiple pods and servers.
For more information, see DDoS dynamic signatures.
Bottleneck Bandwidth and Round-trip propagation time version 2 (BBRv2) congestion control for TCP profile¶
BBRv2 congestion control improves TCP performance when the network is congested, packets are lost, or latency is high. It balances traffic more evenly, which improves network efficiency and creates a better experience for users.
For more information, see F5BigTcpSetting.
Global Server Load Balancing (GSLB) topology load balancing¶
Distribute traffic across geographical server locations using topology-aware load balancing. Supported methods include:
Round robin
Ratio-based load balancing
Global availability
Health monitors support HTTP, HTTPS, Internet Control Message Protocol (ICMP), TCP, UDP, and TCP-half-open protocols. These monitors check server health and performance, enabling precise and reliable traffic management across diverse network environments.
Limited availability and early access¶
Multiprotocol Label Switching (MPLS) support¶
CNF operates as a provider edge (PE) router to support MPLS in Border Gateway Protocol - Labeled Unicast (BGP-LU) mode. This enables efficient label-switched routing for dynamic environments.
CNF handles MPLS virtual private network (VPN) labels (inner) and transport labels (outer) to forward packets across the network. You can apply security policies — such as ACL, CGNAT, and DDoS mitigation — based on VPN labels to protect traffic at multiple layers.
CNF also uses CGNAT to handle overlapping addresses in MPLS traffic. In this release, CNF can re-encapsulate packets with MPLS labels after applying security policies, so traffic can reach the destination network.
Helm-chart and custom-resource schema changes¶
(No schema changes)
Fixed issues¶
> List of fixed issues.
2349797-5¶
Custom analyzer plugin fails with “Invalid request schema” when dynamicCapacityReduction is configured in F5BigAnalyzer CR
Component: analyzer
Symptoms: When using a custom Python analyzer plugin with BNK v2.3.x, every analyzer cycle fails with "status": "error", "message": "Invalid request schema".
The analyzer pod logs show the payload is rejected before the plugin logic executes. As a result, weight annotations are removed from L4Route and HTTPRoute CRs on every cycle, and traffic reverts to default round-robin instead of the intended weighted distribution.
Conditions: Occurs when:
BNK v2.3.x is deployed with Intelligent AI Load Balancing enabled (intelligentLB: enabled: true in CNEInstance CR).
An F5BigAnalyzer CR of type “custom” is configured referencing ConfigMap-based Python plugin.
dynamicCapacityReduction is present in the F5BigAnalyzer CR spec (the issue occurs regardless of enabled: true or enabled: false).
The custom plugin uses PLUGIN_REQUEST_SCHEMA with “additionalProperties”: False — as shown in the official reference implementation (custom_plugins/custom_plugin.py) and in CloudDocs.
Impact: Custom analyzer plugin execution fails on every cycle. Weight calculation logic never runs. L4Route and HTTPRoute weight annotations are removed, reverting traffic to default round-robin. Dynamic AI load balancing is completely non-functional for all custom plugin deployments on BNK v2.3.x when dynamicCapacityReduction is present in the CR.
Workaround: In the custom plugin ConfigMap, change "additionalProperties": False to "additionalProperties": Truein PLUGIN_REQUEST_SCHEMA. This allows the plugin to accept unknown fields without failing validation. The dynamic_capacity_reduction field will be silently ignored if the plugin does not use it.
After updating the ConfigMap, restart the analyzer pod:
kubectl rollout restart deployment/f5-analyzer -n f5-bnk
2449625-3¶
On restart, TMM reserves NAT IP ranges used by another active TMM
Component: CGNAT
Symptoms: After restart, the newly started TMM Pod may reserve NAT IP ranges already owned by another active TMM Pod, causing duplicate NAT IP range assignments across Pods.
Conditions: Occurs when:
Deployment consists of more than 10 TMM Pods.
Deployment is configured with source translation (NAT) objects.
A TMM Pod with a higher-indexed device name (e.g.,
DP-1) is restarted.
Impact: Traffic disruption caused by two TMM pods holding overlapping NAT IP ranges.
Fix Text: Fixed the NAT IP reservation logic to assign each TMM Pod a unique, non-overlapping NAT IP range after restarts or scale-ups.
2318785-1¶
Missing log fields in NAT transaction event logs
Component: cnf_future
Symptoms: The logs generated for NAT translation events do not include bigip_hostname and management_ip_address fields.
Conditions: Occurs when:
Configure AFM NAT policy, Log profile and attach it to secure context.
Send traffic to match AFM NAT policy rules and execute NAT translations.
Impact: There is no functional impact. Logs generated to track NAT translations does not have the fields - bigip_hostname & management_ip_address
Fix Text: Fixed NAT translation event logs to generate ‘bigip_hostname’ and ‘management_ip_address’ fields.
2345657-1¶
DNS virtual server unresponsive after VLAN is delete and recreate in F5BigDnsApp
Component: dns
Symptoms: Deleting and recreating the F5BigNetVlan CR referenced by F5BigDnsApp causes the DNS virtual server to stop forwarding traffic.
Conditions: Occurs when:
F5BigDnsApp CR is configured with a VLAN referenced in spec.vlans.vlanList
The referenced F5BigNetVlan CR is deleted
The same F5BigNetVlan CR is recreated
Impact: The DNS virtual server stops forwarding traffic until you manually reapply the F5BigDnsApp CR.
Workaround: After you recreate the VLAN, delete and reapply the F5BigDnsApp CR.
Fix Text: Fixed the F5BigDnsApp reconciliation logic for changes to a referenced F5BigNetVlan CR. Now the DNS Virtual Server automatically resumes forwarding traffic when you delete and recreate the referenced VLAN, without requiring you to reapply the F5BigDnsApp CR.
2433669-3¶
DNS cache is not created when a local zone record contains double quotes
Component: dns-cache
Symptoms: The DNS cache is not created when a local zone record contains a value with double quotes, such as a TXT record.
Conditions: A local zone contains a record whose data includes double quotes.
Impact: The DNS cache creation fails, and the affected local zone records are not available through the DNS cache.
Workaround: Until the system is upgraded, avoid using double quotes in local zone record data.
Fix Text: The system now correctly escapes double quotes in local zone record data when creating the DNS cache.
2338109-5¶
Upgrade unbound to version 1.25.1
Component: dns-cache
Symptoms: Upgrade unbound to version 1.25.1 to include latest fixes.
Condition: BNK/CNF was using unbound version 1.23.1
Impact: Upgrade unbound to version 1.25.1 to include the latest fixes
Fix Text: Upgrade to version 1.25.1 to include latest fixes.
2289817-4¶
Erroneous TXQ Full Health Check Marks Interface Down, Causing TMM Pod Connectivity Loss
Component: Drivers
Symptoms: TMM fails with errors:
“Error: Set unhealthy status flag because txq has been full for
<####>seconds”“Error: Marking down interface because unhealthy flag set to true.”
Conditions: Occurs when:
TMM handles traffic but one or more dataplane interfaces expose fewer device queues than available threads.
Multiple TMM threads share a single device queue, increasing the likelihood the NIC struggles to handle traffic on the TX path.
Temporary rise in blocked counters can trigger the internal TXQ health check.
Impact: Loss of data-plane connectivity as interfaces are marked down.
Workaround: You can:
Disable txq healthcheck by setting the timeout to 0.
In your TMM deployment, add a new configmap or a host file with the following content: ndal tx_dq_timeout_sec 0
This configmap or host-file should appear within the TMM container as “/opt/lib/tmm/tmm_init.tcl.pre”.
Fix Text: Update the health check to correctly handle wrap-arounds of the “sent” counter.
2295357-4¶
Generalized driver override support through the TMM Helm chart
Component: Drivers
Symptoms: To override a network driver, you must manually create a ConfigMap for xnet_init.tcl and modify the TMM deployment with the appropriate volumeMounts to mount this ConfigMap as the /config/xnet_init.tcl file in the TMM container.
Conditions: The deployment requires network driver overrides that you specify through the xnet_init.tcl ConfigMap.
Impact: This request for enhancement (RFE) improves an existing feature to simplify usage and provide generalized support.
Fix Text: Set the xnetInit property in your values.yaml file to enable TMM network driver overrides:
tmm:
xnetInit:
enabled: true
content: |
# Intel E810
device driver vendor_dev 8086:1889 dpdk
# Intel X710/XXV710/XL710
device driver vendor_dev 8086:154c iavf
2456133-1¶
DPDK: ndal_dev_status does not reflect status if the virtual function is not bound to the driver
Component: Drivers
Symptoms: After you remove a DPDK Virtual Function (VF) from its driver, the ndal_dev_status table still reports if_up and link_up as y, even though the device is no longer operational.
Conditions: The virtual function is removed from its PCI driver while the TMM pod is running, using a DPDK Mellanox network device.
Impact: The ndal_dev_status table reports stale link status (if_up: y, link_up: y) for a virtual function that is no longer bound to its driver, preventing accurate monitoring and diagnostics of network device state.
Fix Text: Added asynchronous device-removal monitoring in the DPDK xnet layer. Registered ports are periodically checked via DPDK alarm callbacks outside the dpdk_get_link_state() path, setting a per-port removed flag when removal is detected. dpdk_get_link_state() checks that flag before returning cached link information, so ndal_dev_status reports the VF as down after driver unbind without placing the removal check on the hot status path.
2460469-1¶
BGP/BFD fails when SR-IOV VF is in host namespace due to mlx5_core driver bind race
Component: Drivers
Symptoms: BGP/BFD sessions never established caused because bonded interface was not created. The bonded interface is not created because the 2nd virtual function is suddenly unbound by CNI plugin.
Conditions: The virtual function is unbound from its PCI driver while the TMM pod is running, using a DPDK Mellanox network device.
Impact: BGP and BFD sessions fail to establish because the TMM data plane interface backed by the affected VF is not operational. ndal_dev_status may continue reporting the interface as up, masking the underlying failure.
Workaround: Restarting the TMM pod may resolve the issue if the VF bind race does not recur.
Fix Text: Added asynchronous device-removal monitoring in the DPDK xnet driver. Registered ports are periodically checked via DPDK alarm callbacks outside the dpdk_get_link_state() path, setting a per-port removed flag when removal is detected. dpdk_get_link_state() checks that flag before returning cached link information, so ndal_dev_status correctly reports the VF as down.
2368565-5¶
TMM connects to read-only DB causing NAT operation failures
Component: dssm
Symptoms: After restart, TMM re-established its connection to the DSSM database pod but connected to the replica instead of the primary. This misconnection caused session APIs to fail, which in turn caused configured NAT operations to fail.
Conditions: TMM should be connected to sentinel-based Redis connection with NAT traffic enabled.
Impact: Because the TMM is connected to READONLY DB, the data sent to Redis DB will not be saved.
Fix Text: Fixed code to perform a Redis DB role check after establishing the connection.
2447705-1¶
Crashagent or Qkview-Collect exit causes F5-DSSM container to terminate and enter CrashLoopBackOff
Component: dssm
Symptoms: The DSSM container terminates whenever the crashagent or qkview-collect process exits because the s6 service finish scripts configured for these processes trigger a full container shutdown upon their exit.
Conditions: DSSM container with s6 service enabled for crashagent and qkview collector.
Impact: The DSSM pod goes into CrashLoopBackOff and will restart.
Fix Text: Removed the s6 finish scripts for both crashagent and qkview-collect, as basOS now handles their lifecycle management.
2368573-5¶
Lua script returns user-script errors when handling large arrays
Component: dssm
Symptoms: Scripts assume ARGV[] fields and Redis LINDEX/LRANGE results are always non-nil numeric strings, and raise a Lua runtime error when that assumption is violated.
Conditions: Lua scripts in Redis perform set and incr_if operations on long array data.
Impact: Script errors prevent Redis from storing the data.
Fix Text: Fixed missing string-to-number conversions in the Lua scripts wherever needed to handle non-nil numeric strings.
2456769-4¶
Gradual increase in TMM memory usage
Component: Firewall (ACL)
Symptoms: TMM memory usage shows gradual increases and does not go down when traffic stops. Memory usage for ACL allocation type shows the growth.
Conditions: CNF Deployment with Firewall policy containing “Drop” action rules.
Impact: Traffic disruption after TMM memory reaches threshold level.
Workaround: Disable hardware offloading of Firewall rules in Global Option CR.
Fix Text: Do not initiate Hardware offload for non DPU deployments.
2399969-5¶
DSSM pod performance degradation with multiple pool members down
Component: fsm
Symptoms: When you create a pool with a pool member and a monitor, every TMM in a TMM pod sends status updates to the DSSM each time the pool member’s state changes. This behavior can degrade performance, especially when many TMM pods contain multiple TMMs, causing the problem to scale rapidly.
Impact: Multiple TMM pods and TMMs writing to DSSM at the same time can create performance bottlenecks in the DSSM pod.
Workaround: Increase the CPU allocation for the DSSM pod to prevent write operations from overloading it. Alternatively, reduce the number of TMM threads, TMM pods, or both.
Fix Text: Fixed the DSSM limits. DSSM now writes to a single TMM in a given TMM pod instead of writing to all TMMs.
2330525-1¶
ICMP monitor prematurely marks pool member down before probe timeout
Component: fsm
Symptoms: The ICMP monitor marks pool members as DOWN earlier than the configured thresholds allow. When the interval and timeout are both set to 5 seconds with the default down-count of 3, the monitor should keep a pool member UP until it misses three consecutive probes, with each probe timing out after 5 seconds — totaling 15 seconds from the first missed reply. Instead, the monitor marks the member DOWN after approximately 13 seconds.
Additionally, after marking the member DOWN, the monitor sends probes at irregular intervals. Probes that should arrive every 5 seconds instead arrive inconsistently, sometimes 2 or more seconds late.
Conditions: If the virtual server has an ICMP monitor.
Impact: The ICMP monitor incorrectly marks pool members as DOWN sooner than the configured settings intend, specifically when the interval equals the timeout. This premature health-check failure causes unnecessary traffic disruption, particularly in environments that expect brief network delays and configure the timeout to tolerate them.
Fix Text: The ICMP monitor now derives its internal idle timeout from the configured Interval and Timeout settings instead of using a fixed short internal value. This eliminates the internal timing mismatch that previously caused the monitor to mark pool members as DOWN prematurely. The monitor now waits for the full configured timeout period before marking a pool member as DOWN, honoring the down-count and interval/timeout settings as expected.
2330521-1¶
CNF Qkview API omits TMM-pod containers when custom TMM pod or App name causes mTLS x509 SAN mismatch
Component: fsm-config
Symptoms: Occurs when:
CNF TMM pod is deployed with a custom (non-default) pod/app name (any name other than the default f5-tmm).
The qkview API is invoked to collect diagnostic data from TMM-pod containers.
mTLS gRPC is used between the qkview orchestrator and TMM containers
Conditions: When the TMM pod uses a custom pod or app name, the CNF Qkview API fails to collect data from TMM-pod containers. The Qkview orchestrator derives the mTLS ServerName from the custom pod or app label, but the TMM server certificate’s SAN always resolves to f5-tmm.
rpc error: code = Unavailable desc = connection error: desc = "transport: authentication
handshake failed: x509: certificate is valid for f5-tmm.<namespace>, not <custom-name>.<namespace>"
As a result, the Qkview output excludes all affected TMM-pod containers.
Impact: CNF 2.2.1: The Qkview API collects only 4 out of 24 TMM containers. Only f5-toda-tmstats succeeds because its endpoint resolves to a service-name SAN rather than the custom pod name. CNF 1.4.0: The Qkview API fails to collect all 24 TMM containers because both the pod and main container use custom names. Additionally, manifest.json falsely reports “completion_status”: “complete” even though the API never writes the TMM sub-packages to disk.
Fix Text: The fix adds another dns name to all the places in certs file where before there was only hardcoded “f5-tmm” default. Now there is still “f5-tmm” hardcoded dns name and there is an added templated { include “tmm.appName” } which will pull in a custom non “f5-tmm” name and process it correctly.
2220989-2¶
BGP may not immediately update routes after route-map changes
Component: fsm-dynamic-routing
Symptoms: If you use a route-map to filter BGP advertisements, modifying the route-map in a way that affects the filtered routes does not trigger updates to those routes.
Conditions: Occurs while using BGP with a route-map filtering advertisements.
Impact: BGP table may not reflect route-map changes until “clear ip bgp
Workaround: Run “clear ip bgp
2389165-5¶
IMI memory leak on every ‘show running-config’ execution
Component: fsm-dynamic-routing
Symptoms: The management/control-plane (imish) process gradually increases its memory usage over time and fails to reclaim it, which can degrade performance or trigger process restarts during prolonged or heavy CLI usage.
Conditions: Issue occurs by repeatedly viewing configuration contexts in the imish CLI — for example, by repeatedly running “show running-config.”
Impact: Each affected operation leaks a small memory block from the internal configuration tree. With frequent CLI or automation polling, long-running sessions, or scripted “show running-config” calls, memory in the imi process grows steadily, increasing memory pressure and potentially triggering an unexpected process restart on the device.
Fix TextFixed a memory leak in the imi configuration module by releasing the internal patricia-tree structure allocated for each configuration mode when the mode is freed. The updated cleanup path now properly frees this structure, preventing leaks during repeated “show running-config” and related config-mode operations.
2440693-4¶
Stale NAT kernel routes remain after routing container restart
Component: fsm-dynamic-routing
Symptoms: A routing container restart can leave stale NAT kernel routes when the system updates NAT policy mid-restart (for example, during an OOM-triggered restart).
Conditions: Occurs when:
The routing container is restarted.
The NAT policy addresses are modified.
Impact: A stale route is invalid or could cause cross-pod BGP route advertisements.
Workaround: Restart the entire Pod, or just tmrouted container.
Fix Text: During reinitialization of the routing daemon, a full load sync of routes will occur.
2359009-4¶
While using bdt_cli incorrect routeECMP routes are displayed
Component: fsm-dynamic-routing
Symptoms: The bdt_cli route command may not properly display Equal-Cost Multi-Path (ECMP) routes learned from BGP in Cloud-Native Network Function (CNF) environments.
Conditions: Display ECMP routes using ‘bdt_cli route’ command.
Impact: Incorrect output.
Fix Text: The bdt_cli route command now correctly displays ECMP nexthops in CNF environments.
2358997-4¶
After BGP routing re-convergence ECMP routes can be incorrect
Component: fsm-dynamic-routing
Symptoms: In CNF environments, Equal-Cost Multi-Path (ECMP) routes learned from BGP may not be properly installed after routing changes or BGP session resets. This can result in:
Missing next-hop gateways in multi-path routes.
Incorrect number of paths displayed for ECMP routes.
Incomplete routing information on some pods.
Conditions: Occurs when,
BGP routes are updated during network convergence events.
Multipath ECMP routes are in use.
Impact: Incorrect ECMP routes cause traffic loss.
Fix Text: Fixed ECMP nexthops to install correctly when routes change.
1929045-12¶
TMM may core after HTTP::respond is used for the first request on iSession connection
Component: fsm-hudfilters
Symptoms: TMM crashes while establishing an iSession tunnel
Conditions: Occurs when:
APM is configured
Tunnel is being established
Impact: Traffic disrupted while TMM restarts
Fix Text: When the tunnel is negotiated, BIG-IP prepares the connection for a graceful transition to the appropriate state, and TMM no longer crashes with the identified conditions.
2460921-1¶
Malformed tmctl --csv output from embedded commas in text columns
Component: fsm-libtmstat
Symptoms: Malformed Tmctl –csv outputs due to data within the table containing columns that are comma separated.
For example, when printing the table without the csv option: /tmctl -d blade tmm/xnet/device_probed id available_drivers driver_selected driver_in_use
xeth0 sock, dpdk, sock Yes 0000:d8:0e.2 sock, dpdk, dpdk Yes 0000:d8:13.7 sock, dpdk, dpdk Yes
/tmctl -d blade tmm/xnet/device_probed –csv id,available_drivers,driver_selected,driver_in_use xeth0,sock, dpdk, ,sock,Yes 0000:d8:0e.2,sock, dpdk, ,dpdk,Yes 0000:d8:13.7,sock, dpdk, ,dpdk,Yes
Due to the available_drivers being comma separated, there are double commas that causes the csv issue.
Conditions: Running the tmctl command with the --csv or -c flag on a table that contains comma-separated values in a column produces malformed output.
Impact: Output of tmstat table columns are malformed when using –csv option.
Fix Text: Wrap comma-separated strings in tmctl --csv output in double quotes (e.g., “val1, val2”) to follow the CSV format.
root@tmm-gcalvert-20260820-203915-8:/config# tmctl -d blade -i tmm/xnet/device_probed –csv id,available_drivers,driver_selected,driver_in_use xeth0,”sock, “,sock,Yes 0000:b1:11.3,”dpdk_mlnx, dpdk, iavf, “,dpdk,Yes 0000:b1:12.3,”dpdk_mlnx, dpdk, iavf, “,dpdk,Yes 0000:b1:14.0,”dpdk_mlnx, dpdk, iavf, “,dpdk,Yes
2224957-4¶
IPFix Templates not retransmitted at configured periodic intervals
Component: HSL
Symptoms: When using HSL Publisher with IPFix Format destination, IPFix Template information is not being retransmitted. For every new UDP socket connection established to log server, a single HSL template is transmitted once for a session, but never retransmitted.
Conditions: When using IPFix Format destination for HSL log publisher, the log collector may not receive continuous updates of IPFix Template information at configured intervals (default being 30 seconds).
Impact: Log collector will not receive IPFIX Template updates at configured intervals.
Fix Text: After the fix, the conditions under IPFIX template is transferred are listed below for UDP.
No template transmission will happen on idle logging scenario.
On every new UDP socket connect to log collector from Tmm, template is transferred to log server at the beginning. Under no logging activity, UDP socket may get closed & only when new socket is opened again on logging activity, the Templates are transmitted again.
When logs are continously generated to a IPFix destination, IPFix Tempaltes are transmitted during log data transmission at the configured periodic interval.
2311589-3¶
TMM pod fails to delete when using a non-default tmm.name in values override
Component: ingress
Symptoms: TMM pod is not deleted when TMM’s main container terminates.
Conditions: Non-default tmm.name value is passed in the values overrides file (default is f5-tmm).
Impact: Configuration de-sync may occur, and the controller may not configure TMM correctly.
Fix Text: Non-default values can now be passed to tmm.name in values override. When TMM main container terminates deletion of TMM pod will occur correctly. Post helm install editing of deployment is still un-supported.
2288497-4¶
CR status falsely reports success when F5-TMM fails to apply configuration
Component: ingress
Symptoms: The F5 Ingress Controller marks the CR status READY=true and reports “CR config sent to all grpc endpoints” even when F5-TMM fails to receive or apply the configuration. This behavior creates a false positive because the controller only confirms that it completed the gRPC send without transport-level errors and does not verify that F5-TMM applied the configuration internally.
Conditions: This can occur when:
An f5-tmm pod is evicted/rescheduled (during node draining) while configuration is in-flight, causing partial delivery when the connection is re-established.
A transient network interruption occurs while an f5-tmm pod is restarting, resulting in some objects being delivered before the interruption and others after, leaving f5-tmm with a partial configuration set.
f5-tmm receives the gRPC message without a transport error but fails to apply the configuration internally (due to a transient internal error or state inconsistency), most frequently observed in clusters with a large number of f5-tmm replicas.
Impact: Configuration expected to be present on f5-tmm may be missing or partially applied, while the Kubernetes CR status continues to report success. This can result in traffic-affecting misconfiguration (e.g., missing Snatpool, virtual server, or pool objects) with no indication that remediation is required.
Workaround: Restart F5ingress. If issues persist after the f5ingress pod restart, the restart removes the missing configuration and forces f5ingress to send a new configuration.
2277713-2¶
Unable to delete the SNATPool Custom Resource (CR) that was not created f5-cne-controller namespace
Component: ingress
Symptoms: The f5-cne-controller watches and processes SNATPool Custom Resources (CRs) within its own namespace, only. SNATPool CRs created in other namespaces are ignored by the controller, and attempts to delete them will fail due to a validation webhook error.
Conditions: F5-cne-controller installed using FLO and SNATPool Custom Resources (CRs) created in a namespace other than f5-cne-controller.
Impact: SNATPool Custom Resources (CRs) cannot be deleted.
Workaround: Follow the steps in sequence:
Create SNATPool Custom Resources (CRs) with same name in the f5-cne-controller namespace.
Delete non f5-cne-controller namespace CR.
Delete f5-cne-controller namespace CR.
Fix Text: Updated the ValidatingWebhookConfiguration resource to optimize behavior when wholeClusterMode is enabled. In this mode, the validating webhook validates only snatpool CR objects in the controller namespace and no longer intercepts requests for snatpool CRs in other namespaces. As a result, the webhook no longer restricts deleting snatpool CRs in non-controller namespaces.
2349689-1¶
Unable to recover Gateway CR after configuring with invalid TLS secret for Client-Side TLS
Component: ingress
Symptoms: The gateway.networking.k8s.io/v1 CR becomes non-functional if updated with invalid TLS certificates. Even after reverting the CR to reference valid certificates, it fails to recover.
Conditions: Occurs when:
Initial configuration with valid certificates: Apply Gateway CR with a valid secret. Running curl https:// succeeds.
Update with invalid certificates: Modify the Gateway CR to reference an invalid or corrupt secret. Running curl https:// fails as expected.
Revert to valid certificates: Update Gateway CR to reference back the valid secret. curl https:// continues to fail despite using correct and valid certificates.
The issue could also occur if you start out with an invalid certificate.
Impact: Ingress functionality for client-side TLS configured via Gateway CR is disrupted. The use case remains non-operational even when valid certificates are reapplied.
workaround: To resolve the issue, delete the affected Gateway CR and recreate it.
Fix Text: Validation has been implemented in the Control Plane to ensure that referenced secrets contain valid certificates. The CP now rejects CRs with invalid certificates or keys, providing appropriate error statuses when invalid configurations are attempted.
2339177-1¶
F5SPKVlan and F5BnkGateway resources stuck in Terminating state after foreground deletion
Component: ingress
Symptoms: When you delete an F5SPKVlan or F5BnkGateway custom resource using Kubernetes foreground deletion, the resource can get stuck in the Terminating state. The controller completes the dataplane cleanup but then tries to add the Kubernetes foregroundDeletion finalizer to the resource. Kubernetes rejects this update with the following error:
"metadata.finalizers: Forbidden: no new finalizers can be added if the object is being deleted"
Because the controller does not remove its own finalizer, Kubernetes cannot complete the deletion.
Conditions: This issue occurs when you delete an F5SPKVlan or F5BnkGateway custom resource that contains the controller-managed finalizer using Kubernetes foreground deletion. For example:
kubectl delete f5-spk-vlan <name> -n <namespace> --cascade=foreground
Impact: Kubernetes rejects the controller’s finalizer update with a metadata.finalizers: Forbidden error because it does not allow new finalizers on an object that is already being deleted. Even though the controller may complete the dataplane cleanup, it does not remove its own finalizer. This causes the F5SPKVlan or F5BnkGateway resource to remain stuck in the Terminating state. Kubernetes does not garbage-collect the resource, and applications such as Argo CD cannot recreate a resource with the same name until you remove the stuck finalizer.
Workaround: The fix checks whether the custom resource has a deletion timestamp because Kubernetes does not allow new finalizers after deletion starts. When a resource enters the delete path, the shared finalizer helper removes both the controller-owned finalizer and the Kubernetes foregroundDeletion (FinalizerDeleteDependents) finalizer from the calculated finalizer list, then returns a delete operation. This ensures the finalizer update only removes finalizers and prevents Kubernetes from rejecting the update with a metadata.finalizers: Forbidden error. As a result, F5SPKVlan and F5BnkGateway resources no longer get stuck in the Terminating state.
2313345-4¶
F5-license-proxy Helm chart fails to deploy with CSI-based storage provisioners or OpenShift restricted security constraints
Component: License Proxy
Symptoms: When you deploy the f5-license-proxy (FLP) Helm chart in an environment that uses a CSI-based dynamic storage provisioner or in an OpenShift cluster with restricted Security Context Constraints (SCC), the following issues occur:
On OpenShift with a restricted SCC, the IPC_LOCK capability prevents vault and vault-init pods from scheduling.
Selector.matchLabels defined in the chart prevent CSI dynamic provisioners from binding volumes, leaving PVCs stuck in Pending.
The chart sets
storageClassName: standardin all PVs and PVCs, preventing use of a custom storage class.The chart always creates three hostPath PersistentVolumes with no option to disable them.
If you upgrade the chart and change
volumes.vaultDataDir, Kubernetes returns an immutability error.
Conditions: Occurs when:
f5-license-proxy Helm chart versions earlier than 1.29.0-0.10.40 is deployed with
a Kubernetes cluster that uses a CSI-based dynamic storage provisioner (such as EBS CSI or any non-hostPath provisioner), and/or
an OpenShift cluster that enforces the restricted or restricted-v2 SCC.
Attempted to upgrade the chart while changing the volumes.vaultDataDir value.
Impact: Environments that use CSI-based storage or enforce OpenShift’s restricted SCC prevent deploying FLP, blocking installations entirely.
Fix Text: Fixed these issues in f5-license-proxy Helm chart (1.29.0-0.10.40)
Added storage.createPV flag (default: true) to control rendering of the three static hostPath PersistentVolumes. Set this to false to skip PV creation in CSI-based environments.
Exposed storage.storageClassName (default: “standard”) and apply it uniformly to all PVs and PVCs, allowing you to specify your cluster’s storage class.
Added optional OpenShift Route support. A new flp-route.yaml template can create a Route with passthrough TLS termination (route.enabled: false by default). The Route host must match a SAN in the FLP server TLS certificate (set via FLP_HOST in setup.sh).
Removed IPC_LOCK from the vault and vault-init container securityContexts. Because disable_mlock = true is already set in vault.hcl, this capability was unnecessary and prevented scheduling under OpenShift’s restricted SCC. All containers now drop all capabilities.
Render selector.matchLabels on all three PVCs only when storage.createPV: true. Omit selectors with CSI provisioners so dynamic provisioning works correctly. Upgrade note: The immutable PV spec issue during upgrades remains an operational constraint. Chart upgrades are not supported; reinstall the chart when changing versions.
2284341-8¶
PEM Gx Session Bin Entry Stay Even After PEM Session Deletion
Component: PEM_Diameter
Symptoms: Gx sessions remain even after the deletion of PEM sessions. The memory allocated to Gx sessions remains intact. As more PEM sessions are created and deleted, the memory for Gx sessions continues to grow and is not released.
Conditions: This is a rare timing-based scenario in which the diam_app is busy sending requests to a non-responsive PCRF. As a result, the middleware (MW) message bus becomes full. When this happens, the notification from SPM to Gx to end the Gx session is dropped because the MW bus has reached its capacity.
Impact: A slight increase in memory due to Gx sessions persisting even after PEM session deletion may lead to consequences over time, such as memory shortages.
Fix Text: Measures were implemented to ensure the deletion of the Gx session if the PCRF is unresponsive and a Gx session cannot be established with it.
2229893-10¶
PEM mw_bus is missing stats in production builds
Component: PEM_General
Symptoms: Middleware runtime statistics are unavailable in production builds because middleware tmstat instrumentation is only enabled in debug builds.
Conditions: Running a production (non-debug) TMM build and attempting to inspect middleware runtime statistics for troubleshooting or post-incident analysis.
Impact: Reduced diagnosability for engineering and support teams. No impact on traffic handling or feature functionality.
Fix Text: Middleware tmstat instrumentation is now enabled in production builds, providing access to middleware runtime statistics for troubleshooting and post-incident analysis while preserving existing functionality
2368509-7¶
Coremond may write core files to ‘unknown’ when pod or container names mismatch
Component: toda_coremond
Symptoms: Renaming a pod causes coremond to write the pod’s core files under /var/cores/<node>/unknown/ instead of the expected namespace directory because the configuration file mis-maps the pod and container names. This is a known issue in CNF 2.2.0. In CNF 2.3.0 and later, coremond no longer uses that configuration file, so the issue does not occur.
Conditions: This occurs when the pod name or Helm release name differs from the actual container name and the configuration file cannot accurately map the renamed pod name and the container name.
Impact: The core files generated by a pod are written under /var/cores/<node>/unknown/ instead of the expected namespace directory.
Workaround: You can customize the configuration file to explicitly provide the process-to-container mapping, for example:
pods:
l1s6svcgtm:
containers:
tmm.0: f5-tmm
Fix Text: Customize the configuration file to explicitly provide the process-to-container mapping, for example:
pods:
l1s6svcgtm:
containers:
tmm.0: f5-tmm
2289845-5¶
Resource limits set in Helm charts
Component: toda_fluentd
Symptoms: In release 2.2.0, installers had to manually configure resource limits for the Fluent Bit sidecar in f5-downloader and f5-toda-fluentd pods. The cluster enforces the rq-f5-cor-cgn ResourceQuota, which requires explicit CPU and memory limits for all containers.
Conditions: Unable to deploy f5-downloader and f5-toda-fluentd pods in Kubernetes because required resources were missing: the fluentbit sidecar container definition in f5-downloader and the fix-perms and fix-home-perms init container definitions in f5-toda-fluentd.
Impact: Pod creation failed with quota errors.
Fix Text: Starting with 2.2.x, the Helm charts configure CPU and memory limits by default (including for f5-downloader’s Fluent Bit sidecar and f5-toda-fluentd init containers), removing the need for manual settings.
2292021-5¶
Automated cleanup of orphaned log folders fully supported
Component: toda_fluentd
Symptoms: CNF 2.2.0 introduced the Automated Orphaned Log Folder Cleanup feature as an optional capability and documented it in the release notes. Initially, installation and upgrade workflows did not seamlessly support this feature.
Conditions: Helm chart for f5-toda-fluentd did not by default expose an env: or extraEnvVars: array in values.yaml to allow users to pass custom environment variables (such as those controlling the Folder Cleaner behavior) while installing/upgrade.
Impact: To support this feature, users needed to update the deployment’s environment variables after installation or upgrade.
Fix Text: Updated Fluentd helm charts to support the feature by default from release 2.2.x
Known Issues¶
> List of known issues.
2290393-2¶
Ingress FW rules fail for hairpin traffic across zones
Component: AFM
Symptoms: Ingress firewall rules fail for hairpin traffic when the app pod and TMM pod are in different zones.
Conditions: Applies only to hairpinned traffic.
Impact: In the IBM setup, when app pod A in Zone 1 sends traffic to TMM B in Zone 2, the local TMM A SNATs the packet’s source IP. This IP change prevents the ingress firewall rule on the remote TMM B from matching and filtering the packet.
Workaround: Apply the same firewall rule on TMM A egress instead of on TMM B ingress.
2484001-1¶
cert-manager fails to auto-recover and create a certificate after you fix ClusterIssuer and delete the TLS secret
Component: Cert-Mgr
Symptoms: After you correct an invalid ClusterIssuer and delete the TLS secret, cert-manager does not immediately create a new certificate and does not generate a new Order, which appears to prevent auto-recovery.
Conditions: An invalid ACME directory URL causes the certificate authority (CA) to reject the order and places cert-manager into exponential backoff (1–32 hours). The operator fixes the issuer, deletes the TLS secret and stale resources, and checks during the active backoff window.
Impact: This issue causes no permanent impact — cert-manager issues the certificate automatically once the backoff period elapses. If you delete the TLS secret during the backoff period, you may experience a temporary gap in certificate availability.
Workaround: cert-manager does not retry until the in-memory backoff period elapses, even after you fix the issuer and delete the TLS secret and stale CertificateRequest, Order, and Challenge resources. Once the backoff period elapses, cert-manager automatically recreates the CertificateRequest → Order → Challenge chain and issues the certificate.
To force immediate re-issuance (optional), use one of the following methods:
Run cmctl renew (if cmctl is installed):
cmctl renew <cert-name> -n <namespace>
Patch the Certificate status to set Issuing=True with reason RenewalRequested:
kubectl patch certificate <cert-name> -n <namespace> \
--subresource=status \
--type='merge' \
-p '{
"status": {
"conditions": [
{
"type": "Issuing",
"status": "True",
"reason": "RenewalRequested",
"message": "Manually triggered issuance of Certificate",
"lastTransitionTime": "'$(date -u +'%Y-%m-%dT%H:%M:%SZ')'"
}
]
}
}'
Rollout-restart the cert-manager pods to clear the in-memory backoff timers.
Delete and recreate the issuer and certificate with a valid configuration.
2457281-1¶
DNS behavior change: Aggressively scrubbing authoritative and additional sections to prevent cache poisoning
Component: dns-cache
Symptoms: After you upgrade the unbound version to 1.25.1 in this release, network diagnostics such as dig or nslookup on downstream clients may show that the AUTHORITY and ADDITIONAL sections of certain DNS responses are empty or significantly reduced compared to previous software versions.
Conditions: This behavior activates automatically when the upstream DNS server runs Unbound version 1.24.1 or later.
Impact: :* Security impact:: Greatly improved. The network now fully protects against a major security vulnerability (CVE-2025-11411). The underlying Unbound engine prevents attackers from hijacking your internet traffic through malicious data injection.
:* Operational impact:: None for normal web browsing, application connectivity, or email traffic. This change does not affect legitimate DNS queries. The only noticeable difference is that the resolver strips extraneous diagnostic data before it reaches your local network devices.
2436037-1¶
The TMM configview API does not display certain GSLB custom resources
Component: dns-gslb engine
Symptoms: The TMM configview API does not display GSLB custom resources (F5BigGslbSyncAgent, F5BigGslbLocalInstance, F5BigGslbInstance, and F5BigGslbProberPool) and returns the error: “Object not found or not supported” The configview API displays other GSLB objects such as Server, Pool, and Wideip as expected.
Conditions: When querying TMM configview for GSLB configuration, the F5BigGslbSyncAgent, F5BigGslbLocalInstance, F5BigGslbInstance, and F5BigGslbProberPool custom resources are not displayed. Returns “Object not found or not supported” error. But, other GSLB objects such as gslb_server, gslb_vs, and gslb_tmm_wideip are visible in configview as expected.
Impact: No functional impact. GSLB configuration is correctly applied and operational. The CR status shows “CR config sent to all grpc endpoints.” The only impact is that these four CR types cannot be inspected via the TMM configview API and must be inspected using alternative methods (kubectl describe, tmctl stats).
Workaround: Use kubectl describe to inspect these CRs and verify their delivery status. For runtime state, use tmctl stats on the gslb-engine pod:
F5BigGslbLocalInstance: kubectl describe f5-big-gslb-local-instances.k8s.f5.com
F5BigGslbInstance: kubectl describe f5-big-gslb-instances.k8s.f5.com
F5BigGslbProberPool: kubectl describe f5-big-gslb-prober-pools.k8s.f5.com
F5BigGslbSyncAgent: kubectl describe f5-big-gslb-sync-agents.k8s.f5.com
2471977-1¶
Deleting applied GSLB Instance custom resources required when upgrading the F5 CNF CRD bundle from BNK 2.2.4/2.2.3 to 2.4.0
Component: dns-gslb general
Symptoms: When you upgrade the F5 CNF CRD bundle (f5-cnf-crds Helm chart) from BIG-IP Next for Kubernetes 2.2.4 (or earlier 2.2/2.3 releases) to 2.4.0, the upgrade fails with the following error:
helm upgrade f5-cnf-crds f5-cnf-crds-<version>.tgz -n default
Error: UPGRADE FAILED: cannot patch "f5-big-gslb-instances.k8s.f5.com"
with kind CustomResourceDefinition: CustomResourceDefinition.apiextensions.k8s.io
"f5-big-gslb-instances.k8s.f5.com" is invalid: status.storedVersions[0]:
Invalid value: "v1alpha1": must appear in spec.versions
Conditions: Occurs when:
You previously provisioned the cluster with the F5 CNF CRD bundle from a 2.2.x/2.3.x release, where the GslbInstance CRD exposed only the
v1alpha1API version.The 2.4.0 CRD bundle removes
v1alpha1from the GslbInstance CRD and exposes onlyv1, because GSLB moves from Early Access to Generally Available (GA) in 2.4.0 and the CRD schema standardizes onv1.The existing CRD’s
status.storedVersionsstill referencesv1alpha1, which Kubernetes requires to remain inspec.versionsbefore you can remove it.This occurs even if you have not created any GslbInstance custom resources on the cluster, because Kubernetes sets
status.storedVersionswhen it establishes the CRD and does not clear it automatically.
Impact: The f5-cnf-crds Helm chart upgrade fails and blocks the overall platform upgrade from 2.2.4/2.3.x to 2.4.0.
Workaround: Before you upgrade the CRD bundle to 2.4.0:
Back up and delete any existing GslbInstance (
v1alpha1) custom resources from the cluster.Delete the existing CRD:
kubectl delete crd f5-big-gslb-instances.k8s.f5.com
Run the Helm upgrade of the CRD bundle (
f5-cnf-crds) to 2.4.0.Recreate any required GslbInstance custom resources using the
v1API version after the upgrade completes.
2460797-1¶
GSLB Engine does not auto-exchange certificates with BIG-IP LTM when a certificate expires or changes
Component: dns-gslb general
Symptoms: When you configure a GSLB Engine with a GSLB Server of type BIGIP-LTM, you provide a secretRef containing the root password for the referenced TMOS BIG-IP. The GSLB Engine uses this password to establish an SSH connection and perform a certificate exchange with the BIG-IP, which enables an iQuery connection between the TMOS BIG-IP’s big3d and the GSLB Engine.
These certificates include a duration field that defines when they expire. You may also choose to update the certificate manually.
In both scenarios, the GSLB Engine does not automatically perform another certificate exchange. As a result, when the system attempts to re-establish an iQuery connection, the BIG-IP rejects the connection.
Conditions: Occurs when:
You have configured a GSLB Server of type BIGIP-LTM with a valid
secretRefthat references a valid root password for the TMOS BIG-IP.You want to change the certificates, or the certificate has expired.
Impact: The BIG-IP rejects iQuery connections between the GSLB Engine and big3d the next time the system establishes a connection. This prevents the GSLB Engine from monitoring TMOS BIG-IP LTM resources.
Workaround: Delete the GSLB server configuration and recreate it.
2285413-3¶
GSLB inter-instance traffic on non-Sync Agent member is routed through the Kubernetes pod network instead of the TMM internal VLAN
Component: dns-gslb sync group
Symptoms: On the non-Sync Agent member of a GSLB Sync Group deployed on OpenShift, incoming GSLB traffic from the Sync Agent is received by TMM but is forwarded to the GSLB Engine via the Kubernetes pod network interface (eth0) instead of the TMM internal VLAN (shim interface). This causes GSLB inter-engine communication to use an incorrect network path, with ingress traffic not following the same data plane path as egress traffic.
Conditions: A GSLB Sync Group with two or more CNF deployments is configured on OpenShift. The non-Sync Agent member receives GSLB traffic from the Sync Agent. The f5ingress controller does not add the required static route on TMM to direct GSLB traffic through the internal VLAN interface.
Impact: GSLB traffic between Sync Group members on the non-Sync Agent side flows through the Kubernetes pod network instead of the TMM data plane. This results in asymmetric routing where egress GSLB traffic uses the correct internal VLAN path but ingress GSLB traffic bypasses it. This may cause GSLB health monitoring (e.g., HTTPS monitors) and probe traffic to fail or behave unexpectedly.
Workaround: There is no known workaround at this time.
2339825¶
GSLB Sync Group members on OpenShift clusters can lose connectivity to the Kubernetes API, preventing configuration synchronization.
Component: DoS
Symptoms: One GSLB Sync Group member cannot synchronize its GSLB configuration (wide IPs, pools, servers) with the rest of the group. Its logs repeatedly report errors while creating or updating GSLB custom resources, and its GSLB server objects remain in a NotReady state.
Conditions: This occurs when a GSLB Sync Group member is deployed on an OpenShift cluster using the OVN-Kubernetes network plugin (CNI). Sync group members deployed on non-OpenShift Kubernetes clusters are not affected.
Impact: The affected sync group member cannot create or update its own GSLB configuration objects and cannot exchange configuration with other members. The rest of the sync group considers this member as permanently out of sync. Until the issue is resolved, the affected member delivers degraded or unavailable GSLB service.
Workaround: At install time, configure the CSRC component’s Helm values (config.excludeCidr) with the affected cluster’s pod, service, and node CIDR ranges to restore normal Kubernetes API connectivity for that cluster’s GSLB pods.
2046925-3¶
TCP throughput degradation during UDP DDoS attack with DPU hardware acceleration
Component: DoS
Symptoms: Lower TCP throughput degradation could be observed during ongoing UDP DDoS attack on DPU platforms even when Global DDoS mitigation is configured.
Conditions: Occurs when,
Global DDoS config has TCP and UDP vectors configured.
DDoS hardware DPU acceleration is enabled.
TCP and UDP traffic is being processed simultaneously.
Impact: Up to 30% degradation in throughput.
2455041-1¶
Sentinel crash on long-running product deployment
Component: dssm
Symptoms: Sentinel pods crash when they run for an extended period with the CPU resource limit set to 1.
Conditions: You deployed Sentinel using the f5-dssm Helm chart with a CPU limit of 1 in the override file.
Impact: This issue causes no functional impact but may affect primary database election.
Workaround: Increase the CPU limit to 2 or higher to accommodate occasional spikes in CPU usage.
2390145-2¶
Egress traffic is disrupted during the upgrade process
Component: egress
Symptoms: Egress traffic from the application pod will fail following the upgrade.
Conditions: Version upgrade and TMM Pod restart.
Impact: VXLAN interfaces and IP routes are wrongly provisioned on node and TMM, resulting in disruption of egress traffic.
Workaround: Delete Egress CR and restart the cne-controller pod. Improved the APP-TMM pod IP mappings synchronization logic in BIG-IP Next for Kubernetes 2.3.0 and higher versions.
2330917-1¶
Egress catchall virtual servers may not restore after you delete and recreate a dependent VRF
Component: egress
Symptoms: When an Egress custom resource depends on a flow-forward VLAN in a VRF and you delete and recreate that VRF, the Egress resource may transition back to Ready=True without fully recreating all Egress-related configuration.
Specifically, the system may restore only the primary IPv4 and IPv6 Egress virtual servers while failing to recreate the catchall IPv4 and IPv6 virtual servers.
Conditions: This issue occurs when all four of the following conditions are met:
You configure an Egress custom resource with a flow-forward VLAN in a specific VRF (for example, VRF A).
You enable the flow-forwarding feature on that Egress custom resource.
You delete VRF A and then recreate it.
The Egress custom resource recovers to
Ready=Trueafter the VRF is restored.
Impact: The Egress custom resource may report a healthy (Ready=True) status while TMM does not program its catchall virtual servers.
This creates a mismatch between the custom resource status and the actual dataplane configuration, which can affect inter-TMM flow-forwarding traffic.
Workaround: After recreating the dependent VRF, reapply the affected Egress CR(s). Reapplying the Egress CR forces reconciliation and restores the missing catchall virtual servers.
2503217¶
Egress traffic load balancing failure after TMM internal IP reconfiguration
Component: egress
Symptoms: Egress traffic load balancing fails when you reconfigure the TMM internal IP.
Conditions: Occurs when:
Deploy the BNK 2.4 build.
Scale up the TMM pods to a value greater than the number of internal VLAN self IPs in the F5SPKVlan custom resource. Ensure at least one TMM is in standby mode.
Update the internal IPv4 and IPv6 self IPs with new addresses in the F5SPKVlan custom resource and apply it.
Impact: The egress traffic load balancing does not working.
Workaround: Scale down TMM pods so that there is no standby TMM pod in the cluster.
1889425-5¶
Egress traffic fails during an f5-tmm pod restart event
Component: fsm-networking
Symptoms: Egress traffic fails while one or more f5-tmm pods are restarting.
Conditions: Occurs when,
SPK is installed and configured to handle egress traffic from watched namespaces.
One or more f5-tmm pods crash or are restarted by Kubernetes.
Impact: Egress traffic might fail from traffic routing to an f5-tmm pod that is restarting.
2471117-1¶
Partial and temporary ingress traffic loss during node reboot
Component: ingress
Symptoms: Healthy TMM pods drop traffic destined for an application pod on a rebooted node until the controller notifies them that the application pod is down. If the controller’s own node reboots, the disruption window is longer because the controller must recover first before it can notify TMM pods about the affected application pod.
Conditions: You reboot a Kubernetes node that hosts one or more application pods. However, healthy TMM pods continue to route traffic to the now-unavailable application pod because the controller has not yet detected and communicated the pod’s failure.
Impact: Healthy TMM pods drop traffic to the affected application pod from the moment the node reboots until the controller detects the pod failure and sends an exception to TMM, which triggers the removal of the unavailable pool member.
If the controller’s node reboots, the outage duration increases because the controller must fully restart before it can reconcile the application pod’s state and update TMM.
Traffic restores automatically when the affected pod becomes available again. The controller detects the pod’s recovery, updates TMM with the revised pool member configuration, and load balancing to the pod resumes.
Workaround: To minimize traffic disruption caused by TMM forwarding requests to unavailable application pods, configure health monitors on the Pool custom resource that your HTTPRoute backendRefs reference.
When you enable health monitors (such as HTTP, TCP, or ICMP) on a Pool, TMM actively probes pool members and can independently mark an application pod as down without waiting for the controller to detect and relay the pod failure. This significantly reduces the time that TMM routes traffic to an unavailable pod.
Select the appropriate monitor type and configure the relevant parameters (including interval, timeout, and send/receive strings) based on your application protocol to ensure prompt failure detection.
2455985-1¶
Renaming of metric scraping CRDs
Component: ingress
Symptoms: As part of complying with F5 Standardization, the following CRDs are renamed from the metrics.f5.net domain to the metrics.f5.com domain:
scrapetemplates.metrics.f5.net → crapetemplates.metrics.f5.com
scrapeclasses.metrics.f5.net → scrapeclasses.metrics.f5.com
scrapes.metrics.f5.net → scrapes.metrics.f5.com
Conditions: As part of a helm limitation, the helm upgrade does not recreate the renamed CRDs by default.
Impact: F5 Ingress upgrade fails.
Workaround: This manual procedure is only needed for upgrades to 2.4, per the name change.
Apply new CRDs directly from the Observer chart
helm show crds .../f5-toda-observer-< UPGRADE VERSION>.tgz | kubectl apply -f -Remove stale old-group objects
kubectl delete scrapetemplate.metrics.f5.net --all --all-namespaces || truekubectl delete scrapeclass.metrics.f5.net --all || trueUpgrade observer
helm upgrade observer .../f5-toda-observer-<VERSION>.tgz ...Upgrade ingress
helm upgrade f5ingress ... /<UPGRADE-F5INGRESS-VERSION>.tgzRemove the old CRD definitions (optional)
kubectl delete crd scrapetemplates.metrics.f5.netkubectl delete crd scrapeclasses.metrics.f5.netkubectl delete crd scrapes.metrics.f5.net
2488649-1¶
Stale GatewaySetting configurations persist across TMM, VPC route table, and IPAM after EgressGateway CR update
Component: ingress
Symptoms: When you update the EgressGateway custom resource to reference a new GatewaySettings custom resource, the system does not properly clean up the old settings across TMM, the VPC route table, and IPAM.
As a result, stale configurations from the previous GatewaySetting persist and may conflict with the new configuration, which can disrupt traffic.
Conditions: Occurs when:
The required custom resources (Infra CR, GatewaySettings CRs, EgressGateway CR) are applied.
All the custom resource statuses show
True.The
parametersRefsection of the EgressGateway custom resource reference a new GatewaySettings custom resource.
Impact: Stale configurations may conflict with the new configurations and disrupt traffic.
Workaround: Option 1: Delete and recreate the EgressGateway custom resource with the updated GatewaySettings custom resource reference to ensure the system runs the correct cleanup processes.
Option 2: Update the GatewaySettings custom resource directly if no other Gateway or EgressGateway references it.
2284529-1¶
Stale egress configuration on TMM with multi-VRF VLAN references
Component: ingress
Symptoms: Although the controller rejects the Egress custom resource because the dependent custom resources are in different VRFs, TMM retains stale egress configuration. The Egress custom resource initially references a VLAN in one VRF, and when the next VLAN is created in a different VRF, TMM does not clean up the original configuration. This results in an inconsistent configuration on TMM.
Conditions: Occurs when,
Create an Egress custom resource with a VLAN in the
TmmInterfacesection that belongs to the red VRF, and reference a second VLAN in the flow-forwarding section.Create the second VLAN referenced in the flow-forwarding section in a different VRF.
Impact: TMM retains stale egress configuration until you move the VLAN to the correct VRF and reapply the VLAN custom resource.
Workaround: Move the VLAN to the correct VRF and reapply the VLAN custom resource. Ensure all configurations referenced in the Egress custom resource belong to a single VRF.
2331381-1¶
Custom resource status may remain stuck at False after a TMM pod restart or crash
Component: ingress
Symptoms: After a TMM pod restart or crash, one or more SPK custom resource statuses may remain stuck at False with the message “Waiting for one or more dependent CRs to be applied,” even though TMM successfully applied the configurations.
Conditions: A TMM pod crashes or restarts in an SPK deployment that has configured dependent custom resources.
Impact: No traffic impact. The custom resource status incorrectly reports False with “Waiting for one or more dependent CRs to be applied” even though TMM successfully applied the configuration.
Workaround: Delete and reapply the affected stuck custom resources to trigger reconciliation and restore the correct status.
2502537-1¶
BNK fails to provision Vxlan CRs on TMM when deployed with OcNOS and Vxlan on an OCP cluster
Component: ingress
Symptoms: The system intermittently fails to provision Vxlan CRs on TMMs. The logs confirm that the communication to the Kube API Server times out.
Conditions: This occurs when BNK is deployed with OcNOS, VRF and Vxlan are enabled on the OCP 6 node cluster with separate control and worker plane nodes. This is a pending case on Red Hat (ID: 04532910).
Impact: Ingress and Egress traffic will fail when BNK is deployed with OCNOS and VXLAN combination on an OCP 6-node cluster.
Workaround: Add required support for provisioning the VXLAN CR correctly without an API server timeout when BNK is deployed with OCNOS and VXLAN combination on the OCP clusters.
2459457-1¶
BNK fails to route egress traffic when deployed with OcNOS, Vxlan, and Vrf on an OCP cluster
Component: ingress
Symptoms: BNK fails to route egress traffic when deployed with OcNOS, VXLAN, and VRF on an OCP cluster. The OVN network does not populate the required routes for the specified app pod.
Conditions: This occurs when BNK is deployed with OcNOS, Vrf, Vxlan enabled on the OCP cluster. This is pending on Red Hat case # 04532910.
Impact: Egress traffic failed when BNK deployed with OCNOS, VXLAN and VRF combination on OCP cluster.
2284409-3¶
No automatic reassignment of freed IPs to failed gateways
Component: IPAM
Symptoms: When the IP pool is exhausted, new Gateway resources fail to obtain an IP address. When a Gateway is deleted and its IPs are freed, the IPs are not automatically reassigned to Gateways that previously failed due to IP exhaustion.
Conditions: Occurs when
The IP pool is fully exhausted.
Multiple Gateway resources fail due to lack of available IPs.
An existing Gateway (with a successfully allocated IP) is deleted, freeing an IP.
Impact:
Gateways that failed due to IP exhaustion remain failed.
IP allocation isn’t automatically retried for affected Gateways.
Manual intervention is required to recover.
Workaround: To allocate an IP to a Gateway that failed due to IP exhaustion:
Delete the affected Gateway resource.
Recreate the Gateway resource. This triggers a new IP allocation attempt, allowing the system to assign any available (freed) IP.
2460133¶
ESP packets appear on the f5-ipsec pod during traffic transmission
Component: IPSec
Symptoms: TMM intermittently leaks ESP packets and forwards them to the IPsec pod when the tunnel count exceeds 1,000.
Conditions: Triggering traffic with 1,000 tunnels causes intermittent ESP leaks at the IPsec pod.
Impact: Specific client traffic triggers ESP leaks at the IPsec pod, causing data loss.
2288025-1¶
Delayed DSSM availability after database failover in Sentinel deployment
Component: PE
Symptoms: In a Sentinel-based DSSM deployment, when the primary database goes down, failover to the new primary database takes approximately seven seconds with the default down-after-milliseconds parameter value of 5. During this interval, DSSM cannot process requests from the application and resumes serving requests only after the failover completes.
Key impacts during this seven-second interval include inconsistencies in RADIUS accounting:
Subscriber creation / accounting start: The system does not create subscribers. As a result, subscriber policies cannot apply until the next accounting update.
Subscriber deletion / accounting stop: The system fails to delete subscribers, which leaves stale entries in the system.
Re-Authentication Request (RAR): During RAR, the system cannot update new policies to DSSM. As a result, some subscribers may lose their applied policies during this brief downtime.
Conditions: DB failover
Impact: DSSM does not serve application requests during this interval.
2483861-1¶
cert-manager reports certificate as Ready=True while holding issuance retries in backoff after an issuer misconfiguration
Component: TLS/SSL
Symptoms: A certificate shows Ready=True even though recent issuance attempts failed and the certificate is nearing expiry. After you fix an invalid ClusterIssuer, no new Order appears immediately, and deleting stale CertificateRequest, Order, and Challenge resources does not force a retry.
Conditions: An invalid ACME directory URL in the ClusterIssuer causes the certificate authority (CA) to reject the order and places cert-manager into exponential backoff (1–32 hours). The existing TLS secret remains valid, so the certificate shows Ready=True. The operator checks during the backoff window.
Impact: No traffic impact — the existing TLS secret continues to serve traffic. The only impact is operational: the absence of new Orders during backoff can mislead operators into thinking recovery has failed.
Workaround: After you fix the ClusterIssuer, wait for the backoff period to elapse. cert-manager auto-recovers by recreating the CertificateRequest → Order → Challenge chain and renewing the secret. Deleting child resources does not speed up this process because cert-manager enforces backoff at the account level.
To force immediate re-issuance (optional), use one of the following methods:
Run cmctl renew (if cmctl is installed):
cmctl renew <cert-name> -n <namespace>
Patch the Certificate status to set Issuing=True with reason RenewalRequested:
kubectl patch certificate <cert-name> -n <namespace> \
--subresource=status \
--type='merge' \
-p '{
"status": {
"conditions": [
{
"type": "Issuing",
"status": "True",
"reason": "RenewalRequested",
"message": "Manually triggered issuance of Certificate",
"lastTransitionTime": "'$(date -u +'%Y-%m-%dT%H:%M:%SZ')'"
}
]
}
}'
Rollout-restart the cert-manager pods to clear the in-memory backoff timers. Delete and recreate the issuer and certificate with a valid configuration. Reference: https://cert-manager.io/v1.11-docs/faq/#what-happens-if-issuance-fails-will-it-be-retried
2482985-1¶
TODA operator cannot persist status updates after forced pod termination
Component: toda_observer
Symptoms: After an abrupt or forced termination of the TODA Observer Operator or Observer worker pods (for example, using kubectl delete pod --force --grace-period=0 or an ungraceful crash), the system fails to transition newly created or updated ScrapeTemplate custom resources (CRs) to a Running state (Ready=True). Instead, these CRs remain stuck in a Pending or Error state (Ready: 0/N, Ready=False).
The Operator and Observer logs display RPC timeout errors such as:
rpc error: code = Unknown desc = query timed out in expression evaluation
The system takes approximately 10–15 minutes to resolve the CR status and recover automatically.
The Operator and Observer logs report RPC timeout errors such as:
rpc error: code = Unknown desc = query timed out in expression evaluation
The CR status may remain unresolved for approximately 10–15 minutes before eventually recovering on its own.
Conditions: The system abruptly or forcibly terminates the TODA Observer Operator or Observer worker pods without performing a graceful shutdown, severing sockets without sending TCP FIN/RST packets. The user applies or modifies new ScrapeClass or ScrapeTemplate CRs shortly after the restart, within the connection cache or retransmission window. This issue occurs on Kubernetes environments (such as bare-metal or ARM64 with Calico and VXLAN networking) where abruptly destroyed network interfaces leave stale half-open TCP connections in the kernel’s ESTABLISHED state.
Impact: Metrics scraping configuration and data collection for newly created ScrapeTemplate resources are delayed or fail to initialize for 10–15 minutes. Normal data path metrics collection resumes automatically once the stale socket window expires.
Workaround: Graceful deletion: Avoid using –force –grace-period=0 when deleting Observer pods, allowing the operating system to send proper TCP FIN/RST packets and cleanly drain sockets. Wait for socket sxpiration: If forced pod termination has occurred, wait approximately 10–15 minutes before creating new ScrapeTemplate CRs to allow the Linux kernel TCP retransmission budget (tcp_retries2) to reap stale sockets. Kernel / CNI Tuning: Reducing the node’s net.ipv4.tcp_retries2 setting or switching Calico to eBPF mode helps mitigate hung sockets across ungraceful interface tear-downs.
2456521-1¶
Qkview displays misleading “Running” status after CWC pod restart
Component: toda_qkview
Symptoms: When a qkview capture is in progress and the CWC pod restarts, the status continues to show “Running” indefinitely with a 0B size. The qkview is not actually running — the pod restart terminated the capture. The API reads stale on-disk state after the restart and returns the misleading status.
Attempting to cancel the qkview fails with: “cancel requested for non-running qkview,” which confirms the status is incorrect.
Conditions: Occurs when:
You start a qkview capture while CWC is running.
The CWC pod restarts during the capture.
Impact: Users see a misleading “Running” status for orphaned qkviews.
Workaround: Delete the stale qkview entry.
2503545-1¶
Toggling SelfIP count in one VLAN may result in missing config for other VLANs
Component: ingress
Symptoms: Missing VLAN config on some TMMs.
Conditions: Reducing the number of SelfIPs on a VLAN, then increasing it back to the original count. For example: two SelfIPs -> one SelfIP -> two SelfIPs
Impact: VLAN config from unmodified VLANs may be missing from some TMMs.
Workaround: Delete and re-apply the VLAN CRs that have missing config.
2330929-8¶
ACL hardware stat intermittently out of sync
Component: Firewall (ACL)
Symptoms: The hw_counter field in the fw_rule_stat tmctl table may intermittently fail to increment.
Conditions: This occurs intermittently for gateway attached firewall policies.
Impact: ACL hw_counter stat may report values lower than actual traffic counts.
Workaround: Remove and reapply the configurations to reset the stats.
2503177-1¶
CNF NAT44 connection per second performance degrades with small packet size
Component: fsm
Symptoms: Connection per second performance degradation is seen with small packet size such 128 bytes.
Conditions: Connection is initiated with small packet.
Impact: With large amount of small packet connection, the connection per second performance degrades.
Workaround: Remove and reapply the configurations to reset the stats.
2503133-1¶
Recreated VLAN with AUTO_LASTHOP_DISABLED can disrupt traffic using dynamic routes
Component: fsm
Symptoms: After a VLAN with AUTO_LASTHOP_DISABLED is recreated, traffic may stop when its return route is a dynamic route whose gateway uses that VLAN. The route may display as resolved while remaining unresolved internally.
Conditions: Occurs when:
VLAN is deleted and recreated, AUTO_LASTHOP_DISABLED is set on VLAN.
A dynamic route uses a gateway reachable through that VLAN.
The route is not re-advertised after VLAN recreation.
Impact: Connections using the affected return route fail or remain stalled. Unrelated traffic is unaffected.
Workaround: Clear and re-establish the BGP session with the neighbor on the affected VLAN. This can be done through the clear bgp <nbr> command in OcNOS/ZebOS. The routes will be withdrawn and re-advertised, allowing TMM to resolve them against the recreated VLAN.
2332481-1¶
VXLan reinstall may require retry when recreating during a pending delete
Component: fsm-dynamic-routing
Symptoms: When you delete a VXLan and quickly follow with a create, the system may reject the create because the delete is still pending. If you retry the create a few seconds later, it succeeds. This can cause a silent failure in automation that does not handle error checking, which can lead to unexpected BGP running configuration for objects that use that VXLan.
Conditions: When you delete and reapply VxLAN custom resources, TMM pods end up in an inconsistent configuration state. Each TMM has different VRF configurations, VNI/VXLAN interfaces have incorrect or missing VRF assignments, and BGP VRF address families are missing.
Impact: All tenant traffic (EVPN/VXLAN) breaks after you reinstall the VXLAN custom resource. Affected pods lose VRF isolation. BGP does not advertise or receive VRF routes. The cluster does not self-heal.
Workaround: In automation, use kubectl delete with –wait=true and check error handling. If manual, wait to retry.