{"cve":{"cve_id":"CVE-2025-47148","is_kev":false,"kev_date_added":null,"kev_vendor_project":null,"kev_product":null,"kev_vulnerability_name":null,"kev_short_description":null,"kev_required_action":null,"kev_due_date":null,"kev_known_ransomware":null,"kev_notes":null,"kev_cwes":null,"epss_score":0.00392,"epss_percentile":0.31617,"epss_as_of":"2026-10-15","description":"When the BIG-IP system is configured as both a Security Assertion Markup Language (SAML) service provider (SP) and Identity Provider (IdP), with single logout (SLO) enabled on an access policy, undisclosed requests can cause an increase in memory resource utilization.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","published_at":"2025-10-15T13:55:42.932000Z","last_modified_at":"2026-10-08T12:10:00.217000Z","cvss_v3_score":6.5,"cvss_v3_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_v3_severity":"MEDIUM","cvss_v4_score":7.1,"cvss_v4_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L","cvss_v4_severity":"HIGH","ssvc_decision":null,"ssvc_exploitation":"none","ssvc_automatable":false,"ssvc_technical_impact":"partial","cwes":["CWE-404"],"nvd_references":["https://my.f5.com/manage/s/article/K000148816"],"vuln_status":"Analyzed","trending_score":null,"is_trending":false,"has_trended":false,"trended_number_one":false,"trending_peak_score":null,"trending_peak_rank":null,"started_trending_at":null,"trended_number_one_at":null,"summary_generated":null,"summary_generated_at":null,"summary_model":null,"created_at":"2026-06-24T00:09:39.878444Z","updated_at":"2026-10-10T21:36:59.224259Z"},"effective_severity":"HIGH","badges":[],"impact_analysis":[],"cvss_v3_decoded":{"version":"3.1","metrics":[{"metric":"AV","name":"Attack Vector","value":"N","value_label":"Network"},{"metric":"AC","name":"Attack Complexity","value":"L","value_label":"Low"},{"metric":"PR","name":"Privileges Required","value":"L","value_label":"Low"},{"metric":"UI","name":"User Interaction","value":"N","value_label":"None"},{"metric":"S","name":"Scope","value":"U","value_label":"Unchanged"},{"metric":"C","name":"Confidentiality","value":"N","value_label":"None"},{"metric":"I","name":"Integrity","value":"N","value_label":"None"},{"metric":"A","name":"Availability","value":"H","value_label":"High"}]},"cvss_v4_decoded":{"version":"4.0","metrics":[{"metric":"AV","name":"Attack Vector","value":"N","value_label":"Network"},{"metric":"AC","name":"Attack Complexity","value":"L","value_label":"Low"},{"metric":"AT","name":"Attack Requirements","value":"N","value_label":"None"},{"metric":"PR","name":"Privileges Required","value":"L","value_label":"Low"},{"metric":"UI","name":"User Interaction","value":"N","value_label":"None"},{"metric":"VC","name":"Confidentiality (Vulnerable System)","value":"N","value_label":"None"},{"metric":"VI","name":"Integrity (Vulnerable System)","value":"N","value_label":"None"},{"metric":"VA","name":"Availability (Vulnerable System)","value":"H","value_label":"High"},{"metric":"SC","name":"Confidentiality (Subsequent System)","value":"N","value_label":"None"},{"metric":"SI","name":"Integrity (Subsequent System)","value":"N","value_label":"None"},{"metric":"SA","name":"Availability (Subsequent System)","value":"L","value_label":"Low"}]},"affected":[{"vendor_slug":"f5","vendor_name":"F5","product_slug":"big-ip","product_name":"BIG-IP","version_start":"17.5.0","version_start_inclusive":true,"version_end":"17.5.1","version_end_inclusive":false,"cpe23_uri":"cve5:f5:big-ip:17.5.0:17.5.1"},{"vendor_slug":"f5","vendor_name":"F5","product_slug":"big-ip","product_name":"BIG-IP","version_start":"17.1.0","version_start_inclusive":true,"version_end":"17.1.3","version_end_inclusive":false,"cpe23_uri":"cve5:f5:big-ip:17.1.0:17.1.3"},{"vendor_slug":"f5","vendor_name":"F5","product_slug":"big-ip","product_name":"BIG-IP","version_start":"16.1.0","version_start_inclusive":true,"version_end":"16.1.6.1","version_end_inclusive":false,"cpe23_uri":"cve5:f5:big-ip:16.1.0:16.1.6.1"},{"vendor_slug":"f5","vendor_name":"F5","product_slug":"big-ip","product_name":"BIG-IP","version_start":"15.1.0","version_start_inclusive":true,"version_end":"15.1.10.8","version_end_inclusive":false,"cpe23_uri":"cve5:f5:big-ip:15.1.0:15.1.10.8"},{"vendor_slug":"f5","vendor_name":"F5","product_slug":"big-ip-access-policy-manager","product_name":"big-ip_access_policy_manager","version_start":"15.1.0","version_start_inclusive":true,"version_end":"15.1.10.8","version_end_inclusive":false,"cpe23_uri":"cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*"},{"vendor_slug":"f5","vendor_name":"F5","product_slug":"big-ip-access-policy-manager","product_name":"big-ip_access_policy_manager","version_start":"17.5.0","version_start_inclusive":true,"version_end":"17.5.0","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:f5:big-ip_access_policy_manager:17.5.0:*:*:*:*:*:*:*"},{"vendor_slug":"f5","vendor_name":"F5","product_slug":"big-ip-ssl-orchestrator","product_name":"big-ip_ssl_orchestrator","version_start":"15.1.0","version_start_inclusive":true,"version_end":"15.1.10.8","version_end_inclusive":false,"cpe23_uri":"cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*"},{"vendor_slug":"f5","vendor_name":"F5","product_slug":"big-ip-ssl-orchestrator","product_name":"big-ip_ssl_orchestrator","version_start":"17.5.0","version_start_inclusive":true,"version_end":"17.5.0","version_end_inclusive":true,"cpe23_uri":"cpe:2.3:a:f5:big-ip_ssl_orchestrator:17.5.0:*:*:*:*:*:*:*"}],"exploit_refs":[],"news":[],"references":[{"url":"https://my.f5.com/manage/s/article/K000148816","source_type":"MISC","tags":[]}],"timeline":[{"type":"published","at":"2025-10-15T13:55:42.932000Z","label":"CVE published","source":null},{"type":"cvss_changed","at":"2026-06-28T17:46:37.370372Z","label":"CVSS score revised","source":"cvelistv5"},{"type":"cvss_changed","at":"2026-06-28T17:46:37.370372Z","label":"CVSS score revised","source":"cvelistv5"},{"type":"cvss_changed","at":"2026-06-28T17:46:37.370372Z","label":"CVSS score revised","source":"cvelistv5"},{"type":"cvss_changed","at":"2026-06-28T17:46:37.370372Z","label":"CVSS score revised","source":"cvelistv5"},{"type":"cvss_changed","at":"2026-06-28T17:46:37.370372Z","label":"CVSS score revised","source":"cvelistv5"},{"type":"cvss_changed","at":"2026-06-28T17:46:37.370372Z","label":"CVSS score revised","source":"cvelistv5"},{"type":"ssvc_changed","at":"2026-06-29T23:46:59.033383Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"ssvc_changed","at":"2026-06-29T23:46:59.033383Z","label":"SSVC decision revised","source":"vulnrichment"},{"type":"ssvc_changed","at":"2026-06-29T23:46:59.033383Z","label":"SSVC decision revised","source":"vulnrichment"}]}