A vulnerability in F5's DNS products lets a remote attacker knock the affected system out of service, and there is no patch for it. The flaw is tracked as CVE-2026-42534, and F5 has published an advisory that offers workarounds rather than a fix. Hong Kong's CERT relayed the advisory in a security bulletin and rated it high risk, specifically because no patch is currently available.
That is the part worth acting on. A denial-of-service bug is not the most alarming class of flaw on its own, but BIG-IP DNS sits in front of other infrastructure and resolves names for it, so an outage there does not stay contained to one box. Organizations that cannot patch have to fall back on configuration changes, and those changes need to be made deliberately rather than during an incident.
What's affected
- BIG-IP Next SPK 2.0.0 to 2.0.3 and 1.7.0 to 1.9.2
- BIG-IP Next CNF 2.0.0 to 2.3.2 and 1.1.0 to 1.4.3
- BIG-IP Next for Kubernetes 2.0.0 to 2.3.2
- BIG-IP DNS 21.1.0, 17.5.0 to 17.5.1, and 17.1.0 to 17.1.3
No CVSS severity score has been published for CVE-2026-42534 at the time of writing. The high-risk rating quoted above is the CERT's own assessment, driven by the absence of a patch rather than by a scored measure of the flaw itself.
What is and is not known
Neither the vendor summary nor the bulletin describes how the vulnerability is triggered, what an attacker needs in order to reach it, or whether anyone has exploited it. F5's own advisory carries whatever detail exists, and readers who run these products should work from that rather than from any secondhand reconstruction.
The one thing the published guidance does indicate is where the risk sits. Every workaround F5 offers concerns the DNS resolution path: restricting which upstream servers a resolver will talk to, protecting that path against tampering in transit, and turning the functionality off where it is not needed. That points at the resolver side of the product rather than at, say, the management interface, but it is an inference from the mitigation advice and not a statement about the mechanism.
What you should do
Until F5 ships a fix, the vendor recommends four measures:
- Restrict upstream DNS servers. Configure the DNS cache resolvers on your BIG-IP systems to query only trusted, internal DNS servers.
- Use DNS over TLS. Where it is supported, resolving over TLS prevents an attacker positioned on the DNS path from injecting crafted EDNS responses.
- Segment the network. Isolate the DNS resolution path so upstream servers sit on a trusted, protected segment.
- Limit DNS features. If DNS or DNS cache resolution is not required on a given system, disable it and remove the attack surface entirely.
Anyone running the affected versions should also plan for the patch, because these workarounds constrain the environment rather than remove the bug. Network appliances of this kind are a standing target: IntelFusions reported earlier this month on attackers exploiting a critical flaw in Progress LoadMaster, another load balancer sitting in the same position on the network. There is no indication of exploitation of the F5 issue at this stage.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.